Stantinko

Overview

Stantinko (tracked across threat intelligence feeds as Trojan:Win32/Stantinko, Win32/CoinMiner.Stantinko, and Trojan.Win32.Stantinko) is a massive, highly resilient cybercriminal botnet documented extensively by ESET Research. Active since at least 2012, Stantinko has compromised over 500,000 endpoints primarily across Russia, Ukraine, Belarus, and Kazakhstan. The botnet employs sophisticated multi-stage infection chains, distributing its modular dropper disguised as pirated software or cracked torrents. Once on an endpoint, Stantinko establishes mutual self-healing Windows services (e.g., udservice.exe); if one service is terminated or deleted, the sibling service immediately restores it. Stantinko's operators deploy diverse monetization modules, including installing malicious extensions from the Chrome Web Store (such as 'The Safe Surfing' and 'Teddy Protection') to execute click fraud and ad-injection, conducting social network account takeover, launching brute-force attacks against WordPress and Joomla administrator consoles, and mining Monero using heavily obfuscated, per-victim compiled xmr-stak cryptominers that resolve mining proxy IPs covertly encoded into YouTube video descriptions.

Known aliases

Threat reports may refer to this family under multiple names:

• Trojan:Win32/Stantinko
• Win32/CoinMiner.Stantinko
• Win64/CoinMiner.Stantinko
• Trojan.Win32.Stantinko
• Stantinko Botnet

Family Pedigree & Lineage

Malware authors regularly fork and iterate upon existing codebases. Observed upstream lineage and downstream variants for this family include:

Derived From / Upstream Ancestry: Modular Botnet Architecture · Xmr-Stak Monero Cryptomining Framework

Known Derivatives & Downstream Variants: Coinminer.Stantinko · Teddy Protection Extension · Safe Surfing Extension

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1059.001: Restrict execution of PowerShell. Enforce PowerShell Constrained Language Mode and Script Block Logging.

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Indicators of Compromise

Public indicators drawn from CISA advisories and vendor reporting. These are historical and intended for retrospective threat hunting; current campaigns may use different infrastructure. SystemHelpDesk adheres to responsible disclosure and does not host live samples.

File hashes (SHA-256, sample)

Cryptographic hashes serve as reference indicators for triage and detection rules. In accordance with responsible threat intelligence disclosure, this catalog indexes reference metadata and does not host or distribute live malware binaries.

• 4ec29694a5275ff517cf367b67c250a2bb40cef7011832fd99b0b73370b5bd5b
• fe20bd81488508f296932ee4cdb8c86a66a70ffa73d9c55ae69c08556202f5d9
• df0d6bced58728899cfce1cd27db378c9e1118d52d1e2ae8d5b06a8349973579

Delivery vectors

• Pirated software and game torrents containing multi-stage Trojan droppers
• Deceptive software download portals masquerading as utility repositories

Persistence mechanisms

• Self-healing Windows services: udservice.exe, system updater services
• HKCU\Software\Policies\Google\Chrome\ExtensionInstallForcelist
• WMI event subscriptions executing obfuscated PowerShell payloads

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_STANTINKO_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Stantinko"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "stantinko" ascii wide nocase
        $s2 = "trojan:win32/stantinko" ascii wide nocase
        $s3 = "win32/coinminer.stantinko" ascii wide nocase
        $s4 = "win64/coinminer.stantinko" ascii wide nocase
        $s5 = "trojan.win32.stantinko" ascii wide nocase
        $s6 = "stantinko botnet" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Stantinko (Botnet) Execution & Triage
id: f9439851-ef8f-5d73-aff2-5e27be2d039f
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Stantinko malware family. Detects firewall rule subversion, internal port
  proxying, and command-and-control keepalive polling indicative of botnet nodes.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/stantinko
- https://malware-families-catalog.systemhelpdesk.com/defensive/botnet-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.botnet
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1204_002
- attack.t1546_003
- attack.t1496
- attack.t1176
- attack.t1102_001
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \netsh.exe
    - \route.exe
    - \arp.exe
    - \ping.exe
    CommandLine|contains:
    - advfirewall firewall add rule
    - netsh interface portproxy
    - ping -n 1 127.0.0.1
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: high

rule MALWARE_WIN_STANTINKO_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Stantinko tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "stantinko" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Isolate the infected endpoint from the corporate network immediately to disrupt botnet C2 communications and cryptomining activity.
2. Identify and simultaneously terminate both self-healing watchdog services (e.g., udservice.exe) to prevent automatic reinstallation.
3. Purge rogue browser extensions installed via local Chrome policy keys (HKCU\Software\Policies\Google\Chrome).
4. Due to Stantinko's deeply embedded rootkit components and encrypted registry payloads, re-imaging the operating system is strongly recommended.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not attempt to delete only one of the Stantinko Windows services, as the surviving watchdog will restore the removed service within seconds.
2. Avoid downloading pirated software, cracked games, or torrent installers that serve as the primary distribution channel for Stantinko droppers.

References & External Analysis

• ESET Research Whitepaper - Stantinko: Teddy Bear Surfing in a Cyber Stealth Minefield
• ESET WeLiveSecurity - Stantinko Botnet Adds Cryptomining to Its Pool of Criminal Activities
• Microsoft Defender Security Intelligence - Trojan:Win32/Stantinko
• Search "stantinko" on VirusTotal (External Analysis)
• Search "stantinko" on Any.Run (Sandbox Sandbox)
• Search "stantinko" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Botnet)

Explore other documented threats in the same operational category:

• Cybernetic
• Storm
• Palevo
• Cutwail
• Tordev
• Phorpiex
• Glupteba
• Mirai

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/stantinko.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.