xmrigMalware
According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling". In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once.From MISP Galaxy
Last reported 2 months ago, by Group-IB6 reports
ATT&CK techniques
6 of 41 · each with the sentence it comes from- T1036Masquerading
“Masquerading: Match Legitimate Name”
- T1505.003Web Shell
“SOCKS5-over-HTTP tunnel tool, used to pivot through web shells planted on victim servers”
- T1547Boot or Logon Autostart Execution
“Boot or Logon Autostart Execution”
- T1059.001PowerShell
“T1059.001 (PowerShell) and T1059.003 (Windows Command Shell)”
- T1059.003Windows Command Shell
“T1059.001 (PowerShell) and T1059.003 (Windows Command Shell)”
- T1071.001Web Protocols
“T1071.001”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
6 reports, newest first · the exact sentence from each-
XMRig Covert Ops: The Cryptomining Campaign That Abuses Trusted Access and Deploys Forensic Smokescreens“./xmrig -lan 192.168.0.1”
-
JadeProx: Tracing a China-nexus Operation Through an OPSEC Mistake“hxxps://github.com/xmrig/xmrig-proxy”
-
The Sharp Taste of Mimo'lette: Mimo Targets Craft CMS“The function also terminates all active xmrig processes to eliminate interference from previous infections.”
-
Linux & Cloud Detection Engineering - TeamPCP Container Attack Scenario“The competitor-killing logic from TeamPCP is very limited in comparison to its competitors, focusing only on xmrig.”
-
SlashAndGrab“We also observed adversaries downloading and using a xmrig cryptominer, with further details below.”
-
Threat Advisory: XMRig Cryptomining By Way Of TeamViewer“…ccess, including PowerShell scripts to download the XMRig miner from hxxp://follow247.xyz/ViewXmrig and subsequently, hxxps://github.com/xmrig/xmrig/releases/latest”
Indicators in its reports
named in the reports above- 85.106.113[.]168in 1 report
- n1tr0[.]onlinein 1 report
- windows.n1tro[.]cyouin 1 report
- 1aa4d88a38f5a27a…9abc29ea671ein 1 report
- 3a71680ffb4264e0…2125a98b94aain 1 report
- fc04f1ef05847607…252c18dd7a62in 1 report
- 7868cb82440632cc…daf1d108ee9ain 1 report
- 2e46816450ad1b4b…b6c36bbb3fd5in 1 report
- hxxp://15.188.246[.]198/alamdar.x86_64in 1 report
- 15.188.246[.]198in 1 report
Copy these 10 indicators · defanged
Thanks — we review every report.