Skip to main content

xmrig

Malware Family

297 indicators of compromise attributed to xmrig across abuse.ch threat intelligence feeds.

Domains

23

IPs

198

URLs

56

Hashes

20

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Domains (23)IPs (198)URLs (56)Hashes (20)

Need continuous updates instead of static lists? The same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CpayloadPayload Delivery

Associated CVEs (1)

CVE-2026-60004

Sample indicators

IndicatorType
selfupdate.netdomain
mine.cdnsrv.indomain
abcdefghijklmnopqrst.netdomain
example-probe-does-not-exist-12345.invaliddomain
0x1x2x3.topdomain
cyberknull.comdomain
download.pooping.picsdomain
download.poop-tree.christmasdomain
download.poop-diaper.buzzdomain
download.sf8edhuhy8e21juiz8dujh.loldomain
download.dancefloor.topdomain
fix.unknower.windomain
kworker.eth.limodomain
kworker.eth.linkdomain
download.stopbanningmydomains.rudomain
endpoint.project0.ccdomain
updates.officehub.worksdomain
download.skibidibopbop.loldomain
download.businessventure.cvdomain
download.vercel.qpondomain
165.154.227.8ip
8.137.157.150ip
94.183.182.171ip
207.180.232.121ip
77.90.185.248ip
2.26.99.68ip
193.160.100.154ip
34.70.205.211ip
197.140.9.148ip
172.104.63.215ip
120.77.79.42ip
95.85.237.226ip
91.208.184.203ip
45.78.201.248ip
143.198.92.217ip
188.166.154.126ip
45.17.39.120ip
47.253.156.31ip
206.42.5.12ip
65.49.1.222ip
http://200.4.115.1/promocioni3.phpurl
http://111.235.143.155:8080/Video.scrurl
http://80.74.30.4:3000/sparky/comfyui-utils.giturl
http://92.246.139.83/3url
https://s.littleshabby.net/payloads/indexi.pngurl
http://176.65.148.250:6556/okurl
http://puschl.langhaar-schaeferhunde.com/plugins/linux.binurl
http://168.121.168.84/Photo.scrurl
http://186.235.86.129/Photo.scrurl
http://187.247.242.34/av.scrurl
https://paste.mangsud.org/raw/ea2e61ccurl
https://tweakz-dream-launcher.lovable.app/__l5e/assets-v1/f9eec8e0-95ce-4178-b709-6136c6e6321b/V4MP-Tweakz-Launcher.exeurl
http://103.249.201.108:81/private/rigel-win.zipurl
http://106.254.250.98:9104/docs/x.rarurl
http://0x1x2x3.top/url
http://78.40.117.175:8000/xmrigurl
http://92.246.139.83/2url
http://45.153.34.212:8181/muiecoaieaarchurl
http://195.181.245.252:9443/xmrigurl
https://cdn.boyzee.xyz/086ad118cef06dd1ebe63c7b/xmrig_linux_amd64url

Another file to check? Run a file hash reputation check.