Fake Installers Spread RATs, Monero Miners in Ongoing Malware Campaign

Fake software installers are being used in a long-running malware operation to drop remote access trojans (RATs), Monero cryptominers, and a new .NET implant across multiple campaigns dating back to late 2023.

REF1695 relies on ISO-based fake installers that mimic legitimate software setup packages but never deliver real applications.

Instead, users are guided via a ReadMe-style lure to bypass SmartScreen, run unsigned binaries, and unknowingly kick off a multi-stage infection chain.

Across campaigns, operators consistently use Themida/WinLicense, paired with .NET Reactor, to protect both loaders and payloads, slowing static analysis and signature-based detection.

Elastic Security Labs tracks the activity as REF1695 and links its various waves through shared packing techniques, overlapping command-and-control (C2) infrastructure, and near-identical social engineering lures.

The campaigns deliver a toolset that includes PureRAT, PureMiner, a custom . NET-based XMRig loader, SilentCryptoMiner, and a previously undocumented .NET implant dubbed CNB Bot.

These payloads give the actor remote access, persistent cryptomining, and flexible update capabilities while maintaining operational control through resilient C2 infrastructure.

Cryptomining and CPA Fraud

REF1695 monetizes compromised hosts in two main ways: background Monero mining and Cost Per Action (CPA) fraud via content lockers.

The loader first invokes PowerShell with -WindowStyle Hidden, to register broad Microsoft Defender exclusions via Add-MpPreference -ExclusionPath and Add-MpPreference -ExclusionProcess, covering the loader.

PureRAT and PureMiner are configured to fetch mining payloads and configurations from attacker-controlled domains and GitHub-based raw file links, using encrypted C2 protocols with derived AES and HMAC keys to protect tasking traffic.

Simultaneously, fake “registration” flows redirect victims to CPA content locker pages that require completing surveys or signups before supposedly releasing a license key, generating affiliate commissions for the operator.

This “low-and-slow” approach focuses on long-lived infections, maximizing revenue per host while avoiding noisy, high-impact behaviors that might trigger rapid cleanup.

CNB Bot, a new .NET implant documented in this operation, combines loader functionality with a C2 polling loop and strictly authenticated tasking.

Its tasks (download-execute, update, uninstall) are signed using RSA-2048, meaning that even if defenders hijack the panel, they cannot issue valid commands without the private key.

The custom XMRig loader takes evasion further by watching for approximately three dozen analysis and monitoring tools and immediately killing the miner process when they appear, dropping CPU usage back to normal.

It also deploys the WinRing0x64 driver to gain ring 0 access and tweak CPU behavior, increasing RandomX hash rates and improving Monero mining efficiency.

The decrypted output is a GZip-compressed PE: the first 4 bytes encode the decompressed size as a little-endian integer, followed by the GZip stream.

SilentCryptoMiner variants extend stealth with direct syscalls, sleep/hibernate disabling, process injection into explorer.exe and conhost.exe, and watchdog logic to restore persistence if removed.

Operational Scale and Infrastructure

REF1695 leans heavily on GitHub as a payload delivery CDN, hosting staged binaries under at least two profiles before deleting repositories to reduce forensic visibility.

Decrypted C2 tasks show PureRAT and related loaders instructed to fetch CNB Bot, custom XMRig loaders, PureMiner, AsyncRAT, Pulsar RAT, and SilentCryptoMiner directly from raw GitHub URLs.Each field value is independently AES-256-CBC encrypted with a random IV. 

By pivoting on wallet addresses embedded in the miner configs and querying public Monero pool dashboards, Elastic estimates that the actor has received more than 27.88 XMR across four wallets, with multiple active workers still online.

At recent Monero prices, that equates to roughly 9,400 USD, underscoring how quietly abused consumer and small business systems can generate steady income over extended periods.

To scale analysis across hundreds of heavily obfuscated .NET samples, the researchers used an agentic pipeline powered by a Claude model to automate unpacking and configuration extraction.

The pipeline orchestrated tools like Unlicense and NETReactorSlayer, recursively followed infection chains from VirusTotal pivots, and generated structured reports on payloads and configs, falling back to “research mode” to synthesize bespoke extraction scripts when generic methods failed.

For defenders, REF1695 highlights the need to block ISO-based lures, tighten execution policies around unsigned installers, monitor for aggressive Microsoft Defender exclusion abuse and WinRing0x64.sys deployment, and hunt for recurring infrastructure markers such as PureRAT/PureMiner C2 domains and CNB Bot’s HostData scheduled task artifacts.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.