Armorsteal can stop its cryptocurrency miner when monitoring tools open, creating a misleadingly quiet Windows desktop. Seqrite’s November 6 analysis describes a broader toolkit combining mining, remote access and data theft.
The researchers recovered PyArmor-protected Python scripts from an infected machine. Scheduled tasks named SysCheck2, SysCheckX and SysHeal pointed to C:\Windows\SystemHealth\Update. A bundled Python runtime removed the need for Python to be installed beforehand.
For defenders, the useful question is what remains after the visible symptom disappears. A process snapshot taken while Task Manager is open cannot establish the absence of software designed to react to that tool. Cleanup needs to account for the launch mechanism and the settings changed around the payload.
Seqrite found the miner manager repeatedly checking Defender exclusions and restoring a broad C:\Windows path exclusion and an xmrig.exe process exclusion. Its findings also cover keylogging, wallet-file collection and password-manager vault harvesting. These are collection capabilities; the report does not establish that every collected vault was unlocked.
The malware family predates this research. Zscaler’s October 22 report traced a September campaign to search results promoting fake Chocolatey and Microsoft Activation Scripts pages. Those pages supplied malicious PowerShell installation commands; the Chocolatey lure also ran the legitimate installer, making the requested software appear to work.
Seqrite did not observe initial infection on its examined machine and could not obtain the miner archive. The current mined currency remains unconfirmed.
Check the protection settings left behind
Microsoft’s Defender documentation explains why exclusion review belongs in recovery: exclusions cause antivirus scans to skip matching content and can affect protection features that depend on the antivirus engine. They do not disable every Defender for Endpoint capability. Microsoft recommends periodically auditing exclusions and retaining the reason each one is needed; predefined Windows Server exclusions are separate from custom entries.
A practical investigation should connect each suspicious task to its executable path, parent process and network activity, then compare custom exclusions with the organization’s approved configuration. Preserve that evidence before removing persistence. A broad exclusion returning after removal is a reason to look for the component restoring it, rather than treating the settings change as an isolated configuration problem.
Image: AI-generated editorial illustration created for DaySec.
