Loading malware…
PureMiner is a stealth-focused .NET cryptominer marketed within the PureCoder malware suite. It targets Windows systems and can deploy CPU- or GPU-based cryptocurrency-mining modules according to attacker configuration. It profiles host hardware, including video adapters and GPU memory, using AMD and NVIDIA interfaces, and checks available memory before mining. Observed variants encrypt command-and-control traffic, receive serialized tasking, can download and execute additional payloads, and monitor analysis tools, active windows, and system idle state to reduce mining visibility. PureMiner has been distributed through fraudulent software-installer ISO images in financially motivated REF1695 activity and through phishing chains targeting Ukraine that used malicious SVG attachments and follow-on loader stages. It has also been delivered by the PureCrypter loader service. REF1695-associated activity used PureMiner alongside PureRAT and custom XMRig loaders to monetize compromised hosts through cryptomining.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Campaign 3 drops multiple embedded payloads, including PureRAT, a custom XMRig loader, and PureMiner.
PureMiner This is a hidden stealth silent miner; an attacker can use it for bots or spread it, and it will automatically mine ETHW or BTC to TAs wallet.
12 distinct techniques documented for this family, organized by ATT&CK tactic.
These attacks leverage an ISO file as the infection vector to deliver a .NET Reactor-protected loader
The loader invokes PowerShell with -WindowStyle Hidden to register Defender exclusions, execute extracted stages, and launch payloads.
TTP MITRE Technique Description Python-Based Infostealer Payload T1059.006 – Command and Scripting Interpreter: Python Core PXA Stealer signature across all known campaigns
Beyond the C2 infrastructure, the threat actor abuses GitHub as a payload delivery CDN, hosting staged binaries across two identified accounts
These attacks leverage an ISO file as the infection vector to deliver a .NET Reactor-protected loader and a text file with explicit instructions to the user to bypass Microsoft Defender SmartScreen protections against running unrecognized applications by clicking on "More info" and "Run anyway."
The operation deploys RATs and cryptominers through fake installer packages; Campaign 1 uses an ISO containing a protected loader and a ReadMe.txt lure.
Threat operation REF1695 has been harnessing counterfeit installers to facilitate multiple attack campaigns delivering remote access trojans and cryptocurrency mining malware since November 2023.
Beyond the C2 infrastructure, the threat actor abuses GitHub as a payload delivery CDN, hosting staged binaries across two identified accounts
CNB Bot profiles the victim and sends Windows version, privileges, processor name, GPU names, and executable path to its C2.
While most recent campaigns involved a fake ISO file that distributed a .NET Reactor-protected loader and text file facilitating the eventual deployment of the CNB Bot implant... REF1695 also leveraged ISO lures to spread the PureMiner and PureRAT payloads...
CNB Bot communicates with C2 by HTTP POST requests; PureRAT uses configured web C2 servers to receive encrypted Protobuf command messages.
Beyond the C2 infrastructure, the threat actor abuses GitHub as a payload delivery CDN, hosting staged binaries across two identified accounts.
The operation deploys cryptominers; the XMRig loader launches a renamed XMRig payload and SilentCryptoMiner injects Monero or Ethereum miners into processes.
9 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.