PowerShell Malware Abuses Registry and DNS TXT Records to Deploy XMRig Crypto Miner

A sophisticated cryptomining campaign is employing multiple layers of obfuscation to conceal malicious PowerShell payloads and ultimately deploy an XMRig-based cryptocurrency miner. This obfuscation includes Windows Registry entries, DNS TXT records, PNG images, and WAV audio files.

The infection was detected after repeated security alerts indicated suspicious PowerShell activity. The initial execution command launched PowerShell using the -NoProfile and execution-policy bypass options and retrieved code stored in a Registry value located at HKLM:\Software\uf42a9660377\vstdfehzr.

PowerShell Malware Abuses Registry

Instead of saving the next-stage script as a conventional .ps1 file, the attackers encoded the PowerShell data in the Registry. The loader dynamically read, decoded, and executed this data in memory, thereby limiting the malware’s disk footprint and making detection more challenging.

According to K7 Security Labs, the Registry-resident script then queried DNS TXT records associated with sslvalidcert[.]com, which were later replaced by txtcdn[.]net. The TXT responses contained comma-separated decimal values that the malware converted into ASCII text. This process reconstructed a URL pointing to a PNG image hosted at frames-1zm[.]pages[.]dev.

Rather than serving as standard media, the image acted as a covert payload container. The PowerShell script extracted data hidden in the PNG’s red pixel channel, reconstructed the embedded code, and executed it on the infected host. This stage established command-and-control communication and retrieved further PowerShell instructions.

Subsequently, the malware deleted files from the Public\Music directory. It downloaded a ZIP archive containing files disguised as audio tracks, such as Atsg.wav and Tmav.wav. Even though these files had a .wav extension, they contained encoded malicious PowerShell scripts and embedded .NET payloads.

The Atsg.wav stage primarily focused on persistence and evasion. It modified PowerShell settings, attempted to weaken telemetry and security controls, added broad Microsoft Defender exclusions, and cleared PowerShell command history artifacts. Additionally, the malware created hidden Scheduled Tasks configured to execute at logon and at recurring intervals.

The campaign also established a WMI permanent event subscription that monitored Registry-related events, triggering execution when specified conditions changed. This gave the attackers another persistence mechanism that could survive restarts and maintain access.

The malware generated a unique 20-character hardware identifier for each compromised system and stored it in the Registry. To discover command-and-control servers, it used DNS-over-HTTPS queries to retrieve TXT records linked to httptls[.]org.

It then communicated with discovered C2 infrastructure through HTTP or HTTPS POST requests, using an X-HWID header to identify the victims.

Both WAV-based stages reconstructed hidden .NET assemblies by skipping the standard 44-byte WAV header and combining lower nibbles from consecutive bytes. The resulting payloads were loaded directly into memory using [Reflection.Assembly]::Load(), thereby avoiding the need to write executable files to disk.

The final payload was an XMRig-associated miner configured to utilize the RandomX rx/0 algorithm. It retrieved additional configuration data remotely, including settings for the mining pool, wallet, TLS, keepalive, and CPU usage. The malware also dropped WinRing0.sys, a driver commonly used to optimize CPU performance during RandomX mining.

Indicators of Compromise

Type	Indicator	Details
Registry path	HKLM:\Software\uf42a9660377\vstdfehzr	Stores encoded PowerShell stage
Domain	sslvalidcert[.]com	DNS TXT payload delivery
Domain	txtcdn[.]net	Later DNS TXT payload delivery
Domain	httptls[.]org	DNS-over-HTTPS C2 discovery
URL	https[:]//frames-1zm[.]pages.dev/frames.png	PNG payload container
URL	https[:]//publicwavlib[.]pages.dev/hdaudio.wav	WAV-hosted .NET assembly
URL	https[:]//publicwavlib[.]pages.dev/mav.wav	WAV-hosted .NET executable
URL	https[:]//wavmain[.]pages.dev/main.wav	Malicious payload resource
URL	https[:]//config-rg7[.]pages.dev/config.txt	Mining configuration
URL	https[:]//softtestcopapool[.]pages.dev/rxconfig.txt	Mining configuration
File	Realtek HD Audio.wav	MD5: ED276B2312F641B00F87FA18E85C48EB
File	mav.wav	MD5: BE860A15B7E5D44B0B3D67F598238FAD
File	tmav.wav	MD5: C024189E1E7FA0AE6D24353367E8B98D
File	atsg.wav	MD5: 94B50ACE73CC03790678C73B867BE129
File	fp.dll	MD5: F94DE28BD66AFC4679F546500DB184D4
File	upgrade.exe	MD5: F1D2FDB7F3B699DA69A050C5352A33C2
C2 server	104[.]21[.]2[.]193:8443	Command-and-control endpoint

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC