Inside SilentNET: Analysis of a Java-Based Infostealer with Blockchain-Based C2
Analysis of a SilentNET infostealer sample in Threat.Zone: blockchain-based C2 resolution, DNS-over-HTTPS lookups and a staged Python stealer.
SilentNET is an infostealer offered as a service. It is distributed mainly through trojanized Minecraft mods and malicious advertising. The family combines several evasion techniques in one infection chain. The malware:
reads the C2 address from a smart contract on the Polygon blockchain;
resolves hostnames over DNS-over-HTTPS;
stages a legitimate Python runtime in folders named after Windows components.
In this post, we use Threat.Zone to analyze a SilentNET sample: a 2.52 MB Java archive. Within about 40 seconds of execution, it had targeted credential and cookie stores in Chrome, Edge and Firefox, plus Electrum wallet and FileZilla data. By then it had also begun beaconing to its C2 server. We follow the infection stage by stage and cover:
how the loader resolves its C2 through the Polygon blockchain (EtherHiding);
how it keeps its lookups out of ordinary DNS;
how the Python stealer is staged and launched;
what data the stealer targets and how it communicates with its operator.
Figure 1: Threat.Zone verdict for the SilentNET sample: Malicious, 91/100 (Critical).
Key Takeaways
No detections at the time of writing: VirusTotal showed no detections for the loader, only generic behavioral tags. Threat.Zone gave it a Malicious verdict (91/100, Critical) based on its behavior.
C2 on the blockchain: The loader queried a public Polygon RPC node to find out where to go next, a technique known as EtherHiding. The C2 pointer cannot be taken down, and the file contains no domain for scanners to match.
No ordinary DNS lookups: The loader and the stealer both contacted DNS-over-HTTPS services, and none of the loader’s connections was preceded by an ordinary DNS lookup. DNS-based controls see very little.
Disguised as Windows: A full Python 3.12 runtime was written to %LOCALAPPDATA%\Microsoft\Windows\NtProfileIndex\, a folder named to imitate a system component.
Two-second theft: The stealer started Chrome and wrote into its memory, decrypted DPAPI-protected data, and requested seven browser credential and cookie stores. It also accessed Electrum wallets and FileZilla credentials. The whole sweep took about two seconds.
Session theft can bypass MFA: Stolen cookies can open authenticated sessions without a password or MFA prompt. That makes this a risk for organizations, not only for gamers.
Zero Detections: Why Static Tools Miss SilentNET
Figure 2: The SilentNET loader on VirusTotal. None of the 64 security vendors flagged the file.
At the time of writing, the JAR has a 0/64 detection rate on VirusTotal. VirusTotal’s behavioral analysis did not mark it as malicious either; it added only generic tags such as detect-debug-environment and checks-cpu-name. Inside Threat.Zone, the static scan also returned no verdict.
That is the result SilentNET was built to achieve. Each part of its design removes something a conventional control depends on:
Design choice
What it defeats
A thin Java first stage; the stealer is downloaded after execution
File signatures and static analysis
C2 address read from a smart contract instead of stored in the file
C2 extraction and domain reputation
Hostname lookups over DNS-over-HTTPS
DNS logging, sinkholes and DNS-layer security
A legitimate Python runtime instead of a custom binary
Hash and file-reputation blocking
Folders named after Windows components
Manual triage and path-based allowlists
Encrypted traffic on port 443 throughout
Network inspection without TLS decryption
Detecting a threat built like this means watching what it does, not what it looks like.
SilentNET Attack Chain
Execution: The victim runs the JAR. It relaunches itself as a separate Java process with a -restarted marker.
Encrypted name resolution: The loader connects to Cloudflare’s DNS-over-HTTPS resolver at 1.1.1.1:443.
EtherHiding lookup: The loader queries the Polygon blockchain through polygon.drpc.org to learn its next-stage address.
Payload download: About 17.7 MB arrives from the C2 server 185.178.208[.]191 (thisisafalsepositive[.]st). A Python 3.12 runtime is written to a fake Windows folder.
Stealer launch:python.exe runs AppHost\main.py with a per-victim identifier and campaign tags.
Preparation: The stealer runs host discovery, makes more DNS-over-HTTPS lookups and installs pip into a second fake Windows folder.
Chrome interaction: The stealer starts Chrome and writes data into its memory.
Theft: It decrypts DPAPI-protected data and reads seven browser stores, Electrum wallets and FileZilla credentials, all in about two seconds.
C2 beaconing: It makes thirteen connections to the C2 server, one roughly every 10.6 seconds.
Figure 3: The SilentNET process tree in Threat.Zone: nine processes across five levels.
Inside the SilentNET Infection: A Threat.Zone Walkthrough
Stage 1: A Java Loader That Restarts Itself
The sample starts as javaw.exe -jar (PID 2512) and immediately relaunches itself as a second Java process (PID 3764), naming its entry class explicitly:
The -restarted argument. The loader checks for this argument to recognize that it has already relaunched.
The net.fabric package name. It is one step away from net.fabricmc, the namespace of the legitimate Fabric Minecraft mod loader. A user looking at the class list would see nothing unusual.
All of the loader’s later activity comes from this second process.
Stage 2: Finding the C2 on the Blockchain
The loader’s first network action, 3.3 seconds after launch, is a connection to 1.1.1.1:443. This is Cloudflare’s resolver, which also serves DNS-over-HTTPS. Threat.Zone recorded that none of the loader’s three connections was preceded by an ordinary DNS lookup. This is consistent with a loader that resolves names over HTTPS, which keeps its lookups out of DNS logs.
At +5.4 s, the loader reached polygon.drpc.org, a public gateway to the Polygon blockchain. This is the EtherHiding step. The operator stores the current C2 address in a smart contract, and the loader reads it at runtime. The operator can move infrastructure at any time without changing the malware, and no registrar or hosting provider can remove the pointer.
The sample also sent requests to thisisafalsepositive[.]st, SilentNET’s current C2 domain. This domain is the value currently stored in SilentNET’s smart contract, and it points to 185.178.208[.]191. Combined with the DNS-over-HTTPS activity, this is consistent with the loader resolving its C2 domain without leaving an ordinary DNS lookup behind.
Figure 4: Two independent detections of the EtherHiding lookup in Threat.Zone.
Threat.Zone flagged this step in two independent ways:
Behavioral logic. Its Executable fetched from a hard-coded address or into a disguised folder, then launched indicator (80/100) recognized polygon.drpc.org as a public blockchain service that EtherHiding loaders read their next address from.
A network signature on decrypted traffic. After the sandbox decrypted the HTTPS session, the traffic matched ET MALWARE EtherHiding Exfil M2 (SID 2065530, 85/100).
Despite the signature’s name, this traffic is the C2 lookup, not exfiltration. It happens about 30 seconds before the first credential store is touched.
Stage 3: Dropping a Python Runtime into a Fake Windows Folder
At +7.6 s, the loader connected directly to 185.178.208[.]191:443, with no DNS lookup before it, and received 17,694,701 bytes. This address is the SilentNET C2 server behind thisisafalsepositive[.]st.
Between +19.0 s and +19.4 s, it wrote nine files into a single folder:
The file set matches a standard portable Python 3.12 runtime, so none of the names looks malicious on its own. The location is what gives them away. NtProfileIndex borrows the Nt prefix of Windows NT components and sits under Microsoft\Windows, a folder Windows does not keep programs in. Threat.Zone flagged the write as an Executable written into a folder imitating a Windows component (T1036.005).
Stage 4: The Stealer Starts, with Campaign Tags in Plain View
At +21.2 s, the loader started the stealer (PID 4572):
--env DoubleClick matches SilentNET’s ad-based distribution channel. The malware records how its victim was reached.
-u passes a UUID. This value is a per-victim identifier (prefireId) that ties stolen data to the operator’s campaign tracking.
Stage 5: Quiet Reconnaissance and a Second Python Environment
Before stealing anything, the stealer prepared its environment:
More DNS-over-HTTPS. It made six connections to cloudflare-dns.com between +25.4 s and +39.3 s.
Host discovery. It read the computer name with GetComputerNameExW (+27.1 s) and ran cmd.exe /c "ver" (+27.4 s).
A debugger check. It called OutputDebugStringW (+35.6 s). This API behaves differently when a debugger is attached, which fits VirusTotal’s detect-debug-environment tag.
A second disguised folder. At +33.3 s it wrote a second Python interpreter to %LOCALAPPDATA%\Microsoft\Windows\IManagementEngine\. At +35.6 s it ran that interpreter with get-pip.py, the bootstrap script for Python’s package manager.
The pip installation then ran in the background:
Threat.Zone recorded a connection to pypi.org at +60.4 s.
The pip-26.2.1 wheel was written to a temporary folder at +82.6 s.
406 files were rewritten across 54 directories at +87.3 s.
Threat.Zone flagged that bulk file activity as Mass in-place file transformation but scored it only 12/100. That is the right call: in context, this is package installation, not ransomware.
The IManagementEngine folder and the get-pip.py step are a consistent part of SilentNET’s infection chain.
Stage 6: Reaching into Chrome
The stealer launched chrome.exe (PID 4900) as its own child process. At +37.3 s, it wrote three blocks of data into Chrome’s memory: 4.4 KB, 50 bytes and 8 bytes. Half a second later, Chrome requested read-write-execute memory protection three times.
Figure 5: The stealer writes into the memory of the Chrome process it started.
The credential sweep began 0.8 seconds later. Recent Chrome versions protect cookies and other secrets with App-Bound Encryption, which ties decryption to the Chrome application itself. Stealers commonly get around this by running code inside a Chrome process. The sequence here (start Chrome, write into its memory, then read the browser stores) is consistent with that technique. The content of the injected data was not verified, so we treat this as an assessment rather than a confirmed finding.
Stage 7: Two Seconds to Sweep the Browsers
The theft itself took about two seconds, from +37.2 s to +39.2 s.
The stealer called CryptUnprotectData twice:
at +37.2 s, just before reading Chrome’s stores;
at +38.7 s, just before reading Edge’s stores.
Chromium browsers protect the key that encrypts saved passwords and cookies with the Windows Data Protection API (DPAPI). This timing fits the stealer recovering one key per browser.
Figure 6: Threat.Zone’s highest-scoring indicator links DPAPI decryption, a multi-browser sweep and outbound activity.
The stealer then requested seven stores:
Time
Browser
Store
What it holds
+38.1 s
Chrome
Login Data
Saved passwords
+38.3 s
Chrome
Network\Cookies
Session cookies
+38.6 s
Chrome
Web Data
Autofill, including saved payment cards
+38.8 s
Edge
Login Data
Saved passwords
+38.8 s
Edge
Network\Cookies
Session cookies
+38.8 s
Edge
Web Data
Autofill, including saved payment cards
+38.9 s
Firefox
cookies.sqlite
Session cookies
At +38.3 s, a temporary file named tmpnuk5yp_n.db appeared in %TEMP%. The tmp + 8-character pattern is how Python’s tempfile module names files. Stealers commonly copy a browser’s locked SQLite database this way so they can read it while the browser is running.
The stealer then moved on to other targets:
Electrum wallets in %APPDATA%\Electrum\wallets (+39.1 s).
FileZillarecentservers.xml and sitemanager.xml (+39.2 s). Unless a master password is set, these files can hold saved server credentials.
SilentNET’s full target list is much longer. It also covers Discord tokens, Telegram sessions, Steam data and more than 20 crypto wallets. Targets that did not appear in our run were most likely skipped because those applications were not installed.
Stage 8: Beaconing Home
At +39.8 s, 0.6 seconds after the FileZilla access, the stealer began connecting to 185.178.208[.]191:443. This is the same server that delivered the payload. It connected 13 times up to +167.0 s, about every 10.6 seconds.
Figure 7: Regular C2 beaconing from the Python stealer.
Threat.Zone states clearly that the content of these encrypted sessions was not verified. The sequence still points to exfiltration: a credential sweep, followed at once by steady traffic to the C2 server. This fits SilentNET’s exfiltration method, which uploads stolen data over HTTPS. Threat.Zone’s top indicator, Credential-store sweep with outbound activity (91/100), captures this correlation and maps it to T1041.
Conclusion
SilentNET shows how far commodity malware has moved from what signature-based tools are built to catch. Its C2 pointer lives on a blockchain, its lookups bypass ordinary DNS, and its payload is a legitimate Python runtime hidden in a folder named after a Windows component. The result was a file that every engine on VirusTotal reported as clean, and that swept the credential stores of three browsers in about two seconds.
Behavior is what gave it away. Threat.Zone followed the infection through every stage, decrypted its traffic and connected weak signals into strong ones. It produced a 91/100 Critical verdict, along with the full attack chain and indicators that defenders can use right away.
About Threat.Zone
Threat.Zone is a malware analysis platform developed by Malwation. At its core is a hypervisor-level sandbox. It runs files and URLs on Windows 7, 10 and 11, Linux, macOS and Android, and observes them from the hypervisor rather than from an agent inside the guest. On our sandboxes, analysis is agentless, which makes the environment much harder for evasive malware to detect.
Around the sandbox, Threat.Zone brings together the tools analysts need in a single platform.
Threat.Zone is available in three deployment models:
Cloud service.
On-premises installation: keeps samples, reports and network captures inside your own environment.
Private tenant: Malwation runs it for you on dedicated infrastructure.
Enterprise customers can also run analyses on their own golden images to match their production builds. A free plan is available for getting started.
