Hackers Hide PowerShell Malware in Registry, PNG and WAV Files to Deploy XMRig Miner
Brief
Researchers have uncovered a multi-stage cryptomining campaign that uses PowerShell, Registry-stored payloads, DNS TXT records, PNG images, and WAV audio files to conceal malware and deploy an XMRig-based cryptocurrency miner on compromised Windows systems.
The activity was first identified after repeated alerts involving suspicious PowerShell execution. Initial analysis showed that the malware launched PowerShell with -NoProfile and execution-policy bypass settings before retrieving a malicious script from the Windows Registry.
PowerShell Malware in Registry
The command accessed a value under HKLM:\Software\uf42a9660377\vstdfehzr , allowing the attacker to avoid placing the next-stage PowerShell payload directly on disk.
The Registry value contained encoded binary data that was decoded dynamically at runtime.