PowerShell Malware Abuses Registry and DNS TXT Records to Deploy XMRig Crypto Miner
K7 Security Labs dissected a PowerShell cryptomining chain hiding payloads in registry, DNS TXT records, PNG pixels and WAV files to deploy XMRig.
A multi-stage cryptomining campaign stores an encoded PowerShell loader in the registry value HKLM:\Software\uf42a9660377\vstdfehzr, then retrieves payload stages via DNS TXT records on sslvalidcert[.]com and txtcdn[.]net. Data hidden in a PNG's red pixel channel and in WAV files (Atsg.wav, Tmav.wav) is decoded in memory into .NET assemblies loaded via [Reflection.Assembly]::Load(). Persistence uses hidden scheduled tasks and a WMI permanent event subscription, while defenses are weakened via Microsoft Defender exclusions and PowerShell history clearing. The final XMRig miner uses the RandomX rx/0 algorithm, discovers C2 via DNS-over-HTTPS to httptls[.]org, and identifies victims with an X-HWID header.
- Fileless loader reads encoded PowerShell from a registry value
- Steganographic payloads hidden in PNG red channel and WAV files
- Persistence via scheduled tasks and WMI permanent event subscriptions
- Defender exclusions added and PowerShell history cleared
- XMRig miner with RandomX rx/0, C2 found via DNS-over-HTTPS
- ATT&CK
- T1059.001 Command and Scripting Interpreter: PowerShellT1027.003 Obfuscated Files or Information: SteganographyT1546.005 Event Triggered Execution: WMI Event SubscriptionT1053.005 Scheduled Task/Job: Scheduled TaskT1562.001 Impair Defenses: Disable or Modify Tools
- Vendors
- K7 Security Labs
- Products
- XMRigMicrosoft DefenderWinRing0
- Malware
- XMRig
- Organizations
- K7 Security Labs
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | config-rg7.pages | pages.dev/main.wav Malicious payload resource URL https[:]//config-rg7[.]pages.dev/config.txt Mining configuration URL https[:]//softtes |
| domain | frames-1zm.pages | ain httptls[.]org DNS-over-HTTPS C2 discovery URL https[:]//frames-1zm[.]pages.dev/frames.png PNG payload container URL https[:]//public |
| domain | frames-1zm.pages.dev | ocess reconstructed a URL pointing to a PNG image hosted at frames-1zm[.]pages[.]dev. Rather than serving as standard media, the image acted |
| domain | httptls.org | ed DNS-over-HTTPS queries to retrieve TXT records linked to httptls[.]org. XMRig configuration fetched (Source: K7 Security Labs) I |
| domain | publicwavlib.pages | [.]pages.dev/frames.png PNG payload container URL https[:]//publicwavlib[.]pages.dev/hdaudio.wav WAV-hosted .NET assembly URL https[:]//pu |
| domain | softtestcopapool.pages | 7[.]pages.dev/config.txt Mining configuration URL https[:]//softtestcopapool[.]pages.dev/rxconfig.txt Mining configuration File Realtek HD Aud |
| domain | sslvalidcert.com | esident script then queried DNS TXT records associated with sslvalidcert[.]com, which were later replaced by txtcdn[.]net. The TXT respo |
| domain | txtcdn.net | iated with sslvalidcert[.]com, which were later replaced by txtcdn[.]net. The TXT responses contained comma-separated decimal valu |
| domain | wavmain.pages | ]pages.dev/mav.wav WAV-hosted .NET executable URL https[:]//wavmain[.]pages.dev/main.wav Malicious payload resource URL https[:]//con |
| ipv4 | 104.21.2.193 | upgrade.exe MD5: F1D2FDB7F3B699DA69A050C5352A33C2 C2 server 104[.]21[.]2[.]193:8443 Command-and-control endpoint Note: IP addresses |
| md5 | 94b50ace73cc03790678c73b867be129 | av MD5: C024189E1E7FA0AE6D24353367E8B98D File atsg.wav MD5: 94B50ACE73CC03790678C73B867BE129 File fp.dll MD5: F94DE28BD66AFC4679F546500DB184D4 File upgr |
| md5 | be860a15b7e5d44b0b3d67f598238fad | wav MD5: ED276B2312F641B00F87FA18E85C48EB File mav.wav MD5: BE860A15B7E5D44B0B3D67F598238FAD File tmav.wav MD5: C024189E1E7FA0AE6D24353367E8B98D File at |
| md5 | c024189e1e7fa0ae6d24353367e8b98d | av MD5: BE860A15B7E5D44B0B3D67F598238FAD File tmav.wav MD5: C024189E1E7FA0AE6D24353367E8B98D File atsg.wav MD5: 94B50ACE73CC03790678C73B867BE129 File fp |
| md5 | ed276b2312f641b00f87fa18e85c48eb | fig.txt Mining configuration File Realtek HD Audio.wav MD5: ED276B2312F641B00F87FA18E85C48EB File mav.wav MD5: BE860A15B7E5D44B0B3D67F598238FAD File tma |
| md5 | f1d2fdb7f3b699da69a050c5352a33c2 | MD5: F94DE28BD66AFC4679F546500DB184D4 File upgrade.exe MD5: F1D2FDB7F3B699DA69A050C5352A33C2 C2 server 104[.]21[.]2[.]193:8443 Command-and-control endpo |
| md5 | f94de28bd66afc4679f546500db184d4 | .wav MD5: 94B50ACE73CC03790678C73B867BE129 File fp.dll MD5: F94DE28BD66AFC4679F546500DB184D4 File upgrade.exe MD5: F1D2FDB7F3B699DA69A050C5352A33C2 C2 s |
From the original article
3 min read at gbhackers.com
A sophisticated cryptomining campaign is employing multiple layers of obfuscation to conceal malicious PowerShell payloads and ultimately deploy an XMRig-based cryptocurrency miner. This obfuscation includes Windows Registry entries, DNS TXT records, PNG images, and WAV audio files. The infection was detected after repeated security alerts indicated suspicious PowerShell activity.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.