Aeternum Blockchain C2 Botnet + XWorm/ZingoStealer Loader Chain: OTX Pulse Analysis — Polygon Smart Contract Detection Pack

---
title: Aeternum Blockchain C2 - Non-Browser Process Querying Polygon RPC Endpoints
id: 8f3a2c1e-4b7d-4e9a-a1c5-6d2f8b3e9a01
status: experimental
description: Detects non-browser, non-developer processes establishing HTTPS connections to public Polygon blockchain RPC endpoints known to be abused by the Aeternum loader for smart-contract-based C2. Legitimate blockchain traffic originates from browsers, wallets, or developer tooling — not unsigned binaries in user-writable paths.
author: Security Arsenal Threat Intelligence
date: 2026/09/10
references:
    - https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/
logsource:
    category: network_connection
    product: windows
detection:
    selection_rpc:
        DestinationHostname|contains:
            - 'endpoints.omniatech.io'
            - 'polygon-zkevm.drpc.org'
            - 'api.zan.top'
            - 'polygon-mumbai.gateway.tenderly.co'
            - 'polygon-rpc.com'
            - 'rpc-mainnet.matic'
    selection_suspicious_path:
        Image|contains:
            - '\AppData\Local\Temp\'
            - '\AppData\Roaming\'
            - '\ProgramData\'
            - '\Users\Public\'
            - '\Downloads\'
    filter_known_good:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
            - '\brave.exe'
            - '\node.exe'
            - '\MetaMask.exe'
    condition: selection_rpc and selection_suspicious_path and not filter_known_good
falsepositives:
    - Crypto trading or Web3 development workstations running unsigned tooling from user directories
level: high
tags:
    - attack.command_and_control
    - attack.t1102
    - attack.t1102.003
---
title: Aeternum Staging via Lookalike CDN and Dynamic DNS Infrastructure
id: 2c7e1a94-9d3f-4b6c-8e2a-5f1d7c4b6a92
status: experimental
description: Detects DNS resolution or connection attempts to confirmed Aeternum/LenAI staging domains including the jsDelivr typosquat cdnjsdelivr.beer and the dynamic DNS fallback node sekirolegion.duckdns.org.
author: Security Arsenal Threat Intelligence
date: 2026/09/10
logsource:
    category: dns
    product: windows
detection:
    selection:
        query|contains:
            - 'cdnjsdelivr.beer'
            - 'sekirolegion.duckdns.org'
    condition: selection
falsepositives:
    - None expected; both domains are attacker-controlled staging infrastructure
level: critical
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1568
---
title: XMRig Cryptominer Deployment via Aeternum Loader Chain
id: 5b9d3f21-7a4e-4c8b-b3d1-9e6f2a8c5d74
status: experimental
description: Detects execution of XMRig or renamed Monero mining binaries based on command-line arguments (Stratum pool configuration) frequently deployed as the final stage of Aeternum loader infections alongside XWorm and ZingoStealer.
author: Security Arsenal Threat Intelligence
date: 2026/09/10
logsource:
    category: process_creation
    product: windows
detection:
    selection_cli:
        CommandLine|contains:
            - 'stratum+tcp://'
            - '--coin=monero'
            - '--donate-level'
            - 'xmr.pool'
            - 'pool.minexmr'
            - '--randomx'
    selection_img:
        Image|endswith:
            - '\xmrig.exe'
    filter_legit:
        Image|startswith:
            - 'C:\Program Files\'
    condition: (selection_cli or selection_img) and not filter_legit
falsepositives:
    - Sanctioned mining in research environments (rare in enterprise fleets)
level: high
tags:
    - attack.impact
    - attack.t1496

// Security Arsenal Hunt: Aeternum Blockchain C2 + LenAI Infrastructure
// Scope: Process-attributed network connections to Polygon RPC endpoints and confirmed staging domains
// Platform: Microsoft Sentinel / Defender for Endpoint | Lookback: 14 days
let RPCEndpoints = dynamic(["endpoints.omniatech.io","polygon-zkevm.drpc.org","api.zan.top","polygon-mumbai.gateway.tenderly.co","polygon-rpc.com"]);
let MaliciousInfra = dynamic(["cdnjsdelivr.beer","sekirolegion.duckdns.org"]);
let AeternumHashes = dynamic(["5bfb25b8255b61e5ffdf6804451534bcfa9f1dfd225e6c8cdcefb5f50d846898","1505eda3da68e2ff9919b55a31018bd30a991236f041aee835f3bc4e430ce505"]);
union
  (DeviceNetworkEvents
   | where Timestamp > ago(14d)
   | where RemoteUrl has_any (RPCEndpoints)
   | where not (InitiatingProcessFileName has_any ("chrome.exe","msedge.exe","firefox.exe","brave.exe","node.exe"))
   | where InitiatingProcessFolderPath has_any ("\\Temp\\","\\Roaming\\","\\Public\\","\\Downloads\\","ProgramData")
   | project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessSHA256, RemoteUrl, RemoteIP, InitiatingProcessCommandLine
   | extend HitType = "Suspicious RPC Egress"),
  (DeviceNetworkEvents
   | where Timestamp > ago(14d)
   | where RemoteUrl has_any (MaliciousInfra)
   | project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessSHA256, RemoteUrl, RemoteIP, InitiatingProcessCommandLine
   | extend HitType = "Confirmed Malicious Infrastructure"),
  (DeviceProcessEvents
   | where Timestamp > ago(14d)
   | where SHA256 has_any (AeternumHashes)
   | project Timestamp, DeviceName, FileName, FolderPath, SHA256, ProcessCommandLine, InitiatingProcessFileName
   | extend HitType = "Known Aeternum Hash Execution"),
  (DeviceProcessEvents
   | where Timestamp > ago(14d)
   | where ProcessCommandLine has_any ("stratum+tcp://","--coin=monero","--donate-level")
   | project Timestamp, DeviceName, FileName, FolderPath, SHA256, ProcessCommandLine, InitiatingProcessFileName
   | extend HitType = "XMRig Mining Activity")
| sort by Timestamp desc

# Security Arsenal - Aeternum / XWorm / ZingoStealer / XMRig IOC Hunt Script
# Run elevated on suspected hosts or deploy fleet-wide via RMM/Intune
# Checks: known hashes, persistence artifacts, mining processes, C2 connections

$AeternumHashes = @(
    "5bfb25b8255b61e5ffdf6804451534bcfa9f1dfd225e6c8cdcefb5f50d846898",
    "1505eda3da68e2ff9919b55a31018bd30a991236f041aee835f3bc4e430ce505"
)
$MaliciousHosts = @("cdnjsdelivr.beer","sekirolegion.duckdns.org")
$RPCEndpoints   = @("endpoints.omniatech.io","polygon-zkevm.drpc.org","api.zan.top","polygon-mumbai.gateway.tenderly.co")
$Findings = @()

Write-Host "[1/5] Scanning user-writable paths for known Aeternum hashes..." -ForegroundColor Cyan
$ScanPaths = @("$env:TEMP","$env:APPDATA","$env:LOCALAPPDATA","C:\ProgramData","C:\Users\Public","$env:USERPROFILE\Downloads")
foreach ($Path in $ScanPaths) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -Include *.exe,*.dll -ErrorAction SilentlyContinue | ForEach-Object {
            $Hash = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($AeternumHashes -contains $Hash) {
                $Findings += [PSCustomObject]@{Type="HASH MATCH"; Detail="$($_.FullName) [$Hash]"; Severity="CRITICAL"}
            }
        }
    }
}

Write-Host "[2/5] Checking Run keys and persistence locations..." -ForegroundColor Cyan
$RunKeys = @(
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce"
)
foreach ($Key in $RunKeys) {
    if (Test-Path $Key) {
        Get-ItemProperty $Key | Get-Member -MemberType NoteProperty | ForEach-Object {
            $Val = (Get-ItemProperty $Key).($_.Name)
            if ($Val -match "Temp|AppData|Public|ProgramData" -and $Val -notmatch "OneDrive|Teams|Spotify|Zoom|Adobe") {
                $Findings += [PSCustomObject]@{Type="PERSISTENCE"; Detail="$Key\$($_.Name) = $Val"; Severity="HIGH"}
            }
        }
    }
}

Write-Host "[3/5] Checking scheduled tasks for suspicious user-context tasks..." -ForegroundColor Cyan
Get-ScheduledTask | Where-Object {$_.TaskPath -notlike "\Microsoft*"} | ForEach-Object {
    $Action = ($_.Actions | Select-Object -First 1).Execute
    if ($Action -match "Temp|AppData|Public" -and $Action -match "\.(exe|bat|ps1|vbs)$") {
        $Findings += [PSCustomObject]@{Type="SCHEDTASK"; Detail="$($_.TaskName) -> $Action"; Severity="HIGH"}
    }
}

Write-Host "[4/5] Checking active connections and DNS cache for C2 indicators..." -ForegroundColor Cyan
$Connections = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue
foreach ($Conn in $Connections) {
    $Proc = Get-Process -Id $Conn.OwningProcess -ErrorAction SilentlyContinue
    if ($Proc -and $Proc.Path -match "Temp|AppData|Public") {
        $Findings += [PSCustomObject]@{Type="SUSP CONN"; Detail="$($Proc.Name) [$($Proc.Path)] -> $($Conn.RemoteAddress):$($Conn.RemotePort)"; Severity="MEDIUM"}
    }
}
$DnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($Entry in $DnsCache) {
    foreach ($Bad in ($MaliciousHosts + $RPCEndpoints)) {
        if ($Entry.Entry -like "*$Bad*") {
            $Sev = if ($MaliciousHosts -contains $Bad) {"CRITICAL"} else {"MEDIUM"}
            $Findings += [PSCustomObject]@{Type="DNS CACHE"; Detail="$($Entry.Entry) -> $($Entry.Data)"; Severity=$Sev}
        }
    }
}

Write-Host "[5/5] Checking for mining processes and ZingoStealer staging directories..." -ForegroundColor Cyan
Get-Process -ErrorAction SilentlyContinue | Where-Object {$_.Name -match "xmrig|miner|monero"} | ForEach-Object {
    $Findings += [PSCustomObject]@{Type="MINER"; Detail="$($_.Name) [$($_.Path)]"; Severity="CRITICAL"}
}

if ($Findings.Count -gt 0) {
    Write-Host "`n=== FINDINGS: $($Findings.Count) indicator(s) detected ===" -ForegroundColor Red
    $Findings | Sort-Object Severity | Format-Table -AutoSize | Out-String | Write-Host
    $Findings | Export-Csv -Path ".\aeternum_hunt_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv" -NoTypeInformation
} else {
    Write-Host "`n[+] No Aeternum campaign indicators detected on this host." -ForegroundColor Green
}