PowerShell Malware Abuses Registry and DNS TXT Records to Deploy XMRig Crypto Miner
K7 Security Labs dissected a PowerShell cryptomining chain hiding payloads in registry, DNS TXT records, PNG pixels and WAV files to deploy XMRig.
A multi-stage cryptomining campaign stores an encoded PowerShell loader in the registry value HKLM:\Software\uf42a9660377\vstdfehzr, then retrieves payload stages via DNS TXT records on sslvalidcert[.]com and txtcdn[.]net. Data hidden in a PNG's red pixel channel and in WAV files (Atsg.wav, Tmav.wav) is decoded in memory into .NET assemblies loaded via [Reflection.Assembly]::Load(). Persistence uses hidden scheduled tasks and a WMI permanent event subscription, while defenses are weakened via Microsoft Defender exclusions and PowerShell history clearing. The final XMRig miner uses the RandomX rx/0 algorithm, discovers C2 via DNS-over-HTTPS to httptls[.]org, and identifies victims with an X-HWID header.