Affected Systems

Windows systems infected with Aeternum C++ botnet loader (Build.exe). The malware targets Windows environments and uses Polygon blockchain smart contracts for command and control, making traditional domain/IP-based blocking ineffective. Associated threats include XWorm RAT, XMRig cryptocurrency miner, and Python-based Telegram C2 variants.

Exploitation Status

Active in the wild. Unit 42 has analyzed live samples (SHA256: 5bfb25b8255b61e5ffdf6804451534bcfa9f1dfd225e6c8cdcefb5f50d846898) with confirmed blockchain-based C2 communication to 22 different Polygon smart contract addresses. The malware establishes persistence, performs reconnaissance, downloads additional payloads from GitHub, and exfiltrates data via Telegram API.

Business Impact

Traditional network-based C2 blocking (DNS sinkholing, IP blacklisting) is ineffective against blockchain-based infrastructure. The decentralized nature complicates law enforcement takedowns and incident response. Infected systems establish persistence via Startup folder, download secondary payloads (XWorm RAT, XMRig miner), and exfiltrate data to Telegram. Detection requires endpoint behavioral analysis rather than network signatures. Organizations face cryptocurrency mining resource theft, data exfiltration, and potential lateral movement via RAT capabilities.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Deploy endpoint detection rules for Aeternum IoCs: monitor for Build.exe, wmiframework.exe, ZrvEsJQzWQ.exe, STAAAAAS.exe in AppData\Local and Startup folder LNK files matching pattern Wmi_Framework_APIKEY_wmsnet_*.lnk
  • Block outbound JSON-RPC traffic to Polygon blockchain endpoints (polygon-mumbai-bor-rpc.publicnode.com and similar public RPC nodes) unless business-justified; alert on eth_call method 0xb68d1809
  • Hunt for Telegram API C2 traffic to bot DLLSendC2Bot and suspicious GitHub repository downloads of putty.exe with side-loaded DotNetZip.dll
  • Enable Palo Alto Advanced WildFire, Advanced Threat Prevention, and Cortex XDR behavioral analysis to detect UPX-packed executables with VM detection and blockchain RPC queries
  • Audit systems for XMRig miner processes and XWorm RAT indicators; check for elevated CPU usage and unauthorized outbound connections to mining pools