ArmorSteal steals passwords, crypto wallets and hides miner
Original title: ArmorSteal Malware Steals Passwords and Crypto Wallet Data, Hides Mining When Task Manager Opens
ArmorSteal installs via Chocolatey lures and runs a stealth Monero miner that detects Task Manager.
ArmorSteal is a Python-based Windows malware kit that steals credentials and crypto wallets while hiding its Monero miner. It drops into C:\Windows\SystemHealth\Update after luring users to typosquatted Chocolatey pages. The kit uses PyArmor protection and scheduled tasks to persist. It checks for monitoring tools and kills the miner if detected.
- Miner restarts after closing monitoring tools
- Checks 20 monitoring tools including Task Manager
- 11 C2 domains in priority order
- Adds C:\Windows and xmrig.exe to Defender exclusions
- Swaps clipboard addresses for attacker wallets
Impact: steals credentials and crypto wallets while running hidden miner
- 1.Remove C:\Windows Defender exclusions
- 2.Review PowerShell logs for lure domains
- 3.Hunt for SysCheck2 and SysHeal tasks
- Vendors
- Seqrite
- Malware
- ArmorSteal
- Organizations
- Zscaler
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | choclatey.org | ons[.]is and datamons[.]org, and it listed the lure domains choclatey[.]org and massgravel[.]net. Defenders should hunt for the SysCh |
| domain | datamons.org | It then tries 11 C2 domains in priority order, so blocking datamons[.]org alone achieves little. ArmorSteal Malware Attack Every 60 |
| domain | icedhatch.top | y[.]top Domain datamons[.]org Domain supertrap[.]net Domain icedhatch[.]top Domain icedhatch[.]xyz Domain icedout[.]top IP address 18 |
| domain | icedhatch.xyz | [.]org Domain supertrap[.]net Domain icedhatch[.]top Domain icedhatch[.]xyz Domain icedout[.]top IP address 186.2.175[.]158 IP addres |
| domain | icedout.top | [.]net Domain icedhatch[.]top Domain icedhatch[.]xyz Domain icedout[.]top IP address 186.2.175[.]158 IP address 186.2.163[.]193 Not |
| domain | massgravel.net | s[.]org, and it listed the lure domains choclatey[.]org and massgravel[.]net. Defenders should hunt for the SysCheck2, SysCheckX and S |
| domain | niceer.net | pymons[.]is Domain pur[.]st Domain workerstats[.]net Domain niceer[.]net Domain plaineagle[.]xyz Domain univalley[.]top Domain dat |
| domain | plaineagle.xyz | ur[.]st Domain workerstats[.]net Domain niceer[.]net Domain plaineagle[.]xyz Domain univalley[.]top Domain datamons[.]org Domain super |
| domain | pur.st | tors of compromise Type Indicator Domain pymons[.]is Domain pur[.]st Domain workerstats[.]net Domain niceer[.]net Domain plain |
| domain | pymons.is | mElevator link (Source : Seqrite). On 31 October 2026, only pymons[.]is (186.2.175[.]158) and datamons[.]org (186.2.163[.]193) st |
| domain | supertrap.net | e[.]xyz Domain univalley[.]top Domain datamons[.]org Domain supertrap[.]net Domain icedhatch[.]top Domain icedhatch[.]xyz Domain iced |
| domain | univalley.top | ts[.]net Domain niceer[.]net Domain plaineagle[.]xyz Domain univalley[.]top Domain datamons[.]org Domain supertrap[.]net Domain icedh |
| domain | workerstats.net | ic reports. Zscaler had already seen the operator move from workerstats[.]net to pymons[.]is and datamons[.]org, and it listed the lure |
| ipv4 | 186.2.163.193 | 026, only pymons[.]is (186.2.175[.]158) and datamons[.]org (186.2.163[.]193) still resolved. Six of the 11 domains had no public repo |
| ipv4 | 186.2.175.158 | k (Source : Seqrite). On 31 October 2026, only pymons[.]is (186.2.175[.]158) and datamons[.]org (186.2.163[.]193) still resolved. Six |
From the original article
3 min read at gbhackers.com
ArmorSteal, a Python-based Windows malware kit. It steals credentials and crypto wallets, hijacks clipboard addresses, and runs a hidden Monero-style miner. The miner shuts down whenever a user opens Task Manager or another monitoring tool.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.