Cryptojacking, the unauthorized use of a victim’s computing resources to mine cryptocurrency, has transitioned from a browser-based nuisance (typified by Coinhive scripts) to a system-level threat utilizing advanced malware techniques.
The infection chain starts with a familiar lure: cracked “premium” productivity suites distributed via pirated software bundles, where the user executes what appears to be a legitimate installer.
Hidden inside is a dropper that deploys a controller binary named Explorer.exe (MD5: bb97dfc3e5fb8109bd154c2b2b2959da), which becomes the brain of the operation, orchestrating installation, persistence, mining, and cleanup.
Explorer.exe behaves as a state machine whose behavior is entirely driven by command-line parameters, allowing one binary to act as an installer, watchdog, payload manager, and kill-switch executor.
The malware’s internal modes are exposed through anime-inspired flags such as “002 Re:0” (active infection), “016” (maintenance), and “barusu” (cleanup), blending an unusual cultural fingerprint with practical state control logic.
According to the report, this campaign chains social engineering, worm-like propagation over removable media, and a Bring Your Own Vulnerable Driver (BYOVD) technique to maximize hashrate while making removal extremely difficult.
A built‑in time bomb checks the system date against a hardcoded deadline of 23 December 2025, after which the malware pivots into decommissioning behavior, indicating a campaign designed around a finite operational window rather than indefinite deployment.
Crypto-Mining Malware
Instead of pulling payloads from a C2, Explorer.exe carries its entire toolkit in its PE resource section, decrypting and decompressing an embedded archive into seven files including a fake “Microsoft Compatbility Telemetry.exe” miner wrapper, a kernel32 .dll XMRig DLL, ghost explorer .exe process killer, multiple “WPS” and Microsoft Edge watchdogs, and the vulnerable WinRing0x64.sys driver.
These files are dropped under user-profile paths, masquerading as familiar applications and marked with hidden/system attributes to evade casual inspection.
Once installed, Explorer.exe enters a tight orchestration loop that constantly checks for the miner process and randomly launches “keeper” binaries (edge.exe, wps.exe, ksomisc.exe) that in turn call back into Explorer.exe with maintenance arguments, creating a circular watchdog topology in which each component can resurrect the others if killed.
If repeated attempts to restart the miner fail likely due to AV interference the malware escalates by terminating the real Windows shell (C:Windowsexplorer.exe), effectively “blinding” the user and using the ensuing chaos as an opportunity to re-establish execution during shell restart.
A key differentiator of this campaign is its worm module, which listens for WM_DEVICECHANGE notifications and DBT_DEVICEARRIVAL events to detect newly attached removable drives.
The loop uses GetTickCount64 (which retrieves the number of milliseconds since the system started) to seed a custom random number generator.
When a USB drive or external disk is inserted, the malware copies its explorer.exe payload, creates a hidden folder, and abuses shortcut .lnk files whose icons are manipulated via registry edits to hide the shortcut arrow to trick users into executing the malware on new hosts, including air‑gapped systems accessed via shared removable media.
To squeeze maximum revenue from each compromised CPU, the attackers bring their own vulnerable driver: WinRing0x64.sys version 1.2.0, affected by CVE‑2020‑14979.
This driver exposes a device object with overly permissive access controls, enabling unprivileged processes to issue IOCTLs that read and write arbitrary memory and control low-level processor registers.
The miner component installs and starts this driver as a kernel service, opens a handle, and then issues IOCTLs (including a write‑MSR primitive) to modify model‑specific registers that control hardware prefetchers.
By turning off specific L2 prefetch mechanisms, the malware optimizes the CPU cache behavior for the RandomX algorithm used by Monero, boosting hashrate by an estimated double‑digit percentage without changing visible user‑mode behavior.
“Silent overclock” of the memory hierarchy is a prime example of how BYOVD attacks convert legacy signed drivers into performance enhancers for illicit mining while sidestepping traditional user‑mode defenses.
Monetization and Operational Outlook
On the backend, all compromised nodes are funneled into the Kryptex mining pool at xmr-sg.kryptex.network:8029, a consumer‑oriented pool often favored by lower‑tier actors for its fiat and Bitcoin payout options.
The handshake happens via ShellExecuteExW and passing a list of target process names as command-line arguments.
Hardened device‑control policies for USB media, driver‑block rules for known vulnerable modules like WinRing0x64.sys, and strict monitoring for masqueraded telemetry and office processes are essential to disrupt similar operations before they transform fleets of endpoints into silent, air‑gapped‑aware mining rigs.
At the time of analysis, telemetry showed a single active worker averaging around 1.24 KH/s with a noticeable uptick in activity from 8 December 2025, suggesting that operators are still refining their tooling and deployment pipeline before a full‑scale release.
For defenders, this campaign underscores that cryptojacking is no longer just “noisy CPU usage” but a full-spectrum intrusion vector combining social engineering, removable‑media worming, deeply layered persistence, UI spoofing, and kernel‑level optimization via vulnerable drivers.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
