Loading malware…
GhostMiner is a fileless cryptocurrency-mining malware family active since at least 2018 that primarily targets Windows systems. It is notable for abusing Windows Management Instrumentation (WMI) for persistence, payload storage, execution, and antivirus evasion, allowing it to operate with minimal conventional on-disk artifacts. GhostMiner has been observed storing Base64-encoded PowerShell content in WMI objects, triggering execution through WMI event subscriptions, and using reflective loading techniques to run malicious components in memory. Its primary monetization objective is cryptomining, including Monero mining, by deploying a miner payload and consuming victim CPU resources.
Beyond mining, GhostMiner exhibits post-compromise maintenance and competitive exclusion behavior commonly seen in illicit mining operations. It can terminate processes and services associated with rival miners, remove competing scheduled tasks and services, interfere with network activity linked to other mining malware, and alter host resolution behavior to disrupt competing botnets. It also includes backdoor-style command handling through encoded communications and can execute returned commands via PowerShell, indicating limited remote operator control in support of mining operations.
GhostMiner has been associated with server-side exploitation and worm-like propagation in some campaigns. Reported activity includes probing random internet-facing systems and exploiting Oracle WebLogic Server vulnerability CVE-2017-10271, while earlier reporting also linked GhostMiner campaigns to exploitation of exposed MSSQL and phpMyAdmin environments. The malware has been described as fileless PowerShell-based malware and as part of broader cryptomining botnet activity. Targeting has centered on susceptible Windows hosts and vulnerable servers rather than a specific vertical, with emphasis on systems that can provide sustained compute resources for mining.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
20 distinct techniques documented for this family, organized by ATT&CK tactic.
An earlier documented sighting of GhostMiner was noted to have used multiple vulnerabilities in MSSQL, phpMyAdmin, and Oracle’s WebLogic to look for and attack susceptible servers.
GhostMiner ... weaponizes Windows management instrumentation (WMI) objects for its fileless persistence, payload mechanisms, and AV-evasion capabilities.
WMI_Killer function, which terminates running processes, and deletes scheduled tasks and services that are associated with cryptocurrency-mining malware families
GhostMiner uses WMI Event Subscriptions to install persistence in an infected machine as well as execute arbitrary code.
This insight has not escaped other actors, and as a result, in recent years Powershell has seen wide use in “Fileless” malware built on the same principle.
For its propagation phase, it acted akin to the old-school Morris Worm, probing random IP addresses and targeting them with an exploit for a certain 1-day vulnerability (in this case CVE-2017-10271, a vulnerability in Oracle’s WebLogic server).
WMI_Killer function, which terminates running processes, and deletes scheduled tasks and services that are associated with cryptocurrency-mining malware families
WMI_Killer function ... deletes scheduled tasks and services that are associated with cryptocurrency-mining malware families
GhostMiner uses WMI Event Subscriptions to install persistence in an infected machine as well as execute arbitrary code.
WMI_Killer function, which terminates running processes, and deletes scheduled tasks and services that are associated with cryptocurrency-mining malware families
WMI_Killer function ... deletes scheduled tasks and services that are associated with cryptocurrency-mining malware families
GhostMiner uses WMI Event Subscriptions to install persistence in an infected machine as well as execute arbitrary code.
It uses Base-64 to encode the send command and ROT-13 ... to decode the received command.
Another example of Powershell malware was GhostMiner, a fileless threat discovered by researchers at Minerva at 2018
The file will then be saved as C:\Windows\Temp\lsass.exe .
Post-exploitation, it used two separate evasion techniques, both released as open-source tools by legitimate penetration testers, to reflectively load a malicious DLL from an obfuscated payload
weaponizes Windows management instrumentation (WMI) objects for its fileless persistence, payload mechanisms, and AV-evasion capabilities.
NetSH Firewall Add AllowedProgram C:\Windows\Temp\lsass.exe “Windows Update”
For its propagation phase, it acted akin to the old-school Morris Worm, probing random IP addresses and targeting them with an exploit for a certain 1-day vulnerability
WMI_Scanner Terminates processes of known cryptominers in the process memory
it will continuously try to connect to the abovementioned IP addresses every 30 seconds using the “/Update/CC/CC.php” URI path.
to reflectively load a malicious DLL from an obfuscated payload
WMI_Killer also terminates running processes ... associated with cryptocurrency-mining malware families
the WMI_CheckHosts, is able to modify the host files of the infected machine and modifies entries that are related to malicious malware such as BULEHERO
8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.