The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications

Domains/URLs

https://polygon.rpc.hypersync.xyz/

https://polygon-mumbai.g.alchemy.com/v2/demo

https://polygon-mumbai-bor-rpc.publicnode.com

https://api.noderpc.xyz/rpc-polygon-pos/public

https://polygon-mumbai.gateway.tenderly.co

https://public.stackup.sh/api/v1/node/polygon-mainnet

https://gateway.tenderly.co/public/polygon

https://polygon-amoy.gateway.tenderly.co

https://rpc.poolz.finance/polygon

https://gateway.tenderly.co/public/polygon-Mumbai

https://api.zan.top/polygon-amoy

https://endpoints.omniatech.io/v1/polygon-zkevm/testnet/public

https://rpc.polygon-zkevm.gateway.fm

https://polygon-pokt.nodies.app/

https://polygon-amoy.therpc.io

https://rpc.polygonsupernet.public.arianee.net

https://public.stackup.sh/api/v1/node/polygon-Mumbai

https://polygon-zkevm-mainnet.public.blastapi.io

https://polygontestapi.terminet.io/rpc

https://polygon-mainnet.g.alchemy.com/v2/demo

https://polygon-zkevm.drpc.org

gulf.moneroocean.stream

http://sekirolegion.duckdns.org/api/endpoint.php

download.sftp-api-group-wechat.com

update.constant-path.xyz

update-launcher.xyz

test-steve.cyou

IP Address 

193.221.200.219

Hash  

5bfb25b8255b61e5ffdf6804451534bcfa9f1dfd225e6c8cdcefb5f50d846898

1505eda3da68e2ff9919b55a31018bd30a991236f041aee835f3bc4e430ce505

f2a326cff405299e4ebdfaac955c52fc7e496544eaa0921ecad4816cb3ae3a27

4e24bbd0fabac6c3efcec943046afbfd332b2c0108a13becfda23a0e26f9ff5f

81bb80d9c5a97dc41b65f6248c131963c91346eb4fb672836b3d53ae67564d9f

ea1b6ff3a0c1a749b9f09d66789973321d63d8896b48f7345193bdad512950a2

Filepaths 

DotNetZip.dll

putty.exe

Wmi_Framework_APIKEY_wmsnet_<random_value>.lnk

wmiframework.exe

ZrvEsJQzWQ.exe

STAAAAAS.exe

Repository

https://github.com/lencod/

https://github.com/Mash3Do/

Telegram ID 

Telegram Token

-4991861036

-1002535992165

-1002144122983

8305917772:AAHAou...

Contract Address 

0x04E25a563f159308FC3E15fE9Ccc9D2CF623D0cc

0x16dA95799CB8aB203f83e01AFC030B1217198Da4

0x1D50703722729dD68e89D819F69eFc5Fb206bBe7

0x27c7c36981c1ed5cFA2DCDb4B43C27A6BaF6bEa8

0x4dcE7d4b1229F3705BDB70341484cF2EEE36432e

0x55b4F951d5Ac035C21B170C73C0A930a641b718C

0x6da31EB2A016074ffd5519326573E78E2677E4C8

0x737791081A398151195a753Fb49f9c1b8bc1fCDB

0x7D2D8A4A6E8D89cf5C151C4f68A521490D9779B0

0x8d2BaEc2687F59eE1EE7BFd322D33325f5E004ee

0xb3EF2D08Bf25a7daB9d8b98d64E564eA1f6Db924

0xb8fB2bfb182A172b29C365AD6CF743449975C418

0xbD6e817Cc510EC3DA5651B5a3AC595d34C0CF1af

0xC37fB924cF5996C9e676BBA399bDfc5F936B3572

0xC41342908f98E813862EDFe47Ac3af676F8098C9

0xc7199C1dbCd82c4E002327Aa3EC9158F434a6aCE

0xCE476E6f4d83a7a086Cbcdf0FE2E8f221e47e81C

0xD69A36439FffD145ADAcacB94fDe6f8b3546a361

0xf9438b4E3200AE1611eD3d03310c803FDdf67672

0xfbC267200f9e5749045f32dbB55BB16615f1CE5F

0xFDB8b139EeacD17ea7c10c256eA77Ba6Dff18D7d

0xFdfB8c4e827c2d053749C8F2f2058548dde0d073

0x75cD25791A60ab3451E2d2feB5ec46c6f541C2B8

0xcaf2c54e400437da717cf215181b170f65187abf

Wallet Address 

82pNS8tBnvZ5cmV1iU9cXdQmhGz95P18fZpASBrxtaSF1ToTmZtf3HGHrdXMt1Znuu8BLU17koPs2hTXxTajdTviLcgbbAi

Xor Key

helo1

$m7*rYpry3

Process Name 

dpapimig.exe

WmiPrvSE.exe

Function Selector

0xb68d1809

0xb249cd2d

0xf851a440

Detection Query 1 :

domainname like "https://polygon-amoy.therpc.io" or url like "https://polygon-amoy.therpc.io" or siteurl like "https://polygon-amoy.therpc.io" or domainname like "update-launcher.xyz" or url like "update-launcher.xyz" or siteurl like "update-launcher.xyz" or domainname like "https://polygon-mumbai.g.alchemy.com/v2/demo" or url like "https://polygon-mumbai.g.alchemy.com/v2/demo" or siteurl like "https://polygon-mumbai.g.alchemy.com/v2/demo" or domainname like "http://sekirolegion.duckdns.org/api/endpoint.php" or url like "http://sekirolegion.duckdns.org/api/endpoint.php" or siteurl like "http://sekirolegion.duckdns.org/api/endpoint.php" or domainname like "https://gateway.tenderly.co/public/polygon" or url like "https://gateway.tenderly.co/public/polygon" or siteurl like "https://gateway.tenderly.co/public/polygon" or domainname like "https://polygon-mumbai-bor-rpc.publicnode.com" or url like "https://polygon-mumbai-bor-rpc.publicnode.com" or siteurl like "https://polygon-mumbai-bor-rpc.publicnode.com" or domainname like "https://public.stackup.sh/api/v1/node/polygon-mainnet" or url like "https://public.stackup.sh/api/v1/node/polygon-mainnet" or siteurl like "https://public.stackup.sh/api/v1/node/polygon-mainnet" or domainname like "https://polygon-zkevm-mainnet.public.blastapi.io" or url like "https://polygon-zkevm-mainnet.public.blastapi.io" or siteurl like "https://polygon-zkevm-mainnet.public.blastapi.io" or domainname like "https://polygon.rpc.hypersync.xyz/" or url like "https://polygon.rpc.hypersync.xyz/" or siteurl like "https://polygon.rpc.hypersync.xyz/" or domainname like "https://polygontestapi.terminet.io/rpc" or url like "https://polygontestapi.terminet.io/rpc" or siteurl like "https://polygontestapi.terminet.io/rpc" or domainname like "https://polygon-amoy.gateway.tenderly.co" or url like "https://polygon-amoy.gateway.tenderly.co" or siteurl like "https://polygon-amoy.gateway.tenderly.co" or domainname like "https://polygon-pokt.nodies.app/" or url like "https://polygon-pokt.nodies.app/" or siteurl like "https://polygon-pokt.nodies.app/" or domainname like "download.sftp-api-group-wechat.com" or url like "download.sftp-api-group-wechat.com" or siteurl like "download.sftp-api-group-wechat.com" or domainname like "https://polygon-zkevm.drpc.org" or url like "https://polygon-zkevm.drpc.org" or siteurl like "https://polygon-zkevm.drpc.org" or domainname like "gulf.moneroocean.stream" or url like "gulf.moneroocean.stream" or siteurl like "gulf.moneroocean.stream" or domainname like "https://polygon-mainnet.g.alchemy.com/v2/demo" or url like "https://polygon-mainnet.g.alchemy.com/v2/demo" or siteurl like "https://polygon-mainnet.g.alchemy.com/v2/demo" or domainname like "https://endpoints.omniatech.io/v1/polygon-zkevm/testnet/public" or url like "https://endpoints.omniatech.io/v1/polygon-zkevm/testnet/public" or siteurl like "https://endpoints.omniatech.io/v1/polygon-zkevm/testnet/public" or domainname like "https://polygon-mumbai.gateway.tenderly.co" or url like "https://polygon-mumbai.gateway.tenderly.co" or siteurl like "https://polygon-mumbai.gateway.tenderly.co" or domainname like "https://api.noderpc.xyz/rpc-polygon-pos/public" or url like "https://api.noderpc.xyz/rpc-polygon-pos/public" or siteurl like "https://api.noderpc.xyz/rpc-polygon-pos/public" or domainname like "https://api.zan.top/polygon-amoy" or url like "https://api.zan.top/polygon-amoy" or siteurl like "https://api.zan.top/polygon-amoy" or domainname like "test-steve.cyou" or url like "test-steve.cyou" or siteurl like "test-steve.cyou" or domainname like "https://rpc.polygon-zkevm.gateway.fm" or url like "https://rpc.polygon-zkevm.gateway.fm" or siteurl like "https://rpc.polygon-zkevm.gateway.fm" or domainname like "https://rpc.polygonsupernet.public.arianee.net" or url like "https://rpc.polygonsupernet.public.arianee.net" or siteurl like "https://rpc.polygonsupernet.public.arianee.net" or domainname like "update.constant-path.xyz" or url like "update.constant-path.xyz" or siteurl like "update.constant-path.xyz" or domainname like "https://rpc.poolz.finance/polygon" or url like "https://rpc.poolz.finance/polygon" or siteurl like "https://rpc.poolz.finance/polygon" or domainname like "https://gateway.tenderly.co/public/polygon-Mumbai" or url like "https://gateway.tenderly.co/public/polygon-Mumbai" or siteurl like "https://gateway.tenderly.co/public/polygon-Mumbai" or domainname like "https://public.stackup.sh/api/v1/node/polygon-Mumbai" or url like "https://public.stackup.sh/api/v1/node/polygon-Mumbai" or siteurl like "https://public.stackup.sh/api/v1/node/polygon-Mumbai"

Detection Query 2 :

dstipaddress IN ("193.221.200.219") or srcipaddress IN ("193.221.200.219")

Detection Query 3 :

sha256hash IN ("1505eda3da68e2ff9919b55a31018bd30a991236f041aee835f3bc4e430ce505","5bfb25b8255b61e5ffdf6804451534bcfa9f1dfd225e6c8cdcefb5f50d846898","81bb80d9c5a97dc41b65f6248c131963c91346eb4fb672836b3d53ae67564d9f","f2a326cff405299e4ebdfaac955c52fc7e496544eaa0921ecad4816cb3ae3a27","4e24bbd0fabac6c3efcec943046afbfd332b2c0108a13becfda23a0e26f9ff5f","ea1b6ff3a0c1a749b9f09d66789973321d63d8896b48f7345193bdad512950a2")

Detection Query 4 :

datasourcename = "Windows Security" and eventtype = "4663" and (objectname like "DotNetZip.dll" or objectname like "putty.exe" or objectname like "Wmi_Framework_APIKEY_wmsnet_<%>.lnk" or objectname like "wmiframework.exe" or objectname like "ZrvEsJQzWQ.exe" or objectname like "STAAAAAS.exe")

Detection Query 5 :

technologygroup = "EDR" and (objectname like "DotNetZip.dll" or objectname like "putty.exe" or objectname like "Wmi_Framework_APIKEY_wmsnet_<%>.lnk" or objectname like "wmiframework.exe" or objectname like "ZrvEsJQzWQ.exe" or objectname like "STAAAAAS.exe")

Detection Query 6 :

datasourcename = "Windows Security" and eventtype = "4688" and (processname like "dpapimig.exe" or processname like "WmiPrvSE.exe")

Detection Query 7 :

technologygroup = "EDR" and and (processname like "dpapimig.exe" or processname like "WmiPrvSE.exe")