Skip to main content

XMRIG

Malware Family

308 indicators of compromise attributed to XMRIG across abuse.ch threat intelligence feeds.

Domains

24

IPs

200

URLs

60

Hashes

24

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Domains (24)IPs (200)URLs (60)Hashes (24)

For continuous updates, the same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CpayloadPayload Delivery

Associated CVEs (2)

CVE-2026-60004CVE-2026-96656

Sample indicators

IndicatorType
selfupdate.netdomain
example-probe-does-not-exist-12345.invaliddomain
0x1x2x3.topdomain
cyberknull.comdomain
download.pooping.picsdomain
download.poop-tree.christmasdomain
download.turd-lovers.latdomain
download.poop-diaper.buzzdomain
download.sf8edhuhy8e21juiz8dujh.loldomain
kworker.eth.limodomain
kworker.eth.linkdomain
download.stopbanningmydomains.rudomain
endpoint.project0.ccdomain
coldtechreview.vipdomain
updates.officehub.worksdomain
s.littleshabby.netdomain
download.skibidibopbop.loldomain
download.businessventure.cvdomain
download.vercel.qpondomain
ota.proxystream.stdomain
104.28.154.251ip
145.239.85.111ip
31.57.63.78ip
94.183.182.171ip
186.209.77.237ip
213.209.159.66ip
164.90.236.107ip
2.26.99.68ip
193.41.68.194ip
185.244.213.94ip
107.175.89.136ip
39.34.134.209ip
43.156.71.219ip
46.151.182.191ip
179.43.139.80ip
195.20.239.136ip
169.150.198.74ip
159.203.64.55ip
8.146.237.26ip
138.199.15.156ip
http://186.235.86.129/Photo.scrurl
http://103.8.164.18/Video.scrurl
http://94.26.106.195:80url
http://217.60.194.116/dockerurl
http://200.4.115.1/promocioni3.phpurl
https://repositoryserver.dpdns.org/killersysurl
http://116.202.242.242:8002/FasAlz1785594302url
https://nomore.quest/questremoval.exeurl
http://45.153.34.212:8181/.rupemnasa/.config4.jsonurl
http://94.26.106.195:5555url
http://111.235.143.155:8080/Video.scrurl
http://80.74.30.4:3000/sparky/comfyui-utils.giturl
https://cta.edu.pe/wp-content/plugins/linux.binurl
https://tweakz-dream-launcher.lovable.app/__l5e/assets-v1/f9eec8e0-95ce-4178-b709-6136c6e6321b/V4MP-Tweakz-Launcher.exeurl
http://57.129.119.218:13333url
http://106.254.250.98:9104/docs/x.rarurl
http://0x1x2x3.top/url
http://165.245.138.247:81/private/xmrig-win.zipurl
https://kworker.eth.limo/kworker/apiurl
http://168.121.168.84/Photo.scrurl

Another file to check? Run a file hash reputation check.