Loading malware…
XMR-Stak is a publicly available cryptocurrency mining program primarily used to mine Monero and related CryptoNight/RandomX-family coins. Although it originated as a legitimate miner, it has been widely repurposed in cryptojacking operations and unauthorized mining campaigns across Windows, Linux, and macOS environments. It is commonly deployed after exploitation of internet-facing services or through follow-on scripts and loaders that fetch, configure, and launch the miner on compromised hosts.
Observed malicious use of XMR-Stak includes deployment in campaigns exploiting enterprise server vulnerabilities such as Microsoft Exchange ProxyLogon and multiple pre-authentication flaws affecting products including Apache HTTP Server, Atlassian Confluence, F5 BIG-IP, VMware vCenter, Oracle WebLogic Server, Jenkins, and Redis-exposed environments. In these intrusions, attackers used shell scripts, batch scripts, droppers, and compromised legitimate hosting platforms to retrieve miner binaries and configuration data, remove competing miners, assess host resources, and keep mining processes running persistently.
XMR-Stak has been seen embedded in broader malware ecosystems including Linux cryptomining botnets such as Watchbog and post-exploitation frameworks such as ShadowHS, where it appears alongside alternative miners and operational logic for pool failover, architecture selection, and anti-competition cleanup. On Windows, it has been staged through downloader scripts and injector components that unpack miner resources, configure them, and in some cases inject the miner into another process for defense evasion. On Linux, it has been launched through scripts that kill rival miners, fetch architecture-specific binaries, and execute them in the background. On macOS, it has been observed bundled inside an application framework and launched as a child process to mine Monero using configured CPU limits.
Documented behaviors associated with malicious XMR-Stak deployments include cryptocurrency mining, persistence via startup items or services, process injection through companion tooling, defense evasion through artifact cleanup and in-memory execution, and exfiltration of mining telemetry or configuration status to operator-controlled services. XMR-Stak is therefore best understood as a dual-use miner that frequently serves as the monetization payload in opportunistic and botnet-driven cryptojacking campaigns targeting enterprise servers and end-user systems.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Among the files contained in the QuickCPU.dat archive are the configurator for the miner, which appears to be xmr-stak. By default, the payload sets up the miner so that it only can communicate if it can have a secure TLS connection back to the Monero wallet where it will store its value.
18 distinct techniques documented for this family, organized by ATT&CK tactic.
After all the competing miners are wiped out, the attribute of /var/spool/cron/root is made immutable and crontab is reloaded.
The batch script is renamed as a temporary file and deleted after it starts running in the background.
The attack begins with a PowerShell command to retrieve a file named win_r.zip from another compromised server’s Outlook Web Access logon path (/owa/auth).
The .zip file is not a compressed archive, but a batch script that then invokes the built-into-Windows certutil.exe program to download two additional files
Earlier this year, a security flaw identified as CVE-2021-41773 was disclosed to Apache HTTP Server Project, a path traversal and remote code execution (RCE) flaw in Apache HTTP Server 2.4.49.
The file uses forged data in its Properties sheet that indicates the file is a Windows component, but the binary is not digitally signed
When decoded, the batch script runs the executable, which extracts the miner and configuration data from the QuickCPU.dat file, injects it into a system process, and then deletes the evidence.
The batch file then deletes the evidence and the miner remains running in memory, injected into a process already running on the system.
The certutil application is designed to be able to decode base64-encoded security certificates, so the attackers have leveraged that functionality by encoding an executable payload in base64 and wrapping it in headers that indicate it is some form of digital certificate.
12 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Cryptocurrency miner (including CUDA GPU backend usage noted) that can be deployed on-demand by the framework for monetization.
A Monero cryptominer used as the final payload on compromised Microsoft Exchange servers. It is configured to mine Monero, communicate over TLS to the attacker-controlled wallet/pool, and persist by being injected into a running system process after extraction from QuickCPU.dat.
A Monero mining binary downloaded and executed on infected Linux hosts as part of the cryptomining operation.
Monero mining client downloaded and installed by Watchbog to perform cryptocurrency mining on compromised Linux hosts.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.