DOUBLECUP DeviceManager EtherHiding eth_call to malicious smart contract

Duo Tech@duotech

•updated Aug 4, 2026•2•0•2

Detects DeviceManager's EtherHiding C2 resolution: an eth_call JSON-RPC request using get_data_selector 0x1dcf296b against the known-malicious contract address 0xc027490af56a9d7050fc259ecd03da1580b84aae, excluding requests with a browser-like User-Agent.