caption - Attack Overview

2.1. 99 Nights Script.zip

The archive contains the 99 Nights Script Installer.msi file, along with files required to run "Ultimate Menu", a cheat mod for GTA Online.

caption - Contents of 99 Nights Script.zip

"99 Nights Script" is the name of an open-source mod for the popular game Roblox. The attacker disguised the EtherRAT installation MSI as this mod installer to induce users into executing the malware.

2.2. 99 Nights Script Installer.msi

Upon execution, the MSI file creates three files in the %LOCALAPPDATA%\msitemp directory:

| File Name | Description |
| --- | --- |
| Dt2fWrOyPtRxL28.js | Obfuscated JavaScript file that decrypts EtherRAT |
| IEgrjQr6OI6C3pf | Encrypted EtherRAT payload |
| syBKJQiN.cmd | Batch script that downloads Node.js and executes the JavaScript file

caption - Files created by the MSI

After file creation, the MSI CustomAction triggers the execution of syBKJQiN.cmd.

caption - MSI CustomAction table

2.3. syBKJQiN.cmd

The batch script first downloads Node.js to %LOCALAPPDATA%\6gahPD. It then copies the previously created Dt2fWrOyPtRxL28.js and IEgrjQr6OI6C3pf files to the same directory. Once copied, it exectues Dt2fWrOyPtRxL28.js using the downloaded Node.js executable.

caption - syBKJQiN.cmd Code

2.4. Dt2fWrOyPtRxL28.js

The Dt2fWrOyPtRxL28.js file is obfuscated using obfuscator.io and implements two specific anti-analysis techniques:

• Console Output Surpression: All console output is suppressed to hinder log analysis

• Formatting detection: If the code is formatted (beautified), dummy code executes, triggering an error.

If the anti-analysis checks pass, the decryption routine proceeds. It decrypts the EtherRAT payload using AES-256-CBC and saves it as the f6gK5600n6.js file in the current execution directory.

caption - AES-256-CBC decryption routine

The script then executes f6gK5600n6.js. Upon successful execution, it saves the JavaScript code responsible for running f6gK5600n6.js as areAx6ey.js in the current directory and establishes persistence by adding a Registry Run key pointing to this file.

2.5. f6gK5600n6.js

The decrypted file is the EtherRAT payload, which employs the same obfuscation and protection techniques as the decryptor. EtherRAT creates a svchost.log file in %APPDATA% to store logs.

caption - Log writing routine

Example log output:

[2025-12-31T06:57:30.086Z] Fetching URL from blockchain...
[2025-12-31T06:57:30.086Z]

C&C Server Address Resolution

EtherRAT does not hardcode C&C addresses; instead, it dynamically retrieves them via Ethereum smart contracts. The malware uses the eth_call method to query a hardcoded contract address. The data payload consists of the function signature 0x7d434425 and the contract creator's wallet address.

caption - Contract query routine

EtherRAT sends concurrent requests to distinct 9 Ethereum RPC endpoints. It selects the URL returned most frequently in the responses as its C&C server.

• https://eth.llamarpc.com

• https://mainnet.gateway.tenderly.co

• https://rpc.flashbots.net/fast

• https://rpc.mevblocker.io

• https://eth-mainnet.public.blastapi.io

• https://ethereum-rpc.publicnode.com

• https://rpc.payload.de

• https://eth.drpc.org

• https://eth.merkle.io

Configuration File Path Generation

EtherRAT generates the storage path for its configuration file using unique system information. It calculates the MD5 hash of the concatenated Computer Name and User Name strings.

The first byte of the hash (modulo 5) determines the parent folder name:

• 0: Microsoft

• 1: Windows

• 2: Programs

• 3: Package

• 4: Google

The second byte of the hash (modulo 5) determines the subfolder name:

• 0: Services

• 1: Components

• 2: Assemblies

• 3: Extensions

• 4: Modules

If the path %LOCALAPPDATA%\[Folder] exists, the configuration path becomes %LOCALAPPDATA%\[Folder]\[Subfolder]\[Hash_First_4_Bytes]. If the parent folder does not exist, it falls back to %LOCALAPPDATA%\[Folder]\[Hash_First_8_Bytes].

Finally, it uses the first 6 bytes of the folder path's hash as the configuration file name.

caption - Config path generation routine

The configuration file is stored as Base64-encoded JSON. The indices correspond to:

• 0: Unique ID

• 1: Connection status to reobf endpoint

• 3: Connection time to reobf endpoint

• 5: Log file writing status

ID Generation

The EtherRAT malware uses a unique ID to identify infected systems. First, it searches specific files to check if there's an existing issued ID. The first file searched is the configuration file; if the ID is stored in the configuration file, it's read and used. The ID is stored at index 0 of the configuration file.

If the ID is not stored in the configuration file, the second file searched is ".node_bot_id". If ".node_bot_id" exists, the contents are used as the ID.

caption - .node_bot_id File Search Routine

If the ".node_bot_id" file does not exist, the third search involves finding a file that starts with "." and is 11 characters long. If a file meeting these conditions is found, its contents are used as the ID. However, if all searches fail, a random ID is generated using the crypto module's randomUUID function and written to the configuration file.

caption - File Search and ID Creation Routine

Initial C&C Connection

During the initial C&C communication, the malware checks if index 1 of the configuration file is set and index 3 is empty. If these conditions are met, it uploads the file (whose name matches the value at index 1) from the configuration folder to the [C&C]/api/reobf/[ID] endpoint.

caption - File upload routine

Then, it updates index 3 with the current time, overwrites the uploaded file with the C&C server’s response, and executes it.

caption - Data overwrite and execution routine

C&C Communication

To mask malicious traffic, EtherRAT randomly selects one extension (png, jpg, gif, css, ico, webp) and one variable name (id, token, key, b, q, s, v) for its requests. It sends a POST request to [C&C Server]/api/[RandomHex]/[ID]/[RandomHex].[Extension]?[Variable]=5a15c932-4675-4a53-920d-3f3a7aa2e835.

caption - C&C communication routine

If a response is not received, the malware retries after approximately 3 seconds. If a response is received, the content is executed as JavaScript.

caption - Response execution routine

Although the C&C server was active during analysis, it returned no response, preventing further analysis of the payload.