Cybersecurity researchers have uncovered a stealthy malware campaign that uses a multi-layered infection chain to plant an XMRig cryptocurrency miner on Windows systems, while obscuring the operation through unconventional methods like hiding data inside images, audio files, and Registry entries.
The Infection Chain: How It All Unfolds
The attack initiates through a PowerShell script executed with execution-policy bypass. Instead of loading code from a standard file, it pulls an encoded second-stage payload directly from a value in the Windows Registry. The script disables its history logs and proceeds to perform DNS TXT record lookups. Those records—delivered in decimal form—reveal URLs pointing to a PNG file that contains more embedded instructions.
Once the script retrieves the PNG file, it treats what appear to be red pixels not as imagery but as carriers of encrypted instructions. A hidden PowerShell component awakens, reaches out to its command-and-control (C2) server, and downloads a ZIP archive. That archive contains two “.wav” files—Atsg.wav and Tmav.wav—that masquerade as audio but actually serve as vessel files for coded data.
From WAV Files to In-Memory Mining
The first WAV container, Atsg.wav, holds encoded PowerShell commands that activate persistence and disable security tools. It makes changes to execution policy, erases history, deactivates telemetry and security controls, and even hides its tracks by adding exceptions to Windows Defender. It also schedules tasks and creates WMI event subscriptions to ensure it survives reboots.
The second WAV file, Realtek HD Audio.wav (also Tmav.wav under certain conditions), conceals a .NET assembly. After skipping the standard 44-byte WAV header, the loader extracts and reconstructs code chunks, loading them directly into PowerShell’s memory. Once active, this hidden .NET binary deploys the XMRig miner over RandomX, using encrypted pool communications and a set number of CPU threads. For enhanced performance, it also installs a legitimate signed driver (WinRing0.sys).
Why It’s Hard to Detect & What to Look For
This campaign combines familiar layers of fileless execution, data container files, and Registry-based payloads. Using PNG and WAV files in this manner provides a cover that sidesteps both file-type filters and signatures of traditional malware. Hiding the final payload in memory further reduces chances of detection by antivirus or endpoint tools.
Key indicators of compromise include a specific Registry key (HKLM:\Software\uf42a9660377\vstdfehzr) holding encoded PowerShell, unexpected PowerShell scripts (vstdfehze.ps1), domains and URLs tied to C2 infrastructure (e.g. sslvalidcert[.]com, frames.png), and file artifacts like Atsg.wav, Tmav.wav, Realtek HD Audio.wav, plus the dropped driver WinRing0.sys. Hash values and filenames have also been identified for deeper forensic analysis.
How Defenders Should Respond
Investigators are urged to monitor PowerShell processes for bypassed execution policies, dynamic code from Registry values, and DNS TXT record lookups. Suspicious PNG or WAV files accessed by scripts should raise alarms. Also, unexpected scheduled tasks, WMI subscriptions, and modifications to Defender settings need close scrutiny.
Upon detection, affected systems ought to be isolated and logs preserved, particularly volatile memory. Full remediation demands removing not just the miner, but all associated persistence mechanisms, command-and-control channels, and any tampered security settings.
This malware campaign underscores an escalating trend: adversaries are mixing Registry-based payloads, steganography, data-hiding in audio/video formats, memory-resident execution, and kernel drivers to avoid being caught. Defensive tools and procedures must evolve accordingly. Teams should adopt behavioral detection, tighten PowerShell policies, and incorporate threat intelligence indicators like the ones identified here. What to watch for next: whether this technique spreads beyond XMRig cryptominers into broader malware families, and how detection vendors respond as attackers push stealth even further.
