The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications
Analysis of the Aeternum botnet loader, a threat leveraging Polygon blockchain smart contracts for decentralized C2 infrastructure and payload execution.
Analysis of the Aeternum botnet loader, a threat leveraging Polygon blockchain smart contracts for decentralized C2 infrastructure and payload execution. Aeternum is a recently discovered C++ botnet loader that shifts its command-and-control (C2) infrastructure entirely to the public Polygon blockchain. Instead of relying on centralized servers or domains, threat actors operate Aeternum by writing encrypted and plaintext instructions directly using smart contracts. Infected devices continuously query public remote procedure call (RPC) endpoints to retrieve and execute these on-chain commands.
Figure 3 shows the TCP stream of an HTTP POST request to the Polygon RPC endpoint, which includes a JSON object with two important fields: to and data . In this case, the decrypted string contains the Aeternum command all:url: putty.exe > , which is a command used to instruct the botnet to proceed and fetch the target file.
Its primary functions are to establish a persistent presence, perform reconnaissance and communicate with the decentralized Polygon blockchain to retrieve encrypted C2 commands. This section explores how Aeternum performed C2 communications on the Polygon blockchain and how it uses different smart contract addresses to retrieve C2 commands. The malware download requested two different files, putty.exe and DotNetZip.dll , as Figure 5 below shows. While investigating the malware’s downloader activity, we found requests for file artifacts hosted on GitHub in two different Github projects.
This article builds upon research by the Ctrl-Alt-Intel team on the Aeternum C2 architecture and the loader binary . Our analysis focuses on three malware samples associated with Aeternum activity. Our first sample is the Aeternum loader. SHA256 hash: 5bfb25b8255b61e5ffdf6804451534bcfa9f1dfd225e6c8cdcefb5f50d846898 This Aeternum loader sample is named Build.exe .
Figure 4 shows the results of this script run on an encrypted Aeternum blockchain value. Like the previous sample for Aeternum loader, once executed, this second sample made a JSON-RPC request using HTTP to the Polygon blockchain containing Aeternum’s to and data values.
What changed
The pattern of encryption keys for the Aeternum loader (i.e., \x00\x00\x00[ENC bytes]\x00[KEY bytes]\x00\x00\x00 ) consists of: Since the pattern is known, a script can identify the different number of occurrences along with its offsets.
This oversight allows the decryption of the malicious payload by using two known variables: the smart contract address and the payload.
Although the analyzed sample uses encryption, we found additional samples using plain-text C2 commands, as well as an unknown encrypted payload.
Who is affected
In this article, we analyze three malware cases linked to the Aeternum botnet: Palo Alto Networks customers are better protected from the threats discussed in this article through the following products and services: If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team .
Then it invokes the CollectAndSendSystemInfo() function, as shown below in Figure 7.
The script includes anti-analysis checks for virtual machine environments and debugger presence.
This dump of information contains configuration information as shown below in Figure 13, including: Armed with this information, specifically the C2 server key, C2 communication port and XWorm version values, we tricked the sample into connecting to a controlled instance of the matching XWorm panel version.
During the final stage of this Aeternum sample's execution, the injected system process starts an information gathering and encryption process.
Figure 15 shows an outbound connection HTTP POST request to a C2 server at 193.221.200[.]219 with a custom user-agent ( cpp-httplib/0.18.3 ) and JSON values containing two keys with Base64-encoded values.
Why this matters
Figure 3 shows the TCP stream of an HTTP POST request to the Polygon RPC endpoint, which includes a JSON object with two important fields: to and data .
In this case, the decrypted string contains the Aeternum command all:url: putty.exe > , which is a command used to instruct the botnet to proceed and fetch the target file.
The technical picture
Its primary functions are to establish a persistent presence, perform reconnaissance and communicate with the decentralized Polygon blockchain to retrieve encrypted C2 commands.
This section explores how Aeternum performed C2 communications on the Polygon blockchain and how it uses different smart contract addresses to retrieve C2 commands.
The malware download requested two different files, putty.exe and DotNetZip.dll , as Figure 5 below shows.
While investigating the malware’s downloader activity, we found requests for file artifacts hosted on GitHub in two different Github projects.
While this Aeternum loader sample retrieved legitimate files like PuTTY, this is likely for testing.
After successfully downloading DotNetZip.dll from GitHub and executing it, the malware sample initiated new communications to an endpoint at Telegram’s API ( api.telegram[.]org ).
The most notable information about this sample is its lack of obfuscation or encryption, as both the chat_id value ( -4991861036 ) and the bot’s API token ( 8305917772:AAHAou...
An HTTP 200 OK response was returned as expected, indicating that a command payload was found and its content returned.
How organizations are responding
This article builds upon research by the Ctrl-Alt-Intel team on the Aeternum C2 architecture and the loader binary .
Our analysis focuses on three malware samples associated with Aeternum activity.
Our first sample is the Aeternum loader.
SHA256 hash: 5bfb25b8255b61e5ffdf6804451534bcfa9f1dfd225e6c8cdcefb5f50d846898 This Aeternum loader sample is named Build.exe .
Figure 1 shows two examples of the decryption process against two different obfuscated string matches and their deobfuscated values.
These values consist of the JSON object strings used for HTTP-based C2 communication during the execution of the malware and its subsequent interaction with the Polygon blockchain.
What defenders should do now
Figure 4 shows the results of this script run on an encrypted Aeternum blockchain value.
Like the previous sample for Aeternum loader, once executed, this second sample made a JSON-RPC request using HTTP to the Polygon blockchain containing Aeternum’s to and data values.
What remains unknown
The available reporting does not establish whether the issue is being actively exploited in the wild.