CoinMiner

CoinMiner is a cryptocurrency-mining malware family. The provided reporting describes it primarily as a Windows-focused miner that typically uses Windows Management Instrumentation (WMI) to spread laterally across a network and often uses WMI Standard Event Consumer scripting for persistence. Multiple variants exist, and observed infection vectors include malspam, being dropped by other malware, PowerShell-based retrieval and execution, exploitation of vulnerable or weakly protected internet-exposed services, and follow-on deployment after other malware such as SocGholish. CoinMiner was observed in attacks against exposed MS-SQL servers, where attackers installed the miner after gaining access, and in broader opportunistic scanning of externally exposed systems with vulnerable services. It was also referenced in Linux SSH threat telemetry as one of the main malware threats observed against Linux SSH services. Reporting further identified an active campaign in which a CoinMiner payload was signed with a stolen AnyDesk Software GmbH certificate and delivered alongside numerous other payloads in an Amadey-linked operation assessed as consistent with an initial access broker or ransomware affiliate playbook. Another report identified an exposed HTTPS file server at 118.209.200.36:8443 in TPG Telecom Limited IP space as active staging infrastructure for a CoinMiner plus Android APK distribution campaign, with .apk, .lnk, and .scr payloads hosted there. Known detections and indicators mentioned in the content include detection names Win.Worm.Coinminer::1201 and Coinminer:MBT.26mw.in14.Talos, a prevalent sample with SHA-256 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 and MD5 2915b3f8b703eb744fc54c81f4a9c67f, and the staging server 118.209.200.36:8443.