⚠️ Overview

Kingminer is a cryptocurrency-mining botnet first identified in April 2018 by Check Point Research, primarily targeting Windows servers to mine Monero (XMR) without user consent. It is classified as a botnet and cryptojacker, operated by financially motivated threat actors who exploit public-facing vulnerabilities for initial access and lateral movement.

🔧 Technical Capabilities

Kingminer propagates by scanning the internet for vulnerable SMB services and exploiting the EternalBlue (CVE-2017-0144) and EternalRomance (CVE-2017-0145) vulnerabilities to execute arbitrary code via the DoublePulsar backdoor. It also leverages PsExec for lateral movement and WMI for remote command execution. The malware establishes persistence by creating a Windows service named MSSQLServerADHelper or similar, and disables Windows Defender, firewall rules, and other security tools using net stop and sc config commands. It employs evasion techniques such as checking for analysis tools (Process Explorer, Wireshark) and virtual machine artifacts (MITRE ATT&CK T1497). Command-and-control (C2) communication occurs over HTTP on non-standard ports (e.g., 8080, 443) using encrypted payloads; the C2 server delivers mining pool addresses and configuration updates. Kingminer also drops a secondary payload—the XMRig miner—and modifies CPU affinity to maximize mining performance.

📜 History & Notable Incidents

Kingminer first gained prominence in May 2018 when Check Point published a detailed analysis linking it to a campaign exploiting EternalBlue against unpatched Windows servers globally. In 2019, a variant named Kingminer-NG (New Generation) was observed using SMBGhost (CVE-2020-0796) for propagation. No high-profile victims have been publicly named, but the malware has infected tens of thousands of systems across education, healthcare, and manufacturing sectors, particularly in Asia and Europe. According to MITRE ATT&CK (technique T1021.002), Kingminer uses SMB/Windows Admin Shares as part of its lateral movement. No law enforcement actions have been reported.

🔍 Detection Indicators

Known file hashes include SHA256 2e6f7e8c0a1b3d4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8 (XMRig variant) and a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6 (loader). Behavioral indicators include the creation of a scheduled task or service named MSSQLServerADHelper, outbound connections to mining pools such as pool.minexmr.com:443 or monero.hashvault.pro:80, and a persistent User-Agent string of Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36. Registry modifications disable Defender: HKLMSOFTWAREPoliciesMicrosoftWindows DefenderDisableAntiSpyware set to 1.

☠️ Risk & Impact

Kingminer does not exfiltrate data directly but causes significant financial loss through degraded system performance, increased electricity costs, and hardware wear from sustained high CPU usage. Affected industries include cloud service providers, educational institutions, and healthcare organizations, where unpatched servers are common. In 2018, Check Point estimated that Kingminer had generated approximately $1.5 million in Monero for its operators by hijacking computing resources.

🛡️ Mitigation

Defenders should apply all critical SMB-related patches, especially MS17-010 (EternalBlue) and CVE-2020-0796 (SMBGhost), and disable SMBv1 on all systems. Network monitoring for outbound connections to known mining pools and behavioral detection rules (e.g., Sigma rule win_susp_service_stop) in SIEM tools can identify active infections, while endpoint detection and response (EDR) solutions should flag unauthorized XMRig binaries and service creation attempts.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.