EtherHide is a blockchain-based technique for hiding malicious payloads within Ethereum smart contracts. Attackers leverage this to deliver malware, exfiltrate data, or obfuscate C2 communications.

EtherSeek is a cyber intelligence tool designed to identify and analyze the EtherHide technique. It extracts relevant network information from infected sites, enabling analysts to correlate suspicious activities to a crypto wallet.

• 🔗 Correlate contracts and wallets involved in suspicious operations given an infected page.
• 📡 Extract network indicators for threat intelligence workflows.
• 🛠 Ad-hoc analysis tools for customized blockchain research.
• 📑 Export results in analyst-friendly formats (JSON, CSV, etc.).

Clone the repository and install dependencies:

git clone https://github.com/m3ll0c/etherseek.git
cd etherseek
pip install -r requirements.txt

Basic command-line usage:

python etherseek.py [-h] (-f file column_name | -u api_key) [-o OUTPUT] [-r] -k KEYWORD [-w WALLETS] [-ci CHAINID] [-j JOBS] [-v]

Contributions are welcome! Please:

1. Open an issue with your idea or bug report.
2. Submit a pull request with clear commits and documentation.

MIT License – see LICENSE for details.