Aeternum is a C++ botnet loader that moves command-and-control operations onto the Polygon blockchain, using smart contracts and RPC queries to retrieve encrypted or plaintext instructions. The investigation also links Aeternum to a Telegram-based Python malware family and a blended payload set involving XWorm RAT and the XMRig miner, while highlighting persistent infrastructure and evasion tactics. #Aeternum #Polygon #Telegram #XWorm #XMRig #LenAI
Keypoints
- Aeternum replaces traditional centralized C2 infrastructure with smart contracts on the Polygon blockchain.
- The loader queries public Polygon RPC endpoints and uses the getDomain() function selector 0xb68d1809 to retrieve commands.
- The malware uses persistence, reconnaissance, VM detection, antivirus awareness, and weak encryption to evade analysis and stay resident.
- One sample downloads PuTTY and a malicious DotNetZip.dll from GitHub, then uses Telegram API hard-coded credentials for exfiltration.
- A second sample drops XWorm and XMRig, retrieves miner configuration from a Pastebin URL, and exfiltrates data to a C2 server.
- A third sample is Python source code that shows blockchain-based fallback C2, Early Bird APC injection, and credential harvesting from crypto wallets and browser extensions.
- All samples share blockchain indicators, including function selectors and rotating Polygon smart contract addresses tied to the same operation.
MITRE Techniques
- [T1027 ] Obfuscated Files or Information – The samples hide strings, payloads, and commands with XOR, encryption, packing, and layered decryption (‘UPX-packed’, ‘deobfuscate global configuration data’, ‘encrypted C2 commands’).
- [T1140 ] Deobfuscate/Decode Files or Information – The malware decrypts on-chain data and embedded strings using XOR, PBKDF2HMAC/AES-GCM, ChaCha20, AES-CTR, AES-CBC, and Base64 decoding (‘use the key to deobfuscate’, ‘decrypt the payload’, ‘translated hexadecimal values to ASCII’).
- [T1583.001 ] Acquire Infrastructure: Domains – The operation relies on staging and C2 domains such as GitHub-hosted artifacts, Telegram endpoints, Pastebin, and retrieved blockchain domains (‘hosting malicious file artifacts’, ‘update.constant-path[.]xyz’).
- [T1105 ] Ingress Tool Transfer – The loader downloads additional files like putty.exe, DotNetZip.dll, and other payloads from GitHub repositories (‘Downloads files as instructed by the C2 server’).
- [T1071.001 ] Application Layer Protocol: Web Protocols – C2 and exfiltration occur over HTTP/HTTPS, JSON-RPC, and Telegram API requests (‘Sends JSON-RPC requests’, ‘HTTP POST request’, ‘api.telegram[.]org’).
- [T1090 ] Proxy: External Proxy – The malware uses public RPC endpoints and blockchain infrastructure as an indirect relay for command delivery (‘shifts its command-and-control infrastructure entirely to the public Polygon blockchain’).
- [T1568.002 ] Dynamic Resolution: Domain Generation Algorithms – The botnet retrieves fresh C2 domains from blockchain storage as a fallback mechanism (‘retrieve and decrypt new C2 domains on the fly’).
- [T1001.001 ] Data Obfuscation: Junk Data – The Python C2 loop pads obfuscated JSON payloads with junk data to break traffic signatures (‘padded with junk data to break traffic signatures’).
- [T1497.001 ] Virtualization/Sandbox Evasion: System Checks – The malware checks for virtual machines, sandbox usernames, machine names, debugger presence, and minimum RAM before proceeding (‘virtual machine detection’, ‘anti-analysis routines’).
- [T1112 ] Modify Registry – Not mentioned.
- [T1036 ] Masquerading – The malware uses disguised filenames and benign-looking binaries such as WmiPrvSE.exe and PythonLauncher-*.lnk to blend in (‘disguised shortcut’, ‘Disguised Binary’).
- [T1055.001 ] Process Injection: Dynamic-link Library Injection – The Python sample performs Early Bird APC injection into dpapimig.exe (‘injecting shellcode into its address space’, ‘Early Bird APC injection technique’).
- [T1053.005 ] Scheduled Task/Job: Scheduled Task – Not mentioned.
- [T1547.001 ] Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder – The samples establish persistence through Startup folder shortcuts (‘Creates a Windows shortcut under the program menu’s Startup directory’, ‘creating a disguised shortcut in the Windows Startup folder’).
- [T1057 ] Process Discovery – The miner inspects system monitoring utilities and endpoint security processes to decide whether to suspend or kill activity (‘blocklisting system monitoring utilities’, ‘kills active processes associated with endpoint security software’).
- [T1562.001 ] Impair Defenses: Disable or Modify Tools – The miner suspends activity when diagnostic tools are detected and terminates security software to avoid remediation (‘process suspension’, ‘kill-targets option’).
- [T1496 ] Resource Hijacking – XMRig mining is deployed to consume CPU and mine Monero (‘maximum CPU allocation for the miner’).
- [T1021 ] Remote Services – The malware uses Telegram and blockchain RPC services as remote communication channels (‘connect to a controlled instance of the matching XWorm panel version’).
- [T1113 ] Screen Capture – The Telegram exfiltration uses a file named screenshot.png as the document being sent (‘document … is a PNG file named screenshot.png’).
- [T1005 ] Data from Local System – The malware collects CPU, RAM, disk, GPU, UAC status, and administrator-rights information from the host (‘information gathering and data exfiltration from the compromised machine’).
- [T1555 ] Credentials from Password Stores – The Python source mentions harvesting credentials from browser extensions and desktop wallets (‘harvest credentials from over 55 cryptocurrency browser extensions and 10 popular desktop wallets’).
Indicators of Compromise
- [SHA256 hash ] Aeternum loader sample and other related binaries – 5bfb25b8255b61e5ffdf6804451534bcfa9f1dfd225e6c8cdcefb5f50d846898, f2a326cff405299e4ebdfaac955c52fc7e496544eaa0921ecad4816cb3ae3a27, and other 3 hashes
- [Filename ] Loader, persistence, and payload files – Build.exe, DotNetZip.dll, putty.exe, and other 3 items
- [Filename ] Startup and supporting binaries – Wmi_Framework_APIKEY_wmsnet_.lnk, wmiframework.exe, and other 2 items
- [Domain ] Telegram, mining pool, and staging infrastructure – api.telegram[.]org, gulf.moneroocean[.]stream, and other 6 items
- [Repository ] GitHub repositories hosting malicious artifacts – hxxps[:]//github[.]com/lencod/, hxxps[:]//github[.]com/Mash3Do/
- [Telegram ID / Telegram Token ] Telegram C2 credentials used in the DLL and Python malware – -4991861036, 8305917772:AAHAou…, and other 2 items
- [Contract Address ] Polygon smart contracts used for Aeternum C2 and related blockchain operations – 0x04E25a563f159308FC3E15fE9Ccc9D2CF623D0cc, 0x16dA95799CB8aB203f83e01AFC030B1217198Da4, and other 20 items
- [RPC Endpoint ] Public Polygon RPC endpoints queried by the loader – hxxps[:]//polygon-mumbai-bor-rpc.publicnode[.]com, hxxps[:]//polygon-mainnet.g.alchemy[.]com/v2/demo, and other 13 items
- [IP Address:Port ] HTTP C2 exfiltration server used in sample 2 – 193.221.200[.]219, and one related endpoint
- [C2 URL ] Malware callback endpoint linked to exfiltration activity – hxxp[:]//sekirolegion.duckdns[.]org/api/endpoint.php
- [Wallet Address ] Monero wallet used for mining payments – 82pNS8tBnvZ5cmV1iU9cXdQmhGz95P18fZpASBrxtaSF1ToTmZtf3HGHrdXMt1Znuu8BLU17koPs2hTXxTajdTviLcgbbAi
- [Staging Domain ] Python malware staging domain – download.sftp-api-group-wechat[.]com
- [C2 Domain ] Blockchain-retrieved domains for Python malware – update.constant-path[.]xyz, update-launcher[.]xyz, and test-steve[.]cyou
- [Contract Address ] Python malware Polygon smart contract address – 0xb0874252a7359AA701F3F144A1f03A6e0DA8aE6D
- [XOR Key ] Keys used to decode the Python malware C2/domain data – helo1, $m7*rYpry3
- [Injected Process ] Process used for Early Bird APC injection – dpapimig.exe
- [Disguised Binary ] Masqueraded binary name used by the Python sample – WmiPrvSE.exe
- [Function Selector ] Shared blockchain selector across samples – 0xb68d1809, 0xb249cd2d, and 0xf851a440
- [Operator Address ] LenAI-associated smart contract address – 0xcaf2c54e400437da717cf215181b170f65187abf
Read more: https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/