16 minhigh
The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications
Aeternum is a C++ botnet loader that migrates C2 infrastructure to the public Polygon blockchain, using smart contracts to store encrypted and plaintext commands. Infected devices query public RPC endpoints to retrieve on-chain instructions, decrypt them using a flawed PBKDF2HMAC/AES-GCM routine, and execute payloads including XWorm RAT, XMRig miner, and cryptocurrency wallet stealers. The decentralized architecture complicates takedown efforts and provides resilient, low-cost C2 infrastructure.
Sens:▲ 24hConf:
Showing defanged values
- domainapi[.]noderpc[.]xyzPolygon RPC endpoint used by Aeternum loader for blockchain C2 communications.
- domainapi[.]zan[.]topPolygon RPC endpoint used by Aeternum loader for blockchain C2 communications.
- domaincdnjsdelivr[.]beerC2 domain pushed by operator LenAI via updateDomain() transaction on the Polygon blockchain. Represents active C2 infrastructure rotation.
- domaindownload[.]sftp-api-group-wechat[.]comStaging domain used by Python-based Aeternum sample for downloading malware components.
- domainendpoints[.]omniatech[.]ioPolygon RPC endpoint used by Aeternum loader for blockchain C2 communications.
- domaingateway[.]tenderly[.]coPolygon RPC endpoint used by Aeternum loader for blockchain C2 communications.
- domaingulf[.]moneroocean[.]streamXMRig mining pool domain used by sample 2 for cryptocurrency mining.
- domainmaper[.]infoDomain observed serving content at /polygonc5 path, associated with Aeternum RPC traffic.
- domainpolygon-amoy[.]therpc[.]ioPolygon RPC endpoint used by Aeternum loader for blockchain C2 communications.
- domainpolygon-mainnet[.]g[.]alchemy[.]comPolygon RPC endpoint used by Aeternum loader for blockchain C2 communications.
- domainpolygon-mumbai-bor-rpc[.]publicnode[.]comPolygon RPC endpoint used by Aeternum loader for blockchain C2 communications.
- domainpolygon-mumbai[.]g[.]alchemy[.]comPolygon RPC endpoint used by Aeternum loader for blockchain C2 communications.
- domainpolygon-mumbai[.]gateway[.]tenderly[.]coPolygon RPC endpoint used by Aeternum loader for blockchain C2 communications.
- domainpolygon-pokt[.]nodies[.]appPolygon RPC endpoint used by Aeternum loader for blockchain C2 communications.
- domainpolygon-rpc[.]comPolygon RPC endpoint observed in network traffic from image analysis.
- domainpolygon[.]rpc[.]hypersync[.]xyzPolygon RPC endpoint used by Aeternum loader for blockchain C2 communications.
- domainpolygontestapi[.]terminet[.]ioPolygon RPC endpoint used by Aeternum loader for blockchain C2 communications.
- domainpolygon-zkevm[.]drpc[.]orgPolygon RPC endpoint used by Aeternum loader for blockchain C2 communications.
- domainpolygon-zkevm-mainnet[.]public[.]blastapi[.]ioPolygon RPC endpoint used by Aeternum loader for blockchain C2 communications.
- domainpublic[.]stackup[.]shPolygon RPC endpoint used by Aeternum loader for blockchain C2 communications.
- domainrpc[.]ankr[.]comPolygon RPC endpoint observed in network traffic from image analysis.
- domainrpc[.]polygonsupernet[.]public[.]arianee[.]netPolygon RPC endpoint used by Aeternum loader for blockchain C2 communications.
- domainrpc[.]polygon-zkevm[.]gateway[.]fmPolygon RPC endpoint used by Aeternum loader for blockchain C2 communications.
- domainrpc[.]poolz[.]financePolygon RPC endpoint used by Aeternum loader for blockchain C2 communications.
- domainsekirolegion[.]duckdns[.]orgC2 domain contacted by malware for data exfiltration, linked to IP 193.221.200.219.
- domaintest-steve[.]cyouC2 domain retrieved from Polygon smart contract by Python-based Aeternum sample.
- domainupdate[.]constant-path[.]xyzC2 domain retrieved from Polygon smart contract by Python-based Aeternum sample.
- domainupdate-launcher[.]xyzC2 domain retrieved from Polygon smart contract by Python-based Aeternum sample.
- filenameC:\Users\<user>\AppData\Local\Directory where Aeternum loader creates a folder and copies itself for persistence.
- filenameC:\Users\<user>\AppData\Local\Temp\esewurmgvbqt.exeTemporary file written by sample 2's embedded Python script after multi-layer decryption of payload.
- filenameC:\Users\<user>\AppData\Local\Temp\XWormClient.exePath where XWorm client is dropped on the compromised host.
- ip193[.]221[.]200[.]219HTTP C2 exfiltration server receiving AES-128 ECB encrypted data from compromised hosts via POST to /api/endpoint.php.
- ip213[.]176[.]79[.]66XWorm v7.4 C2 server IP address extracted from malware configuration.
- ip77[.]91[.]96[.]177API endpoint IP for XMRig miner configuration, observed in Pastebin config data.
- sha2561505eda3da68e2ff9919b55a31018bd30a991236f041aee835f3bc4e430ce505Malicious DotNetZip.dll downloaded from GitHub by Aeternum loader. Uses hard-coded Telegram credentials for C2 exfiltration.
- sha2564e24bbd0fabac6c3efcec943046afbfd332b2c0108a13becfda23a0e26f9ff5fXWormClient.exe dropped by sample 2. Default filename from XWorm v7.4 builder.
- sha2565bfb25b8255b61e5ffdf6804451534bcfa9f1dfd225e6c8cdcefb5f50d846898Aeternum C++ loader executable (Build.exe), UPX-packed 32-bit Windows PE. Primary sample establishing blockchain-based C2 communications.
- sha25681bb80d9c5a97dc41b65f6248c131963c91346eb4fb672836b3d53ae67564d9fXMRig coin miner (miner.exe) dropped by sample 2.
- sha256ea1b6ff3a0c1a749b9f09d66789973321d63d8896b48f7345193bdad512950a2Python script sample containing Aeternum malware source code with blockchain C2 and cryptocurrency wallet stealing capabilities.
- sha256f2a326cff405299e4ebdfaac955c52fc7e496544eaa0921ecad4816cb3ae3a27XBinderOutput_protected.exe, 64-bit Windows PE packed with PyInstaller. Drops XWorm RAT, XMRig miner, and data exfiltrator.
- urlhxxps://github[.]com/lencod/GitHub repository hosting malicious file artifacts including DotNetZip.dll used by Aeternum loader.
- urlhxxps://github[.]com/Mash3Do/GitHub repository hosting malicious file artifacts used by Aeternum loader.
- urlhxxps://pastebin[.]com/raw/p1GBF379Pastebin URL retrieved from decrypted blockchain C2 command. Returns XMRig cryptocurrency miner configuration as raw JSON.
Detection / Hunteropenrouter
What Happened
A newly discovered malware called Aeternum uses a public blockchain network (Polygon) to send commands to infected computers. Instead of using traditional servers that can be shut down by law enforcement, the attackers embed instructions inside blockchain smart contracts (self-executing programs on a blockchain). Infected computers constantly check these contracts for new orders. The malware can install additional malicious tools, including remote access software, cryptocurrency miners, and programs that steal digital wallet credentials. Organizations using Windows systems or cryptocurrency tools should check for indicators of this activity, update their security software, and review whether their systems communicate with known blockchain RPC endpoints or the specific smart contract addresses identified in the research.
Key Takeaways
- Aeternum is a C++ botnet loader that uses the Polygon blockchain as its C2 infrastructure, writing encrypted and plaintext commands directly into smart contracts via JSON-RPC calls.
- A persistent 4-byte function selector (0xb68d1809, getDomain()) is shared across all three analyzed samples, providing a reliable fingerprint for tracking Aeternum activity.
- The malware uses a flawed PBKDF2HMAC/AES-GCM decryption routine where the smart contract address serves as both password and salt, enabling decryption of on-chain C2 commands.
- Three distinct payload types were observed: a Telegram-based exfiltration DLL, a blended XWorm RAT + XMRig miner + data exfiltrator package, and a Python-based cryptocurrency wallet stealer.
- The operator (moniker LenAI) actively rotates C2 domains on-chain using the admin-only updateDomain() function (0xb249cd2d), demonstrating iterative refinement of the smart contract codebase over time.
Affected Systems
- Windows (32-bit and 64-bit)
- Systems with Python 3.14 runtime
- Cryptocurrency wallet desktop applications
- Browser-based cryptocurrency wallet extensions
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Malware delivered via social engineering lure impersonating DBeaver installer or direct execution of UPX-packed Build.exe
- Persistence: Creates folder under AppData\Local, copies itself, and creates Windows shortcut in Startup folder (Wmi_Framework_APIKEY_wmsnet_<random>.lnk or PythonLauncher-*.lnk)
- Anti-Analysis: Checks for sandbox usernames, machine names, minimum 8 GB RAM, and Zone.Identifier ADS to confirm non-VM environment; detects AV scanning and virtual machines
- C2 Communication: Sends JSON-RPC eth_call requests to Polygon RPC endpoints using function selector 0xb68d1809 (getDomain) to retrieve encrypted or plaintext C2 commands from smart contracts
- Payload Execution: Decrypts on-chain commands using flawed PBKDF2HMAC/AES-GCM (password = contract address), downloads additional payloads (XWorm, XMRig, DotNetZip.dll) from GitHub or Pastebin
- Exfiltration: Collects system info and cryptocurrency wallet data, exfiltrates via Telegram API (hard-coded bot tokens) or HTTP POST to C2 server with AES-128 ECB encrypted payload
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: Yes
- Platforms: Palo Alto Networks Advanced Threat Prevention signatures 87116 and 87152, Custom Python decryptor scripts, CAPE community XWorm parser
The article references Palo Alto Networks Threat Prevention signatures 87116 and 87152 for blocking Aeternum activity. Custom Python scripts for decrypting blockchain C2 payloads and exfiltrated data are mentioned but not reproduced. CAPE's community XWorm parser was used for configuration extraction.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR can detect persistence via Startup folder shortcuts, process injection via Early Bird APC into dpapimig.exe, and child process spawning patterns. However, blockchain RPC traffic over HTTPS blends with legitimate web traffic and the use of signed binaries for injection reduces detection confidence. |
| Network Visibility | Medium | JSON-RPC POST requests to Polygon blockchain endpoints are visible but may blend with legitimate cryptocurrency or development traffic. The custom user-agent strings (SystemInfo Bot/2.0, cpp-httplib/0.18.3, WinHTTP Example/1.0) are distinctive. Telegram API exfiltration traffic uses standard HTTPS and requires content inspection or destination correlation. |
| Detection Difficulty | Hard | The blockchain-based C2 architecture uses legitimate public RPC endpoints, making network-level blocking impractical without disrupting legitimate traffic. Smart contract addresses rotate across samples. Encryption keys are derived from on-chain data. The malware performs anti-analysis checks and uses signed binaries for injection. Detection requires correlation across host and network telemetry. |
Required Log Sources
- DNS resolution logs
- HTTP/HTTPS proxy logs with URL and user-agent visibility
- Endpoint process creation and command line logs
- Windows Startup folder file creation events
- File creation events in AppData\Local and Temp directories
- Network connection logs with destination IP and port
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Processes making HTTP POST requests to multiple Polygon RPC endpoints within a short timeframe may indicate Aeternum C2 beaconing behavior. | Network proxy or firewall logs with destination URL and HTTP method; EDR network connection events | Command and Control | Medium - legitimate blockchain developers or cryptocurrency applications may query Polygon RPC endpoints regularly. |
| Processes invoking eth_call with the function selector 0xb68d1809 in the JSON-RPC data field are likely communicating with Aeternum smart contracts. | Full HTTP request body inspection via TLS proxy or EDR network content capture | Command and Control | Low - this specific 4-byte selector is a custom function not used by standard blockchain tooling. |
| Shortcut files created in the Windows Startup folder with names matching Wmi_Framework_APIKEY_wmsnet_ or PythonLauncher- patterns indicate Aeternum persistence. | File system monitoring of Startup folder; EDR file creation events | Persistence | Low - these naming patterns are specific to Aeternum and not used by legitimate software. |
| The signed binary dpapimig.exe spawning child processes or making outbound network connections may indicate Early Bird APC injection by Aeternum. | EDR process ancestry and network connection correlation | Execution | Low - dpapimig.exe is a DPAPI migration tool that does not normally spawn child processes or initiate network connections. |
| Outbound HTTPS requests to api.telegram.org with user-agent string SystemInfo Bot/2.0 indicate Aeternum data exfiltration via Telegram bot API. | Proxy logs with user-agent string visibility; EDR network connection metadata | Exfiltration | Low - this user-agent string is non-standard and specific to the malware. |
Control Gaps
- Traditional domain and IP blocklists cannot disrupt blockchain-based C2 since the malware queries legitimate public RPC endpoints.
- Signature-based AV may miss the loader due to UPX packing and XOR-based string obfuscation.
- Network security controls that do not inspect HTTP request bodies will not detect the eth_call function selector 0xb68d1809 in JSON-RPC payloads.
- EDR solutions without process injection detection for Early Bird APC techniques may miss the dpapimig.exe injection.
- DLP solutions may not flag Telegram API exfiltration since it uses standard HTTPS to a legitimate service.
Key Behavioral Indicators
- Process making HTTP POST to Polygon RPC endpoints with JSON-RPC eth_call method containing data field starting with 0xb68d1809
- File creation in Windows Startup folder matching pattern Wmi_Framework_APIKEY_wmsnet_.lnk or PythonLauncher-.lnk
- dpapimig.exe (signed Microsoft binary) spawning child processes or initiating outbound network connections
- HTTP requests with user-agent string 'SystemInfo Bot/2.0' to api.telegram.org
- HTTP POST requests with user-agent 'cpp-httplib/0.18.3' to /api/endpoint.php
- Downloads of DotNetZip.dll from GitHub repositories by unexpected processes
- Process creating files named esewurmgvbqt.exe in the Temp directory
- XMRig configuration containing stealth-target and kill-target options that terminate security tools
False Positive Assessment
Medium - The malware uses legitimate public blockchain RPC endpoints and GitHub for hosting, which are also used by developers and legitimate applications. Telegram API traffic is common. However, the specific function selector 0xb68d1809, custom user-agent strings, and persistence shortcut naming patterns are distinctive and reduce false positive risk for targeted detections.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider blocking the identified C2 IP 193.221.200.219 and domains (cdnjsdelivr.beer, sekirolegion.duckdns.org, update.constant-path.xyz, update-launcher.xyz, test-steve.cyou, download.sftp-api-group-wechat.com) at your firewall and DNS filtering layers.
- If your EDR supports it, consider searching endpoints for the SHA256 hashes of the three primary samples and associated dropped binaries (DotNetZip.dll, XWormClient.exe, miner.exe).
- Consider hunting for processes making outbound connections to the listed Polygon RPC endpoints, especially those sending JSON-RPC eth_call requests, and investigate if the function selector 0xb68d1809 appears in the request data field.
- If applicable, consider blocking or alerting on the Telegram bot tokens and chat IDs identified in the article to detect exfiltration activity.
Infrastructure Hardening
- Evaluate whether blocking outbound traffic to the specific Polygon RPC endpoints listed in the IOC table is feasible for your environment, keeping in mind that some may be used by legitimate blockchain applications.
- Consider implementing TLS inspection for traffic to api.telegram.org if your organization's policy permits, to detect exfiltration via Telegram bot API.
- If your network security tooling supports it, consider creating custom signatures for the user-agent strings 'SystemInfo Bot/2.0' and 'cpp-httplib/0.18.3' associated with Aeternum exfiltration.
- Evaluate whether your DNS security solution can alert on queries to the identified C2 domains and the duckdns.org dynamic DNS service.
User Protection
- Consider deploying EDR policies that alert on file creation in Windows Startup folders, particularly shortcuts with names containing 'Wmi_Framework' or 'PythonLauncher'.
- If supported by your endpoint tooling, consider monitoring for the signed binary dpapimig.exe spawning child processes or making network connections, as this indicates process injection.
- Evaluate whether your application control solution can restrict execution of binaries dropped to AppData\Local and Temp directories.
- Consider reviewing browser extension policies to restrict unauthorized cryptocurrency wallet extensions on endpoints that handle sensitive data.
Security Awareness
- Consider incorporating awareness of social engineering lures impersonating software installers (e.g., DBeaver) into existing phishing training programs.
- If applicable to your workforce, consider educating users about the risks of downloading software from unverified GitHub repositories.
- Consider reminding users to report unexpected cryptocurrency mining activity or system performance degradation, which may indicate XMRig deployment.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping11 techniques
Tactic
Execution
Tactic
Persistence
Tactic
Privilege Escalation
Tactic
Command and Control
Tactic
Exfiltration
Tactic
Impact
Additional IOCs
- Ips:
213[.]176[.]79[.]66- XWorm v7.4 C2 server IP address extracted from malware configuration.77[.]91[.]96[.]177- API endpoint IP for XMRig miner configuration, observed in Pastebin config data.
- Domains:
gulf[.]moneroocean[.]stream- XMRig mining pool domain used by sample 2 for cryptocurrency mining.test-steve[.]cyou- C2 domain retrieved from Polygon smart contract by Python-based Aeternum sample.polygon-mumbai-bor-rpc[.]publicnode[.]com- Polygon RPC endpoint used by Aeternum loader for blockchain C2 communications.polygon[.]rpc[.]hypersync[.]xyz- Polygon RPC endpoint used by Aeternum loader for blockchain C2 communications.polygon-mumbai[.]g[.]alchemy[.]com- Polygon RPC endpoint used by Aeternum loader for blockchain C2 communications.api[.]noderpc[.]xyz- Polygon RPC endpoint used by Aeternum loader for blockchain C2 communications.polygon-mumbai[.]gateway[.]tenderly[.]co- Polygon RPC endpoint used by Aeternum loader for blockchain C2 communications.public[.]stackup[.]sh- Polygon RPC endpoint used by Aeternum loader for blockchain C2 communications.gateway[.]tenderly[.]co- Polygon RPC endpoint used by Aeternum loader for blockchain C2 communications.rpc[.]poolz[.]finance- Polygon RPC endpoint used by Aeternum loader for blockchain C2 communications.api[.]zan[.]top- Polygon RPC endpoint used by Aeternum loader for blockchain C2 communications.endpoints[.]omniatech[.]io- Polygon RPC endpoint used by Aeternum loader for blockchain C2 communications.rpc[.]polygon-zkevm[.]gateway[.]fm- Polygon RPC endpoint used by Aeternum loader for blockchain C2 communications.polygon-pokt[.]nodies[.]app- Polygon RPC endpoint used by Aeternum loader for blockchain C2 communications.polygon-amoy[.]therpc[.]io- Polygon RPC endpoint used by Aeternum loader for blockchain C2 communications.rpc[.]polygonsupernet[.]public[.]arianee[.]net- Polygon RPC endpoint used by Aeternum loader for blockchain C2 communications.polygon-zkevm-mainnet[.]public[.]blastapi[.]io- Polygon RPC endpoint used by Aeternum loader for blockchain C2 communications.polygontestapi[.]terminet[.]io- Polygon RPC endpoint used by Aeternum loader for blockchain C2 communications.polygon-mainnet[.]g[.]alchemy[.]com- Polygon RPC endpoint used by Aeternum loader for blockchain C2 communications.polygon-zkevm[.]drpc[.]org- Polygon RPC endpoint used by Aeternum loader for blockchain C2 communications.polygon-rpc[.]com- Polygon RPC endpoint observed in network traffic from image analysis.rpc[.]ankr[.]com- Polygon RPC endpoint observed in network traffic from image analysis.maper[.]info- Domain observed serving content at /polygonc5 path, associated with Aeternum RPC traffic.
- Urls:
hxxps://github[.]com/lencod/- GitHub repository hosting malicious file artifacts including DotNetZip.dll used by Aeternum loader.hxxps://github[.]com/Mash3Do/- GitHub repository hosting malicious file artifacts used by Aeternum loader.
- File Hashes:
ea1b6ff3a0c1a749b9f09d66789973321d63d8896b48f7345193bdad512950a2(SHA256) - Python script sample containing Aeternum malware source code with blockchain C2 and cryptocurrency wallet stealing capabilities.1505eda3da68e2ff9919b55a31018bd30a991236f041aee835f3bc4e430ce505(SHA256) - Malicious DotNetZip.dll downloaded from GitHub by Aeternum loader. Uses hard-coded Telegram credentials for C2 exfiltration.4e24bbd0fabac6c3efcec943046afbfd332b2c0108a13becfda23a0e26f9ff5f(SHA256) - XWormClient.exe dropped by sample 2. Default filename from XWorm v7.4 builder.81bb80d9c5a97dc41b65f6248c131963c91346eb4fb672836b3d53ae67564d9f(SHA256) - XMRig coin miner (miner.exe) dropped by sample 2.
- File Paths:
C:\Users\<user>\AppData\Local\- Directory where Aeternum loader creates a folder and copies itself for persistence.C:\Users\<user>\AppData\Local\Temp\XWormClient.exe- Path where XWorm client is dropped on the compromised host.C:\Users\<user>\AppData\Local\Temp\esewurmgvbqt.exe- Temporary file written by sample 2's embedded Python script after multi-layer decryption of payload.
- Command Lines:
- Purpose: Decrypt Aeternum blockchain C2 payload using contract address and hex payload | Tools:
python,custom decryptor script| Stage: C2 decryption |python decryptor.py <contract_address> <hex_payload> - Purpose: Extract XWorm configuration from malware sample using CAPE community parser | Tools:
python,XWorm.py parser| Stage: Malware analysis |python XWorm.py <sample_hash> <filename> - Purpose: Decrypt exfiltrated data from C2 server using AES-128 ECB key | Tools:
python,custom exfil_crypt.py script| Stage: Exfiltration analysis |python exfil_crypt.py dec <encrypted_file> <hex_key>
- Purpose: Decrypt Aeternum blockchain C2 payload using contract address and hex payload | Tools:
- Other:
0xb68d1809- getDomain() function selector on Polygon smart contracts. Shared across all Aeternum samples. Used by malware to retrieve encrypted C2 domain/command data from blockchain storage slot 1.0xb249cd2d- updateDomain() function selector on Polygon smart contracts. Admin-only function used by operator to rotate C2 domains on-chain.0xf851a440- admin() function selector on Polygon smart contracts. Auto-getter for storage slot 0 containing deployer wallet address.0xcaf2c54e400437da717cf215181b170f65187abf- LenAI operator primary smart contract address on Polygon. Used to deploy and manage Aeternum smart contracts and push C2 domain updates.0x04E25a563f159308FC3E15fE9Ccc9D2CF623D0cc- Polygon smart contract address used by Aeternum loader sample 1 for C2 communications.0x16dA95799CB8aB203f83e01AFC030B1217198Da4- Polygon smart contract address used by Aeternum loader sample 1 for C2 communications.0x1D50703722729dD68e89D819F69eFc5Fb206bBe7- Polygon smart contract address used by Aeternum loader sample 1 for C2 communications.0x27c7c36981c1ed5cFA2DCDb4B43C27A6BaF6bEa8- Polygon smart contract address used by Aeternum loader sample 1 for C2 communications.0x4dcE7d4b1229F3705BDB70341484cF2EEE36432e- Polygon smart contract address used by Aeternum loader sample 1 for C2 communications.0x55b4F951d5Ac035C21B170C73C0A930a641b718C- Polygon smart contract address used by Aeternum loader sample 1 for C2 communications.0x6da31EB2A016074ffd5519326573E78E2677E4C8- Polygon smart contract address used by Aeternum loader sample 1 for C2 communications.0x737791081A398151195a753Fb49f9c1b8bc1fCDB- Polygon smart contract address used by Aeternum loader sample 1 for C2 communications.0x7D2D8A4A6E8D89cf5C151C4f68A521490D9779B0- Polygon smart contract address used by Aeternum loader sample 1 for C2 communications.0x8d2BaEc2687F59eE1EE7BFd322D33325f5E004ee- Polygon smart contract address used by Aeternum loader sample 1 for C2 communications.0xb3EF2D08Bf25a7daB9d8b98d64E564eA1f6Db924- Polygon smart contract address used by Aeternum loader sample 1 for C2 communications.0xb8fB2bfb182A172b29C365AD6CF743449975C418- Polygon smart contract address used by Aeternum loader sample 1 for C2 communications.0xbD6e817Cc510EC3DA5651B5a3AC595d34C0CF1af- Polygon smart contract address used by Aeternum loader sample 1 for C2 communications.0xC37fB924cF5996C9e676BBA399bDfc5F936B3572- Polygon smart contract address used by Aeternum loader sample 1 for C2 communications.0xC41342908f98E813862EDFe47Ac3af676F8098C9- Polygon smart contract address used by Aeternum loader sample 1 for C2 communications.0xc7199C1dbCd82c4E002327Aa3EC9158F434a6aCE- Polygon smart contract address used by Aeternum loader sample 1 for C2 communications.0xCE476E6f4d83a7a086Cbcdf0FE2E8f221e47e81C- Polygon smart contract address used by Aeternum loader sample 1 for C2 communications.0xD69A36439FffD145ADAcacB94fDe6f8b3546a361- Polygon smart contract address used by Aeternum loader sample 1 for C2 communications.0xf9438b4E3200AE1611eD3d03310c803FDdf67672- Polygon smart contract address used by Aeternum loader sample 1 for C2 communications.0xfbC267200f9e5749045f32dbB55BB16615f1CE5F- Polygon smart contract address used by Aeternum loader sample 1 for C2 communications.0xFDB8b139EeacD17ea7c10c256eA77Ba6Dff18D7d- Polygon smart contract address used by Aeternum loader sample 1 for C2 communications.0xFdfB8c4e827c2d053749C8F2f2058548dde0d073- Polygon smart contract address used by Aeternum loader sample 1 for C2 communications.0x75cD25791A60ab3451E2d2feB5ec46c6f541C2B8- Polygon smart contract address used by sample 2 (XWorm + XMRig) for C2 communications.0xb0874252a7359AA701F3F144A1f03A6e0DA8aE6D- Polygon smart contract address used by sample 3 (Python malware) for C2 communications.8305917772:AAHAou...- Hard-coded Telegram bot API token used by DotNetZip.dll for data exfiltration via Telegram API (sample 1).-4991861036- Hard-coded Telegram chat ID used by DotNetZip.dll for data exfiltration (sample 1).7356125890:AAF5ncBIc2pJrEfYPAmy2g9YS7B5NjmtwTc- Telegram bot token used by Python-based Aeternum sample for C2 and exfiltration (sample 3).-1002535992165- Telegram chat ID used by Python-based Aeternum sample for exfiltration (sample 3).-1002144122983- Telegram chat ID used by Python-based Aeternum sample for exfiltration (sample 3).I3DgQX204TaYue4d- Mutex used by XWorm v7.4 client dropped by sample 2.helo1- XOR key used for C2 communication decryption in Python-based Aeternum sample.$m7*rYpry3- XOR key used for domain decryption in Python-based Aeternum sample.
