AETERNUM LOADER: INSIDE THE BINARY

Summary from the TLDR InfoSec newsletter

Researchers reversed the Aeternum Loader malware, revealing its use of the Polygon blockchain for C2 communications via a hardcoded smart contract address, with AES-encrypted commands that can be decrypted using only the contract address as the key. The loader employs per-string XOR obfuscation, CRC32/DJB2 API hashing, NTFS ADS-based self-deletion, PPID spoofing to explorer.exe, and novel anti-VM checks including CPUID thermal/power MSR detection and SMBIOS BIOS characteristics bit counting. Notably, the blockchain C2 approach creates a permanent, immutable record of all attacker commands, giving defenders a historical audit trail once the encryption is broken.