{
  "family": "xmrig",
  "sample_count": 248,
  "category": "cryptominer",
  "description": "XMRig is a legitimate, open-source application that uses a system's CPU to mine the Monero cryptocurrency. Because it is freely available, criminals abuse it by installing it on victims' machines without consent to mine cryptocurrency for their own profit, a form of cryptojacking. It often runs silently in the background, consuming heavy system resources and slowing down the computer. According to PCrisk, XMRig is frequently delivered through \"bundling,\" a deceptive distribution method in which unwanted software is installed alongside other downloads, often together with adware-type applications that show intrusive ads and collect data. XMRig is documented by Fraunhofer FKIE's Malpedia.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is XMRig?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "XMRig is a legitimate, open-source program that uses a computer's CPU to mine the Monero cryptocurrency. It becomes a security concern when criminals install it on systems without the owner's consent."
      }
    },
    {
      "@type": "Question",
      "name": "Why is XMRig considered malicious in some cases?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Although XMRig itself is legitimate, attackers deploy it on victims' machines without permission to mine cryptocurrency for their own profit. Using someone's computer to mine without consent is known as cryptojacking."
      }
    },
    {
      "@type": "Question",
      "name": "How does unwanted XMRig get installed?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "According to PCrisk, XMRig is often spread through \"bundling,\" where it is installed alongside other downloads. It frequently arrives together with adware-type applications that display intrusive ads and gather information."
      }
    },
    {
      "@type": "Question",
      "name": "What are the symptoms of an XMRig infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Victims typically experience severe performance degradation, high CPU usage, loud cooling fans, and general system sluggishness due to the intense computational demands of cryptocurrency mining."
      }
    },
    {
      "@type": "Question",
      "name": "What sources document XMRig?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "XMRig is profiled in Fraunhofer FKIE's Malpedia, and its abuse via bundling has been described in vendor analyses such as those referenced by PCrisk."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [],
  "cisa_advisory": null,
  "last_updated": "2026-06-11",
  "sources": [
    {
      "name": "Malpedia (Fraunhofer FKIE): XMRig",
      "url": "https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig"
    },
    {
      "name": "PCrisk: XMRig cryptominer analysis",
      "url": "https://www.pcrisk.com/removal-guides/13262-xmrig-virus"
    }
  ],
  "target_industries": [
    "Cloud Infrastructure",
    "Consumers"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}