Aeternum Blockchain C2, Midnight Blizzard 'CaptiveCrunch' M365 Credential Theft, and GoldDigger Android Banking Trojan: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Blockchain RPC C2 Communication from Endpoint (Aeternum / LenAI)
id: 8f3a1c2e-7b41-4e9d-a6f2-1d5c9e8b3a01
status: experimental
description: Detects endpoint processes initiating JSON-RPC traffic to public blockchain RPC endpoints, consistent with Aeternum botnet smart-contract C2 retrieval
author: Security Arsenal Threat Intel
date: 2026/08/12
references:
    - https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/
logsource:
    category: proxy
    product: proxy
detection:
    selection_host:
        cs-host|contains:
            - 'endpoints.omniatech.io'
            - 'polygon-zkevm.drpc.org'
            - 'polygon-mumbai.gateway.tenderly.co'
            - 'api.zan.top'
    selection_method:
        cs-method: 'POST'
    filter_business:
        cs-host|contains:
            - '.internal.example.com'
    condition: selection_host and selection_method and not filter_business
fields:
    - c-ip
    - cs-host
    - cs-uri
    - cs-user-agent
falsepositives:
    - Legitimate Web3/crypto development teams
    - Blockchain analytics platforms
level: high
tags:
    - attack.command_and_control
    - attack.t1102
    - attack.t1071.001
---
title: Aeternum / CaptiveCrunch Malware Infrastructure Resolution
id: 2c7d4f9a-3e18-4b6c-9d21-5a8f6c0e7b42
status: experimental
description: Detects DNS resolution of Aeternum staging domains and Midnight Blizzard CaptiveCrunch M365 phishing domains
author: Security Arsenal Threat Intel
date: 2026/08/12
logsource:
    category: dns
detection:
    selection:
        query|contains:
            - 'sekirolegion.duckdns.org'
            - 'cdnjsdelivr.beer'
            - 'm365-owa.com'
            - 'ms365-device.com'
            - 'ms365-live.com'
            - 'owa-ms365.com'
    condition: selection
fields:
    - ClientIP
    - query
falsepositives:
    - Threat research and sandbox detonation
level: critical
tags:
    - attack.command_and_control
    - attack.t1566
    - attack.t1071.004
---
title: ClickFix Social Engineering — Suspicious Clipboard-to-Run Execution
id: 5e9b3d71-4c26-4f8a-b1d3-8e2a7c5f9d06
status: experimental
description: Detects ClickFix-style execution where users paste malicious commands into Run dialog or terminal spawning encoded PowerShell/mshta/curl, as used in CaptiveCrunch delivery of CornFlake and ChocoShell
author: Security Arsenal Threat Intel
date: 2026/08/12
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\explorer.exe'
            - '\msedge.exe'
            - '\chrome.exe'
            - '\firefox.exe'
    selection_child:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\mshta.exe'
            - '\curl.exe'
            - '\rundll32.exe'
    selection_cmd:
        CommandLine|contains:
            - '-enc'
            - '-e '
            - 'FromBase64String'
            - 'iex'
            - 'IWR'
            - 'Invoke-WebRequest'
    condition: selection_parent and selection_child and selection_cmd
falsepositives:
    - IT admin remote remediation scripts
    - Software deployment tooling
level: high
tags:
    - attack.execution
    - attack.t1059.001
    - attack.t1204.002

// CaptiveCrunch & Aeternum — Network and Process Hunt (Microsoft Sentinel)
let PhishDomains = dynamic(["m365-owa.com","ms365-device.com","ms365-live.com","owa-ms365.com","sekirolegion.duckdns.org","cdnjsdelivr.beer"]);
let BadIPs = dynamic(["193.221.200.219","38.146.28.75"]);
let BlockchainRPC = dynamic(["endpoints.omniatech.io","polygon-zkevm.drpc.org","polygon-mumbai.gateway.tenderly.co","api.zan.top"]);
let Lookback = 14d;
let NetEvents = DeviceNetworkEvents
    | where Timestamp > ago(Lookback)
    | where RemoteUrl has_any (PhishDomains) or RemoteIP in (BadIPs) or RemoteUrl has_any (BlockchainRPC)
    | extend IOCType = case(
        RemoteUrl has_any (PhishDomains), "Phishing/Staging Domain",
        RemoteIP in (BadIPs), "Malicious IP",
        RemoteUrl has_any (BlockchainRPC), "Blockchain RPC C2",
        "Other")
    | project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort, IOCType;
NetEvents
| join kind=leftouter (
    DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where ProcessCommandLine has_any ("-enc","FromBase64String","iex","Invoke-WebRequest","IWR ")
      and InitiatingProcessFileName in~ ("msedge.exe","chrome.exe","firefox.exe","explorer.exe")
    | project ProcTimestamp=Timestamp, DeviceName, ClickFixCmd=ProcessCommandLine, ProcFile=FileName
) on DeviceName
| extend ClickFixSuspect = isnotempty(ClickFixCmd)
| summarize Connections=count(), FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Processes=make_set(InitiatingProcessFileName), ClickFix=any(ClickFixSuspect) by DeviceName, InitiatingProcessAccountName, IOCType
| sort by LastSeen desc

# Security Arsenal — Aeternum / CaptiveCrunch IOC Hunt Script
# Run elevated on Windows endpoints. Outputs findings to console + CSV.
$Results = @()
$Now = Get-Date

# --- 1. Network connections to known-bad IPs and blockchain RPC C2 ---
$BadIPs = @('193.221.200.219','38.146.28.75')
$BadHosts = @('endpoints.omniatech.io','polygon-zkevm.drpc.org','polygon-mumbai.gateway.tenderly.co','api.zan.top','sekirolegion.duckdns.org','cdnjsdelivr.beer','m365-owa.com','ms365-device.com','ms365-live.com','owa-ms365.com')

Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | Where-Object {
    $BadIPs -contains $_.RemoteAddress
} | ForEach-Object {
    $p = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    $Results += [PSCustomObject]@{Type='Network-IP'; Indicator=$_.RemoteAddress; Process=$p.ProcessName; PID=$_.OwningProcess; Time=$Now}
}

# --- 2. DNS cache hits for malicious / RPC domains ---
$dns = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($h in $BadHosts) {
    $dns | Where-Object { $_.Entry -like "*$h*" } | ForEach-Object {
        $Results += [PSCustomObject]@{Type='DNS-Cache'; Indicator=$_.Entry; Process='N/A'; PID='N/A'; Time=$Now}
    }
}

# --- 3. Persistence: Run keys & scheduled tasks referencing suspicious binaries (XWorm/XMRig patterns) ---
$RunKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run','HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run')
foreach ($k in $RunKeys) {
    Get-ItemProperty -Path $k -ErrorAction SilentlyContinue | ForEach-Object {
        $_.PSObject.Properties | Where-Object { $_.Value -match 'AppData|Temp|xmrig|powershell.*-enc|mshta' } | ForEach-Object {
            $Results += [PSCustomObject]@{Type='Persistence-RunKey'; Indicator="$k\$($_.Name) = $($_.Value)"; Process='N/A'; PID='N/A'; Time=$Now}
        }
    }
}
Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object {
    ($_.Actions.Execute -match 'powershell|mshta|curl') -and ($_.Actions.Arguments -match '-enc|IWR|http')
} | ForEach-Object {
    $Results += [PSCustomObject]@{Type='Persistence-SchedTask'; Indicator="$($_.TaskName): $($_.Actions.Execute) $($_.Actions.Arguments)"; Process='N/A'; PID='N/A'; Time=$Now}
}

# --- 4. File hash sweep (Aeternum loader / CornFlake / ChocoShell samples) ---
$Hashes = @(
 '5bfb25b8255b61e5ffdf6804451534bcfa9f1dfd225e6c8cdcefb5f50d846898',
 '918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593',
 'be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c'
)
$SearchPaths = @("$env:TEMP","$env:APPDATA","$env:LOCALAPPDATA","$env:USERPROFILE\Downloads")
foreach ($path in $SearchPaths) {
    Get-ChildItem -Path $path -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
        $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($Hashes -contains $h) {
            $Results += [PSCustomObject]@{Type='FileHash-Match'; Indicator=$_.FullName; Process=$h; PID='N/A'; Time=$Now}
        }
    }
}

if ($Results.Count -gt 0) {
    $Results | Format-Table -AutoSize
    $Results | Export-Csv -Path ".\IOC_Hunt_$($env:COMPUTERNAME)_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation
    Write-Host "[!] $($Results.Count) indicator(s) found — escalate to IR immediately." -ForegroundColor Red
} else {
    Write-Host "[+] No indicators matched on $env:COMPUTERNAME." -ForegroundColor Green
}