Mining-Themed Certificate Emerges as Prometei Files Go Quiet
The only new indicator in this case is a single IP tied to a Let's Encrypt certificate for the Monero-mining-themed domain corvusxmr.live, appearing just as the two Prometei-linked files that anchored the prior report drop out of the collection window. Weak verification and no cross-referenced infrastructure leave the finding provisional at best.
The freshest artefact in this collection window is not a payload — it is a single IP address, 31.56.209.100, sitting on AS 209373 and carrying a Let's Encrypt certificate whose subject line reads corvusxmr.live. That domain, and its companion mine.corvusxmr.live and www.corvusxmr.live, describe themselves in the certificate's own subject-alternative-name field as Monero-mining infrastructure.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read