Pirated Content Sites Distribute SilentCryptoMiner Fork and RAT
Summary
Researchers detail a campaign active since at least 2022 that uses fake player updates on pirated streaming and library sites to install a SilentCryptoMiner fork and RAT, with DNS-based system checks, persistence, defense evasion and rotating C2.
Key points
- Fake video-player update prompts on pirated streaming and digital library sites deliver a ZIP containing a legitimate executable and a malicious DLL that uses DLL side-loading.
- The DLL uses a stack overflow and ROP chain to decrypt and load a main module identified as a modified SilentCryptoMiner fork.
- The malware collects processor and drive information and sends it in a DNS-tunneled query; execution continues only after a response containing a specific byte sequence.
- With elevated privileges, it adds Windows Defender exclusions, removes MSRT, disables sleep and hibernation, and installs an automatic-start service.
- A Watchdog component checks the service every five seconds and can restore miner files; the malware also uses process injection and process hollowing.
- The RAT supports commands to run arbitrary commands, execute a PE file or shellcode, or exit. Its C2 domains rotate based on the date, and server responses are encrypted and signature-verified.
- Researchers observed the campaign distributing malware through sites whose combined traffic reached 40 million visits in April 2026; this is site traffic, not a count of infections.
Article Details
- Attack Vectors
- Pirated movie and TV streaming sites and digital libraries displayed a fake video-player plugin update that led users to download a ZIP archive.
- The archive bundled a legitimate executable with a malicious DLL, which used DLL side-loading to execute its code.
- The malware used DNS tunneling to transmit system information and contacted date-rotating C2 domains for RAT commands.
- The miner attempted to obtain elevated privileges through repeated UAC prompts; with elevated privileges, it added security-tool exclusions and established persistence.
- Defensive Notes
- Avoid downloading updates offered by pirated streaming or digital-library sites; the reported infection chain used a fake plugin-update prompt.
- The malware reportedly adds Windows Defender exclusions, disables MSRT, and persists through a service or a registry Run entry; review these areas during investigation.
- The Watchdog component restores miner files if tampering is detected. The article says it must be terminated before remediation of the miner.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | 5d14vnfb[.]space | Date-rotating RAT C2 domain registered for April–July 2025. |
| DOMAIN | file[.]ipfs[.]us[.]69[.]mu | Domain previously used to deliver parts of the malicious archive. |
| DOMAIN | jeaw520i[.]space | Date-rotating RAT C2 domain registered for January–March 2026. |
| DOMAIN | kristina[.]quest | Address listed by the article as an UnamWebPanel control-panel address. |
| DOMAIN | m4yuri[.]online | Address listed by the article as an UnamWebPanel control-panel address. |
| DOMAIN | qdmagva5[.]space | Date-rotating RAT C2 domain registered for April–July 2026. |
| DOMAIN | r7mvjl67[.]space | Date-rotating RAT C2 domain registered for August–November 2025. |
| DOMAIN | urush1bar4[.]online | Website used to distribute the malicious archive. |
| DOMAIN | zgj1tam9[.]space | Date-rotating RAT C2 domain registered for December 2025. |
| IPV4 | 107[.]172[.]212[.]235 | IP address used by the miner’s configuration-retrieval infrastructure; the article says the generated mining domains point to it. |
MITRE ATT&CK
T1001.003 · Protocol or Service ImpersonationThe malware crafted DNS traffic to resemble legitimate traffic and used a microsoft.com-like domain name.T1055 · Process InjectionThe RAT, Watchdog, and miner components were injected directly into host-process memory without being written to disk.T1055.012 · Process HollowingThe miner was launched inside explorer.exe through process hollowing.T1071.004 · DNSThe malware sent collected system information in a DNS query using DNS tunneling.T1082 · System Information DiscoveryThe malware collected processor information and the system drive serial number from infected devices.T1105 · Ingress Tool TransferA link on the fake update prompt downloaded the ZIP archive containing the executable and malicious DLL.T1112 · Modify RegistryThe malware created registry values to prevent MSRT from being offered and to establish persistence.T1140 · Deobfuscate/Decode Files or InformationThe DLL used a ROP chain to decrypt the next stage before transferring execution to it.T1496 · Resource HijackingThe campaign deployed CPU and, on systems with a discrete GPU, GPU miners to mine cryptocurrency on infected devices.T1543.003 · Windows ServiceThe malware registered the GoogleUpdateTaskMachineQC service and configured it to launch automatically.T1547.001 · Registry Run Keys / Startup FolderThe malware added a registry Run entry for persistence when executing from the Sandboxie folder.T1562.001 · Disable or Modify ToolsWith elevated privileges, the malware added Windows Defender exclusions and disabled MSRT.T1573.001 · Symmetric CryptographyThe RAT’s request and response data was encrypted using AES-CBC.T1574.002 · DLL Side-LoadingA malicious DLL was loaded alongside the bundled legitimate executable to run attacker code.