ChainScript: the RAT that hides its command server inside a blockchain contract
Brief
Blackpoint uncovers ChainScript, a Node.js RAT that queries a Polygon smart contract to find and rotate its command server.
Blackpoint’s Adversary Pursuit Group was chasing a ClickFix campaign spreading an unknown RAT namend ChainScript. The malicious code is a previously undocumented Node. js remote access trojan that hides its command server on a public blockchain.
The infection starts with a familiar ClickFix trick. The victim gets talked into pasting and running a command that fires up msiexec. exe, which pulls down an installer dressed up as Spotify. Inside that installer sits a full Node. js runtime and a JavaScript agent ready to launch.
Once it runs, the installer scatters its pieces across folders with Microsoft-sounding names, blending into the rest of the system. A hidden PowerShell script kicks off a VBScript file, which then starts the bundled Node. js runtime.