https://blog.efespain.com/en/tags/xmrig/A honeypot in some corner of the network. Every infection, a story worth telling.HugoeneFeSpaineFeSpain2026 eFeSpainSat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-15/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-15/I built a cage, ran the miner and pulled from memory the configuration I couldn't decrypt back in chapter 6. I got excited… and walked away with two things I wasn't looking for: that this family was already documented top to bottom —somewhere it never occurred to me to look— and that the piece I thought I'd decrypted was for something else.https://blog.efespain.com/en/chapter-13/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-13/In chapter 10 I caught the miner, but not the thing that hands it out: that part I told on loan, using someone else's analysis. The honeypot holds a grudge, and brought me the whole thing — armoured three times over, with a blob that resisted everything I know how to do. Until I stopped trying to read it.https://blog.efespain.com/en/chapter-6/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-6/We unpack RedTail's miner and crack it open in Ghidra hunting for the pool and the wallet. What we find is more interesting than a number: the data is in there, embedded and encrypted — and nobody has published how to crack it.