There is no single, specific malware family universally referred to as "coins." Instead, the term is frequently used by security vendors as a descriptor for entire categories of malicious software that focus on cryptocurrency. This most commonly refers to "Coinminers" (or cryptojackers) that hijack a victim's computer resources (CPU, RAM, or GPU) to mine cryptocurrencies like Monero without consent. It may also refer to Cryptocurrency Stealers, which are designed to locate and steal existing crypto assets by targeting wallet.dat files, hijacking clipboard contents to replace wallet addresses during transactions, or logging keystrokes to steal seed phrases.
These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.
rule MALWARE_WIN_COINS {
meta:
description = "Detects Coins (cryptominer)"
author = "SystemHelpdesk Boilerplate Generator"
date = "2026-07-06"
strings:
$s1 = "coins" ascii wide nocase
condition:
uint16(0) == 0x5a4d and any of them
}title: Suspicious Coins Activity
id: 68849520e7cb551715bb507436ec4605
status: experimental
description: Detects generic indicators of the coins malware family.
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
CommandLine|contains:
- "*coins*"
condition: selection
level: mediumIt is a generic category label used to describe malware that either steals existing cryptocurrency from wallets, or hijacks a computer's resources to mine new cryptocurrency for the attacker.
Cryptominers often run silently in the background, significantly slowing down the victim's system, causing high CPU/GPU temperatures, and increasing electricity consumption.
They may search your hard drive for wallet files, monitor your clipboard to swap out legitimate wallet addresses with the attacker's address when you copy/paste, or log your keystrokes to steal passwords.
Explore other malware families in the same category:
Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/coins.json
This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Replit, StackBlitz, CodeSandbox, and CodePen.