ChainDrop EtherHiding C2 Resolution via eth_call to Malicious Contract

Jeff Daisley@JDaisley

•updated Aug 4, 2026•1•0•7

Detects outbound HTTP POST requests associated with the ChainDrop/Shai-Hulud malware family. The rule looks for 'eth_call' JSON-RPC method calls targeting a specific Ethereum smart contract address known to be used for EtherHiding C2 infrastructure, where malicious payloads or commands are embedded within blockchain interactions.