Aeternum

Analysis of the malware’s source code reveals a multi-staged infection chain that begins with a social engineering lure impersonating a DBeaver installer.

One analysed loader unpacked itself, copied files into AppData and created a Windows Startup shortcut before contacting Polygon.

creates persistence and injects code into a signed Windows binary before security monitoring initializes.

This technique involves spawning a suspended, signed binary ( dpapimig.exe ) and injecting shellcode into its address space, effectively executing the malicious payload before security hooks are fully initialized.

One analysed loader unpacked itself, copied files into AppData and created a Windows Startup shortcut before contacting Polygon.

The Python source code points to a targeted operation. It impersonates a DBeaver installer

creates persistence and injects code into a signed Windows binary before security monitoring initializes.

This technique involves spawning a suspended, signed binary ( dpapimig.exe ) and injecting shellcode into its address space, effectively executing the malicious payload before security hooks are fully initialized.

Once launched, the samples check for virtual machines and security tools... The Python source code... rejects lightweight analysis environments

the code includes rigorous anti-analysis routines that check for specific sandbox usernames, machine names and a minimum of 8 GB of RAM.

The script includes anti-analysis checks for virtual machine environments and debugger presence.

It also includes routines aimed at credentials from more than 55 cryptocurrency browser extensions and 10 desktop wallets.

The DLL collected system information and prepared it for Telegram-based transfer

Once launched, the samples check for virtual machines and security tools... The Python source code... rejects lightweight analysis environments

the code includes rigorous anti-analysis routines that check for specific sandbox usernames, machine names and a minimum of 8 GB of RAM.

The script includes anti-analysis checks for virtual machine environments and debugger presence.

It features hard-coded routines to harvest credentials from over 55 cryptocurrency browser extensions and 10 popular desktop wallets.

Aeternum uses a smart contract as a public noticeboard for infected devices... Each bot queries Polygon remote procedure call services and reads a contract value containing either a command or a destination for the next stage.

It then fetched benign-looking and malicious files from code repositories.

Aeternum can deliver further malware, collect host and wallet data, and send it through Telegram or another control server.

It dropped an XWorm remote-access tool and a miner

Once launched, the samples check for virtual machines and security tools