PowerShell Malware Hid in the Registry and Pulled Its Miner Out of DNS Records a PNG and Four WAV Files

Sun, 20 Sep 2026 15:33:32 +0200

Your Windows PC mined Monero on 40 percent of your threads. A scan of the disk found nothing to delete. The code sat in the registry. The rest arrived in DNS records, a PNG image and four WAV files.

The machine would not stop complaining about PowerShell. Clean it up, and the next day the alerts were back. The startup folder was empty. There was no download to point at and the fans kept running anyway.

Cryptomining on HackingPassion.com : root@HackingPassion.com-[~]

PowerShell Malware Hid in the Registry and Pulled Its Miner Out of DNS Records a PNG and Four WAV Files