Security researchers have uncovered Aeternum, a C++-based botnet loader that uses the Polygon blockchain to host command-and-control (C2) instructions.
Rather than relying on traditional servers and domains, the malware retrieves commands from smart contracts, making the operation harder to disrupt through conventional takedowns.
A smart contract is a program stored and executed on a blockchain. In Aeternum’s case, attackers use these contracts as a decentralized dead-drop service for infected devices.
The malware sends JSON-RPC requests to public Polygon Remote Procedure Call (RPC) endpoints, reads a contract value and then retrieves instructions or C2 domains.
This model gives operators a resilient and low-cost infrastructure. Even if security teams block one malicious domain or server, attackers can update the information stored in another smart contract and redirect compromised machines.
The campaign also uses anti-analysis checks, virtual-machine detection and antivirus discovery to avoid security tools.
Aeternum Botnet Uses Polygon
The primary Aeternum loader is a UPX-packed 32-bit Windows executable written in C++. It establishes persistence by copying itself into the user’s AppData directory and creating a disguised Windows Startup shortcut. This allows the malware to run again whenever the device restarts.
After execution, Aeternum contacts Polygon RPC services and queries smart contracts using the 0xb68d1809 function selector, linked to a getDomain() method.
The response can contain encrypted or plaintext commands. Researchers observed one command directing infected systems to download a file from a remote URL.
The loader uses weak cryptography to protect some blockchain-delivered commands. It relies on PBKDF2HMAC and AES-GCM but uses the password itself as a salt, a major design weakness.
Because the contract address and encrypted payload are available, analysts can recover the hidden instructions.
In one case, Aeternum downloaded a legitimate PuTTY installer alongside a malicious DotNetZip.dll file hosted in GitHub repositories.
The malicious DLL collected system details and sent them to a hard-coded Telegram bot through the Telegram API. Stolen information included CPU, RAM, disk, GPU, administrator rights and Windows User Account Control status.
Researchers also identified a related malware sample that used Aeternum’s Polygon-based C2 system to deploy XWorm remote-access malware, the XMRig cryptocurrency miner and an information-stealing component.
The sample retrieved a Pastebin URL from the blockchain, which delivered XMRig configuration data, including mining pool, wallet address and CPU settings.
The miner included options to suspend itself when system-monitoring tools were opened and terminate processes associated with security products. This behavior helps hide resource usage while preserving CPU power for mining, unit42 said.
Indicators of Compromise
| Type | Indicator | Description |
|---|---|---|
| SHA-256 | 5bfb25b8255b61e5ffdf6804451534bcfa9f1dfd225e6c8cdcefb5f50d846898 | Aeternum C++ loader (Build.exe) |
| SHA-256 | 1505eda3da68e2ff9919b55a31018bd30a991236f041aee835f3bc4e430ce505 | Malicious downloaded DotNe |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN
