{
  "family": "coinstealer",
  "sample_count": 52,
  "category": "trojan",
  "description": "Trojan:Win32/Coinstealer is a broad heuristic classification applied to highly specialized infostealer trojans that are engineered explicitly to search for, compromise, and exfiltrate cryptocurrency wallet data (such as Bitcoin, Ethereum, or Monero wallets) from infected endpoints.<br><br><b>Understanding Coinstealers</b><br>To the end-user, a Coinstealer infection is entirely invisible until they attempt to access their cryptocurrency wallet and find it emptied. For security analysts, this represents a highly lucrative, specialized cybercriminal ecosystem. Unlike traditional banking trojans that rely on intercepting active web sessions (Man-in-the-Browser), Coinstealers primarily target the raw wallet files (`wallet.dat`), seed phrases, or private keys stored locally on the hard drive or copied to the system clipboard.<br><br><b>Execution and Evasion Strategies</b><br>Coinstealers are typically distributed via spearphishing, malicious links on cryptocurrency forums, or bundled with pirated software. Upon execution, the trojan establishes persistence (often via Registry Run keys). It rapidly scans the hard drive for specific file extensions or directory paths associated with popular wallet software (e.g., `%AppData%\\Bitcoin\\wallet.dat`). It also parses browser extension data (like MetaMask) to steal encrypted vaults (`T1555.003`). Many variants actively monitor the system clipboard (`T1115`); if the user copies a long, alphanumeric string that matches the regex of a crypto wallet address, the malware dynamically replaces it in the clipboard with the attacker's wallet address, hijacking the transaction before it is sent.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is immediate, irreversible financial loss. Incident responders will observe anomalous 'File Read' activity targeting specific cryptocurrency application directories. Network logs will reveal HTTPS POST requests exfiltrating small, highly structured files (`wallet.dat`) to the attacker's C2 server. EDR platforms may flag the malware's continuous polling of the clipboard API (`GetClipboardData`).",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1547.001",
    "T1115",
    "T1005",
    "T1048",
    "T1555"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1555",
      "name": "Credentials from Password Stores",
      "tactic": "Credential Access"
    },
    {
      "id": "T1115",
      "name": "Clipboard Data",
      "tactic": "Collection"
    },
    {
      "id": "T1005",
      "name": "Data from Local System",
      "tactic": "Collection"
    },
    {
      "id": "T1048",
      "name": "Exfiltration Over Alternative Protocol",
      "tactic": "Exfiltration"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network to halt the exfiltration of the `wallet.dat` files or seed phrases.",
    "If the user has not yet entered their master password to unlock a stolen (but encrypted) wallet, advise them to immediately move funds using a different, clean device.",
    "Capture a forensic memory image to identify the specific C2 server the stolen wallets were sent to.",
    "Assume all locally saved passwords and seed phrases have been compromised; a complete OS rebuild is necessary to ensure clipboard hijackers are removed."
  ],
  "what_to_avoid": [
    "Do not allow the user to perform any cryptocurrency transactions on the infected machine, as the clipboard hijacker will steal the funds.",
    "Avoid assuming the threat is contained just by running a basic AV scan; the exfiltrated wallet data must be considered compromised."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}