The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications

This report analyzes the Aeternum botnet, a novel malware family that retrieves encrypted and plaintext C2 commands from Polygon blockchain smart contracts to drive a multi-stage infection chain. It documents three samples—a C++ loader that fetches payloads and exfiltrates via Telegram, a PyInstaller package that drops XWorm RAT and an XMRig miner, and a Python sample with blockchain-based domain resolution—providing behavioral and static analysis, decryption methods, and extensive IOCs for detection and mitigation.