EtherHiding: eth_call JSON-RPC to UNC5142 C2 contract (non-browser)

Duo Tech@duotech

•updated Aug 13, 2026•0•0•7

Detects JSON-RPC eth_call requests to the UNC5142 EtherHiding C2 configuration contract (0x5d04ed162c548fc4508cbb59266b02afbaf3ebc1, selector 0x1dcf296b) from non-browser clients, indicating the DeviceManager RAT resolving its C2 address via Ethereum smart contract.