TrendLabs: Ransomware XIAOBA Repurposed as File Infector and Cryptocurrency Miner

Figure 1. Infector code showing Coinhive injection; another variant even contains its own XMR configuration and miner binary

REF: https://blog.trendmicro.com/trendlabs-security-intelligence/ransomware-xiaoba-repurposed-as-file-infector-and-cryptocurrency-miner/