| Description: | | The detected artifact corresponds to network traffic generated when a Monero-mining trojan on a compromised host establishes its first outbound connection to an external controller. The malware typically infiltrates via exploit kits, malicious e-mail attachments or cracked software, then exfiltrates local system data such as CPU count, process name and wallet address to prepare for the delivery and configuration of a mining payload. By silently enrolling large numbers of victims into anonymous mining pools, attackers steal computational resources in an untraceable way, causing severe performance degradation, inflated power costs and accelerated hardware wear. Because the trojan remains resident and often provides a backdoor, it can later be repurposed for lateral movement, data theft or ransomware deployment, creating a persistent, multi-stage threat. |