Loading malware…
SilentCryptoMiner is a Windows-focused covert cryptocurrency miner derived from the open-source XMRig miner. It hijacks victim CPU and GPU resources to mine Monero and, depending on build configuration, may support other cryptocurrencies and mining algorithms. Documented variants use direct system calls, process injection or process hollowing, anti-analysis checks, and suspension of mining when security or analysis tools are detected. Some variants use the WinRing0 driver to tune processor settings for improved mining performance.
SilentCryptoMiner establishes persistence through scheduled tasks, services, or user-level autorun mechanisms, and can disable sleep and hibernation to maximize mining uptime. Certain variants inject a watchdog into a Windows process; the watchdog monitors the miner and restores removed payloads and persistence artifacts. A later campaign variant collected hardware identifiers and exfiltrated them through DNS tunneling disguised as benign traffic. That campaign also used DLL side-loading, in-memory reflective loading, and, when elevated, disabled security controls.
SilentCryptoMiner has been distributed through trojanized or fake software installers, fake VPN and network-restriction-bypass tools, fake media-player or browser-update prompts on pirated-content sites, and steganographically embedded components. The financially motivated cluster tracked as REF1695 deployed SilentCryptoMiner alongside remote-access malware and custom XMRig loaders in fake-installer campaigns active since late 2023. Other campaigns particularly targeted Russian Windows users with trojanized restriction-bypass utilities.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
The Umnr_-prefixed loader is a Themida-packed SilentCryptoMiner loader that injects a watchdog into conhost.exe and a miner into explorer.exe.
50 distinct techniques documented for this family, organized by ATT&CK tactic.
By visiting pirated movie and TV show streaming sites, users are met with a fake alert claiming their video player plugin is out of date. One click on that fake update button kicks off an infection.
the attackers threatened the content creators under the pretext of copyright infringement, demanding that they post videos with malicious links or risk shutdown of their YouTube channels.
The infection chain leveraged a fake update for a video player plugin. When the user attempted to watch a video, the player displayed a message saying the plugin version was outdated and asking to install an update to continue. Clicking the link downloaded a ZIP archive.
The best protection against this threat is to avoid unofficial installers and cracked software.
Campaign 2 registers a scheduled task named SVCConfig with an ONLOGON trigger and HIGHEST privilege; CNB Bot creates HostDataProcess to run every 10 minutes.
operators retain full authority to run arbitrary commands or custom shellcode remotely
the original start script general.bat had been modified to run this file using PowerShell.
powercfg / x - hibernate - timeout - ac 0 ... powercfg / x - standby - timeout - dc 0
The malicious executable is a simple loader written in Python and packed into an executable application using PyInstaller. In some cases, the script has been additionally obfuscated using the PyArmor library.
SilentCryptoMiner uses direct syscalls instead of NTDLL functions and invokes NtCreateUserProcess, NtCreateSection, NtMapViewOfSection, NtSetContextThread, and NtResumeThread.
Beyond the C2 infrastructure, the threat actor abuses GitHub as a payload delivery CDN, hosting staged binaries across two identified accounts
a hidden function inside the file actively triggers a strategic stack overflow ... This overflow systematically builds a customized return-oriented programming chain to decrypt the primary payload
the developers recommend disabling security solutions, citing false positives... In one version, if the security solution on the victim’s device deleted the malicious file, the modified start script displayed the message “File not found, disable all antiviruses and re-download the file, that will help!”
The operation deploys RATs and cryptominers through fake installer packages; Campaign 1 uses an ISO containing a protected loader and a ReadMe.txt lure.
Campaign 2 registers a scheduled task named SVCConfig with an ONLOGON trigger and HIGHEST privilege; CNB Bot creates HostDataProcess to run every 10 minutes.
To prevent MSRT from being automatically installed during the next update, the DontOfferThroughWUAU parameter is created with a value of 1 under the HKLM\Software\Policies\Microsoft\MRT registry key.
The loader creates a service named DrvSvc and sets its description to that of the legitimate Windows Image Acquisition (WIA) service.
The watchdog is responsible for monitoring the loader file in its persistence folder: it rewrites the file to disk if it is deleted and reinstalls the persistence mechanism if the scheduled task or registry key is deleted.
If SilentCryptoMiner lacks administrator rights, it instead adds a Run key to the registry.
Campaign 2 registers a scheduled task named SVCConfig with an ONLOGON trigger and HIGHEST privilege; CNB Bot creates HostDataProcess to run every 10 minutes.
SilentCryptoMiner injects a watchdog into conhost.exe and a miner into explorer.exe, mapping a payload into a suspended target process and redirecting its entry point.
The encrypted data is then converted into a base64 string, which is passed as a command-line parameter to launch the miner inside the explorer.exe process through process hollowing.
"WinRing0x64.sys," a legitimate, signed, and vulnerable Windows kernel driver, is abused to obtain kernel-level hardware access and modify CPU settings to boost hash rates
SilentCryptoMiner creates a new suspended process with a spoofed parent process by passing an explorer.exe handle in a PS_ATTRIBUTE_LIST to NtCreateUserProcess.
The loader creates a service named DrvSvc and sets its description to that of the legitimate Windows Image Acquisition (WIA) service.
The watchdog is responsible for monitoring the loader file in its persistence folder: it rewrites the file to disk if it is deleted and reinstalls the persistence mechanism if the scheduled task or registry key is deleted.
If SilentCryptoMiner lacks administrator rights, it instead adds a Run key to the registry.
standard user runs will continuously trigger intrusive privilege prompts . This aggressive routine loops every three minutes until the victim yields control
In this scenario, the miner begins repeatedly triggering User Account Control (UAC) prompts until it is successfully executed with elevated privileges.
The loader also drops and loads WinRing0x64.sys, a legitimate open-source driver frequently abused by cryptominers. The driver provides direct Ring 0 (kernel-level) hardware access...
In some cases, the script has been additionally obfuscated using the PyArmor library.
The miner configuration is Base64-encoded and encrypted using the AES-CBC algorithm
They started distributing malware under the guise of restriction bypass programs and injecting malicious code into existing programs.
The loader creates a service named DrvSvc and sets its description to that of the legitimate Windows Image Acquisition (WIA) service.
Stage 2 drops a malicious svchost.exe; SilentCryptoMiner copies itself to Appdata/Local/OptimizeMS/optims.exe to masquerade as legitimate software.
SilentCryptoMiner injects a watchdog into conhost.exe and a miner into explorer.exe, mapping a payload into a suspended target process and redirecting its entry point.
The encrypted data is then converted into a base64 string, which is passed as a command-line parameter to launch the miner inside the explorer.exe process through process hollowing.
If you open one of these... the malware instantly kills the mining process. Your computer’s performance returns to normal, leaving you with nothing to find.
It kills Microsoft's Malicious Software Removal Tool (MSRT) by calling ZwSetInformationFile with the FileDispositionInformation type, which causes the mrt.exe file to be deleted upon closing.
Beyond the C2 infrastructure, the threat actor abuses GitHub as a payload delivery CDN, hosting staged binaries across two identified accounts
SilentCryptoMiner creates a new suspended process with a spoofed parent process by passing an explorer.exe handle in a PS_ATTRIBUTE_LIST to NtCreateUserProcess.
The encrypted next-stage module is stored as a .NET resource and decrypted via Triple DES (3DES) in CBC mode using an embedded key and IV. The decrypted output is a GZip-compressed PE.
For stealth, SilentCryptoMiner employs process hollowing to inject the miner code into a system process (in this case, dwm.exe).
Scanning the current environment for artifacts of running on a virtual machine or in a sandbox. The loader compares system data... with predefined lists of values used by virtual environments.
Only after receiving a specific approval signal from the server does the malware proceed, showing that attackers carefully filter targets to avoid tripping security test environments.
this shellcode reflectively loads the main module completely inside system memory
To prevent MSRT from being automatically installed during the next update, the DontOfferThroughWUAU parameter is created with a value of 1 under the HKLM\Software\Policies\Microsoft\MRT registry key.
Adding the AppData directory to Microsoft Defender exclusions.
On each tick, IsAnalysisToolRunning() compares all running process names against a hardcoded list of 35 security and monitoring tools (Taskmgr, ProcessHacker, Wireshark, Procmon, etc.).
the main module gathers basic processor metadata and disk serial numbers
Scanning the current environment for artifacts of running on a virtual machine or in a sandbox. The loader compares system data... with predefined lists of values used by virtual environments.
Only after receiving a specific approval signal from the server does the malware proceed, showing that attackers carefully filter targets to avoid tripping security test environments.
The custom XMRig loader compares running processes against 35 security and monitoring tools; SilentCryptoMiner also blocklists monitoring, AV, and reverse-engineering processes.
The command-and-control addresses used to receive these commands follow this format: http://{domain}.space/index.php?authorization=1
CNB Bot communicates with C2 by HTTP POST requests; PureRAT uses configured web C2 servers to receive encrypted Protobuf command messages.
It then transmits this hardware information by utilizing advanced DNS tunneling techniques
SilentCryptoMiner Mining proxy/fallback 172.94.15[.]211:5443
The loader retrieves the URL of the next-stage payload from a hardcoded path on one of two domains... After the download, it saves the payload named t.py in a temporary directory and runs it.
It can be controlled remotely via a web panel.
This agent utilizes dynamically generated domains to receive administrative instructions
the group hosts malicious files on trusted platforms like GitHub and uses high-level RSA-2048 encryption to control their bots.
The operation deploys cryptominers; the XMRig loader launches a renamed XMRig payload and SilentCryptoMiner injects Monero or Ethereum miners into processes.
55 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.