Analysis of a Disguised-Service Cryptocurrency Miner (XMRig Variant)
To thoroughly analyze a cryptocurrency-mining trojan disguised as a system service, analysts drove AVL Code with a single natural-language instruction, closing the loop from malicious sample to a complete analysis report.
Built with AVL Code + the Landi model
Overview
Facing a 576KB, 64-bit Windows PE32+ program disguised as a system maintenance service — an XMRig-variant cryptocurrency miner — analysts drove AVL Code with one natural-language instruction to reverse-engineer it in depth: identifying its version-info masquerade as a Microsoft system module (InternalName: MaintenanceServices.dll), its scheduled-task (schtasks) registration/removal persistence, an embedded mongoose library providing HTTP/WebSocket communication, and process-injection-capable imports such as CreateRemoteThreadEx — producing, in about 14 minutes, an analysis report with a complete IOC list and remediation recommendations.
Key results
- Fully reverse-engineered the 576KB 64-bit Windows malware, identifying it as an XMRig-variant cryptocurrency miner disguised as a system maintenance service
- Reconstructed the service-masquerade and scheduled-task persistence mechanism — forged version info posing as a Microsoft system module, persisting via schtasks-registered/removed scheduled tasks
- Extracted a complete IOC list (3 file hashes, 4 disguised filenames, 1 C2 email address, 2 scheduled-task names, 1 registry path)
- Identified HTTP/WebSocket communication via an embedded mongoose library and process-injection-capable imports such as CreateRemoteThreadEx, generating remediation recommendations in about 14 minutes
Technical highlights
Practical value
Helps security operations teams rapidly identify and respond to cryptocurrency-mining trojan threats, provides end-to-end guidance from detection to remediation, strengthens detection and handling of disguised mining malware, and effectively protects enterprise computing resources from hijacking.
Artifacts
Session replays & reports are original records in Simplified Chinese · Built with AVL Code + the Landi model