Malware

匿铲

Tracked since Aug 14, 2026 · Updated 3 months ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

Vulns0Associated

Actors0Associated

ATT&CK15Techniques

IOCs23Tracked

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

3 techniques

T1053.005Scheduled TaskEvidence1

创建多个计划任务,分别执行后续下载到的载荷。计划任务名分别为“OneDriveCloudSync”、“DefaultBrowserUpdate”、“OneDriveCloudBackup”

T1059.001PowerShellEvidence1

使用 PowerShell 脚本命令；“get.png”的PowerShell脚本…执行哈希验证、创建计划任务、禁用系统自带杀毒软件和创建服务等操作。

T1574.001DLLEvidence1

第二个技术是利用MSDTC服务加载后门DLL,实现自启动后门,达到持久化的目的。…攻击者会下载后门DLL重命名为oci.dll并放在指定目录下…该服务会加载oci.dll后门

Persistence

2 techniques

T1053.005Scheduled TaskEvidence1

创建多个计划任务,分别执行后续下载到的载荷。计划任务名分别为“OneDriveCloudSync”、“DefaultBrowserUpdate”、“OneDriveCloudBackup”

T1543.003Windows ServiceEvidence1

通过PowerShell脚本中的命令创建MSDTC服务…从指定的URL下载文件并保存到C:\Windows\System32\drivers,创建并启动名为aswArPots和IObitUnlockers的服务。

Privilege Escalation

3 techniques

T1053.005Scheduled TaskEvidence1

创建多个计划任务,分别执行后续下载到的载荷。计划任务名分别为“OneDriveCloudSync”、“DefaultBrowserUpdate”、“OneDriveCloudBackup”

T1055Process InjectionEvidence1

脚本解码出shellcode代码,shellcode代码经过解密得到控制器(一个可执行文件)并注入到powershell.exe进程中

T1543.003Windows ServiceEvidence1

通过PowerShell脚本中的命令创建MSDTC服务…从指定的URL下载文件并保存到C:\Windows\System32\drivers,创建并启动名为aswArPots和IObitUnlockers的服务。

Stealth

4 techniques

T1055Process InjectionEvidence1

脚本解码出shellcode代码,shellcode代码经过解密得到控制器(一个可执行文件)并注入到powershell.exe进程中

T1070Indicator RemovalEvidence1

清理C:\Windows\Installer目录中的空间…如果找到了最大的文件,将其删除,以便释放空间。…禁用Windows Defender的实时监控,关闭rpc服务,清理系统的垃圾文件和日志等。

T1140Deobfuscate/Decode Files or InformationEvidence1

该脚本实际为压缩和BASE64编码后的PowerShell脚本,该脚本会解密多层载荷

T1574.001DLLEvidence1

Defense Impairment

1 technique

T1685Disable or Modify ToolsEvidence1

第一个技术是滥用反病毒软件的旧版本内核驱动程序中的功能来结束反病毒软件和EDR…目前仍能被非法利用并有效结束大多数反病毒软件。

Discovery

3 techniques

T1082System Information DiscoveryEvidence1

还会根据受害主机自身系统型号下载对应的“86/64.png”的压缩文件

T1083File and Directory DiscoveryEvidence1

发现文件和目录查找指定目录最大文件；搜索C:驱动器根目录和除了一些系统目录之外的所有子目录中具有特定扩展名…的最大文件。

T1124System Time DiscoveryEvidence1

表5-1 事件对应的ATT&CK技术行为描述表…发现系统时间获取系统时间

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence1

不断地向服务器发送心跳信号,接收命令,执行这些命令,并将命令的输出结果发送回服务器。

T1105Ingress Tool TransferEvidence1

“匿铲”挖矿木马首先会从放马服务器上下载名为“get.png”的PowerShell脚本…之后会下载“kill.png”脚本和“delete.png”、“kill(1).png”…最后“get.png”脚本会下载“smartsscreen.exe”程序

T1132Data EncodingEvidence1

该脚本用于将日期时间、受害者主机名进行2次BASE编码并回传至攻击者服务器…不断地向服务器发送心跳信号,接收命令

Impact

1 technique

T1496Resource HijackingEvidence1

影响资源劫持占用 CPU 资源

Indicators of compromise

Observables

23 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.

View all in app →

Indicator values are available in Mallory. Pivot on every hash, domain, URL, and IP, or pipe them straight into your SIEM.View all in Mallory

Activity feed

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

antiyNews · Jan 1, 2026“匿铲”挖矿木马活动分析A named cryptomining malware active since November 2023 that uses PowerShell-based staging, shellcode injection, abuse of old antivirus kernel drivers to terminate AV/EDR, MSDTC-based DLL hijacking persistence via oci.dll, and downloads XMRig components for mining.Read more ↗

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start Free Trial Open in App ↗

IOC matching23Match every observed IP, domain, and hash against your live telemetry.

Associated threat actorsGroups linked to this family, with evidence pinned to each claim.

Associated vulnerabilitiesCVEs linked to this family, with the reporting behind each link.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15Every documented technique, ranked by evidence weight.

Researcher chatterReddit, Mastodon, and CTI community discussion around this family.

匿铲

Tracked since Aug 14, 2026 · Updated 3 months ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

Vulns0Associated

Actors0Associated

ATT&CK15Techniques

IOCs23Tracked

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure