Nicehashminer

Overview

PUA:Win32/Nicehashminer is a legitimate, widely used cryptocurrency mining application that allows users to rent out their computing power. However, it is heavily flagged as a Potentially Unwanted Application (PUA) or 'CoinMiner' by enterprise antivirus engines because threat actors frequently bundle it silently with malware or deploy it en masse across compromised corporate networks (Cryptojacking) to illegally hijack CPU/GPU resources (`T1496`).

Understanding Nicehashminer (Cryptojacking Vector)
To an end-user intentionally running it, it's a way to earn crypto. To a corporate IT department, its unauthorized presence represents a massive theft of electricity, severe degradation of workstation performance, and a clear indication that perimeter defenses or endpoint controls have failed, allowing an attacker to execute arbitrary binaries.

Execution and Resource Hijacking Mechanics
When deployed maliciously, attackers use droppers or exploit tools (like PsExec) to silently install the Nicehashminer client on victim machines. They configure the application (`.json` or `.ini` files) to mine cryptocurrency to the attacker's wallet address rather than the victim's. They often use scheduled tasks or registry run keys to ensure the miner starts automatically (`T1547.001`), and may use simple scripts to hide the mining window from the user's desktop.

Indicators of Compromise & Impact
The impact is extreme resource exhaustion and increased operational costs. Host-based IoCs are highly visible: CPU or GPU utilization will pin at 90-100%, causing the system fans to run loudly and the machine to become sluggish. You will find the `nicehashminer.exe` process (or renamed variants) running, often from unusual directories like `%Temp%` or `C:\Windows\Temp`. Network IoCs include continuous outbound traffic over specific mining stratum protocols (e.g., port 3333, 4444) to known mining pools like `stratum.nicehash.com`.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_NICEHASHMINER {
    meta:
        description = "Detects Nicehashminer (advanced_threat)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "nicehashminer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Nicehashminer Activity
id: eae3ae19df15aa7960d2e3431e549767
status: experimental
description: Detects generic indicators of the nicehashminer malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*nicehashminer*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Terminate the rogue mining processes to immediately restore system performance.
2. Identify how the miner was installed; if a user intentionally installed it, enforce corporate acceptable use policies. If it was dropped by malware, initiate a full incident response.
3. Block known mining pool domains (e.g., *.nicehash.com) and stratum protocol ports at the corporate firewall.
4. Enforce strict Application Control (AppLocker) to prevent the execution of known mining binaries.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not dismiss cryptomining as a 'low severity' threat; if an attacker can deploy a miner, they can just as easily deploy ransomware.
2. Avoid relying solely on CPU monitoring, as advanced malicious deployments can throttle the miner when user activity is detected.

References & External Analysis

• Search "nicehashminer" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: advanced_threat)

Explore other malware families in the same category:

• Daum
• Spoofer
• Sogou
• Simpleregistrycleaner
• Podnuha

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/nicehashminer.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.