Coinstealer

Overview

Trojan:Win32/Coinstealer is a broad heuristic classification applied to highly specialized infostealer trojans that are engineered explicitly to search for, compromise, and exfiltrate cryptocurrency wallet data (such as Bitcoin, Ethereum, or Monero wallets) from infected endpoints.

Understanding Coinstealers
To the end-user, a Coinstealer infection is entirely invisible until they attempt to access their cryptocurrency wallet and find it emptied. For security analysts, this represents a highly lucrative, specialized cybercriminal ecosystem. Unlike traditional banking trojans that rely on intercepting active web sessions (Man-in-the-Browser), Coinstealers primarily target the raw wallet files (`wallet.dat`), seed phrases, or private keys stored locally on the hard drive or copied to the system clipboard.

Execution and Evasion Strategies
Coinstealers are typically distributed via spearphishing, malicious links on cryptocurrency forums, or bundled with pirated software. Upon execution, the trojan establishes persistence (often via Registry Run keys). It rapidly scans the hard drive for specific file extensions or directory paths associated with popular wallet software (e.g., `%AppData%\Bitcoin\wallet.dat`). It also parses browser extension data (like MetaMask) to steal encrypted vaults (`T1555.003`). Many variants actively monitor the system clipboard (`T1115`); if the user copies a long, alphanumeric string that matches the regex of a crypto wallet address, the malware dynamically replaces it in the clipboard with the attacker's wallet address, hijacking the transaction before it is sent.

Indicators of Compromise & Impact
The impact is immediate, irreversible financial loss. Incident responders will observe anomalous 'File Read' activity targeting specific cryptocurrency application directories. Network logs will reveal HTTPS POST requests exfiltrating small, highly structured files (`wallet.dat`) to the attacker's C2 server. EDR platforms may flag the malware's continuous polling of the clipboard API (`GetClipboardData`).

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_COINSTEALER {
    meta:
        description = "Detects Coinstealer (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "coinstealer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Coinstealer Activity
id: 5f3041344bdfe250a23eeff3a399d5a1
status: experimental
description: Detects generic indicators of the coinstealer malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*coinstealer*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Instantly isolate the endpoint from the network to halt the exfiltration of the `wallet.dat` files or seed phrases.
2. If the user has not yet entered their master password to unlock a stolen (but encrypted) wallet, advise them to immediately move funds using a different, clean device.
3. Capture a forensic memory image to identify the specific C2 server the stolen wallets were sent to.
4. Assume all locally saved passwords and seed phrases have been compromised; a complete OS rebuild is necessary to ensure clipboard hijackers are removed.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not allow the user to perform any cryptocurrency transactions on the infected machine, as the clipboard hijacker will steal the funds.
2. Avoid assuming the threat is contained just by running a basic AV scan; the exfiltrated wallet data must be considered compromised.

References & External Analysis

• Search "coinstealer" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Optimizer
• Filerepmalware
• Hesv
• Monitoringtool
• Xxybuj

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/coinstealer.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.