Loading malware…
LoudMiner is a cryptocurrency-mining malware family that abuses virtualization to run its mining payload inside a hidden Linux virtual machine on infected hosts. It is known for bundling virtualization components and launching a TinyCore Linux guest that executes XMRig, allowing the miner to operate somewhat isolated from the host operating system and complicating detection and analysis. LoudMiner has been observed on both Windows and macOS, and is commonly distributed through pirated Virtual Studio Technology (VST) software packages.
On Windows, LoudMiner has used an MSI-based installer to deploy virtualization software and supporting components, then configured the mining virtual machine to run as a service at startup. It has been observed using batch scripts and service-management tooling to launch the virtual machine automatically, including hidden directories and hidden file attributes to reduce user visibility. The malware also deletes installation artifacts after setup, indicating deliberate cleanup and defense-evasion behavior.
LoudMiner performs host profiling before or during execution. Observed behaviors include process discovery using native utilities and scripts to collect the infected machine’s IP address for transmission to command-and-control infrastructure. Its scripts have also been obfuscated. In one documented deployment, LoudMiner appeared as an additional monetization component bundled with a ServHelper intrusion chain associated with TA505, where the operators combined backdoor access with covert cryptomining on 64-bit Windows systems.
The malware’s defining characteristic is its use of a virtualized Linux environment to host the miner rather than running the mining engine directly on the host. This tradecraft distinguishes LoudMiner from more conventional cryptominers and reflects an emphasis on stealth, persistence, and operational resilience.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
19 distinct techniques documented for this family, organized by ATT&CK tactic.
As it proceeds, it will execute a PowerShell script file named upgrade.ps1 ... The executed PowerShell script will decrypt and invoke the main Installer of ServHelper.
Many entries mention .bat, .cmd, or batch scripting, such as APT1 using batch scripting to automate execution, APT41 using a batch file for persistence, and numerous malware families executing or downloading batch files.
"Anchor can create and execute services to load its payload"; "APT32's backdoor has used Windows services as a way to execute its malicious payload"; "Ragnar Locker has used sc.exe to execute a service that it creates"; "Shamoon creates a new service named 'ntssrv' to execute the payload"
The PowerShell command was encrypted with a combination of Base64 encoding and Triple DES Algorithm... Afterwards, it will prepare the payload to be dropped by decrypting it using Base64 decoding and GZip decompression.
Examples throughout the content include 'encrypted payloads decrypted and executed in memory,' 'encrypts its configuration file,' 'AES-encrypted resource,' 'RC4 encrypted embedded scripts,' and 'payload includes an encrypted main component.'
The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.
APT19 used Base64 to obfuscate executed commands; APT32 used Invoke-Obfuscation to obfuscate PowerShell; Aquatic Panda encoded PowerShell commands in Base64; numerous groups and malware used Base64, XOR, RC4, compression, encryption, variable substitution, and other methods to obfuscate scripts and commands.
Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi).
Upon execution, the loader will check if it is running on a virtualized environment... by checking for the presence of a file, C:\aaa_TouchMeNot_.txt ... If the file is present, installation will stop.
AdFind can extract subnet information from Active Directory; actors used ipconfig /all after exploiting a machine; numerous malware and groups used ipconfig, ifconfig, arp, route, netsh, nbtstat, NBTscan, and related APIs to gather IP, MAC, DNS, DHCP, gateway, proxy, domain, ARP cache, routing, and adapter details.
Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.
The content repeatedly describes malware and threat actors collecting host details such as hostname, OS version, architecture, CPU, memory, BIOS, language, and other machine characteristics; e.g., "Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host."
31 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
22 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
In June 2019, miscreants spread NetWire malware in a broad public attack, leveraging a zero-day vulnerability in Firefox. Mac malware on the rise again; several new threats found: Netwire, Mokes, LoudMiner, NewTab
Uses a script to gather infected machine IP addresses before C2 transmission.
A cross-platform cryptocurrency miner that abuses system resources for mining operations.
Software changes: ... LoudMiner
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.