Thursday, February 13, 2025
HomeComputer SecurityKingMiner Malware Targets Windows Servers and Uses 100% CPU To Mine Monero

KingMiner Malware Targets Windows Servers and Uses 100% CPU To Mine Monero

Published on

SIEM as a Service

Follow Us on Google News

KingMiner malware targets Windows server and utilizes entire CPU resources to mine Monero. The malware primarily targets Microsoft Servers using IIS\SQL.

The malware was first identified in June 2018, security researchers form Checkpoint detected new version of KingMiner with significant that bypass several detection engines.

KingMiner malware gains access to the machines by using brute force method to download Windows Scriptlet file (.sct) on the victim’s machine.

KingMiner malware

Then it will detect the CPU architecture of the infected machine and downloads the XML payload file based on the CPU architecture. The downloaded zip file includes five files.

config.json – XMRig CPU miner configuration file.
md5.txt – Text file containing only the string “zzz.”
powered.exe (called fix.exe in older versions) – The main executable file.
soundbox.dll/soundbox.dll – DLL files containing functions to be exported by powered.exe.
x.txt/y.png – Binary blob files. Note – This is not a real PNG file.

Researchers said the powered.exe is executed, then it creates XMRig miner and appends key on the registry, and executes functions from DLL files.

The function King1 decodes the binary blob file x.txt & y.png, which is the modified version of the XMRig CPU miner.

The XMRig CPU Miner designed to consume only 75% of the CPU resource but it consumes of 100%. The malware is evolving constantly and it has placeholders for future operations or upcoming updates which will make this malware even harder to detect.

Related Read

Powerful Mobile Malware Rotexy Launched over 70,000 Attacks with Banking Trojan & Ransomware Modules

$60 Million Worth Cryptocurrencies Stolen Hackers From Japanese Cryptocurrency Exchange

Bittrex Cryptocurrency Exchange Delist the Bitcoin Gold After They Declined to Pay 12,372 BTG for Cyber Attack

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Enhancing Threat Detection With Improved Metadata & MITRE ATT&CK tags

The cybersecurity landscape continues to evolve rapidly, demanding more sophisticated tools and methodologies to...

Hackers Exploit Ivanti Connect Secure Vulnerability to Inject SPAWNCHIMERA malware

In a concerning development, cybersecurity experts have identified active exploitation of a critical vulnerability...

ZeroLogon Ransomware Exploits Windows AD to Hijack Domain Controller Access

A newly intensified wave of ransomware attacks has surfaced, leveraging the infamous ZeroLogon vulnerability...

Cl0p Ransomware Hide Itself on Compromised Networks After Exfiltrate the Data

The Cl0p ransomware group, a prominent player in the cybercrime landscape since 2019, has...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

ZeroLogon Ransomware Exploits Windows AD to Hijack Domain Controller Access

A newly intensified wave of ransomware attacks has surfaced, leveraging the infamous ZeroLogon vulnerability...

Sandworm APT Hackers Weaponize Microsoft KMS Activation Tools To Compromise Windows

In a sophisticated cyber-espionage operation, the Russian state-sponsored hacking group Sandworm (APT44), linked to...

Preventing Attackers from Permanently Deleting Entra ID Accounts with Protected Actions

Microsoft Entra ID has introduced a robust mechanism called protected actions to mitigate the...