Also known as: A cryptocurrency miner
Category: Malware
Type: Cryptojacking
Platform: Windows
Variants: Trojan:Win32/CoinMiner
Damage potential: Data theft and exfiltration, installation of additional malware, system manipulation and control, hardware overheating, system performance issues.
Overview
The Coinminer malware is malicious software that infiltrates the victim’s computer and uses its hardware, such as the CPU, GPU, and RAM, to mine cryptocurrency. Coinminers often use stealth techniques, such as mining only during certain hours, to remain undetected.
Possible symptoms
Coinminer malware primarily targets cryptocurrency mining, so unexpected slowdowns in system performance or unusually high CPU/GPU usage could be signals that your system is infected. Other possible symptoms include:
- Unexplained slowdowns. One symptom that applies to all types of coinminers is a decrease in system performance as CPU, RAM, and GPU resources are required to mine cryptocurrencies.
- Increased system heat. Using hardware to mine cryptocurrencies will also increase the amount of heat the system generates and may result in overheating hardware.
- Elevated electricity bill. Mining cryptocurrency requires lots of resources and electricity, so if you suddenly need to pay much more for electricity, this may be a sign of a coinminer on your computer.
- Unusual network activity. Coinminer malware communicates with external servers to download additional components or upload mined cryptocurrency, leading to unexpected network traffic.
- Unexplained system crashes or freezes. The strain on system resources will often lead to your system crashing or freezing.
- Changes in browser behavior. Coinminer malware may install browser extensions or modify browser settings to redirect web traffic to cryptocurrency mining pools or malicious websites.
- Disabled security software. Sometimes, coinminer malware will disable your antivirus or other security software to increase the likelihood of avoiding detection.
Sources of the infection
Coinminer malware typically infiltrates a device via popular and established methods. Here are a few examples:
- Malicious websites. Compromised or spoofed websites are often used to spread all types of malware, including coinminers.
- Phishing. Coinminers can be spread via malicious links or attachments, whether distributed via email or personal messages on social media.
- Software vulnerabilities. Hackers may attack systems with unpatched vulnerabilities in software and operating systems to execute coinminers. Though, it happens much less often than phishing.
- Pirated software. One of the most common ways to spread cryptocurrency to miners is through pirated software and games because the victim already intends to go through some installation procedures.
Protection
Protecting against coinminer malware requires proper cyber hygiene. You should also remember that this type of malware, more so than any other, is seasonal. Attacks increase when cryptocurrency prices rise and decrease when they fall.
- Update your software. Don’t leave your devices exposed by postponing patch fixes and feature updates.
- Pay attention to your device. Usually, computers slow down slowly as their parts get older. So, any sudden changes to performance are a clear sign something needs to be investigated.
- Avoid pirated software. Always download software from verified and official sources.
You can also use NordVPN’s Threat Protection Pro. It’s a feature that scans URLs and files before you download them to make sure they’re not infected.
Coinminer malware removal
If you suspect that your device has been infected with the Coinminer malware, you should first isolate it from the internet and run a virus check. If your antivirus software can’t remove the virus, we recommend contacting an IT professional.
