{
  "family": "coinstealer",
  "sample_count": 52,
  "category": "infostealer",
  "description": "Coinstealer (cataloged across threat intelligence databases and security vendors under signatures including Trojan:Win32/Coinstealer, Trojan:Win32/Coinstealer!rfn, and Trojan.CoinStealer) is a specialized cryptocurrency clipboard hijacker and wallet theft trojan active since 2017. Distributed through malicious software cracks, cryptocurrency discussion forums, and trojanized mining utilities, Coinstealer runs covertly as a background process monitoring the Windows Clipboard using the SetClipboardViewer or AddClipboardFormatListener APIs. When the user copies a string matching regular expression patterns of cryptocurrency addresses (such as Bitcoin base58/bech32, Ethereum 0x hex format, Monero, or Litecoin), Coinstealer instantaneously substitutes the victim's destination address with an operator-controlled wallet address before the user pastes it into a transaction form. Additionally, Coinstealer searches local disk directories for wallet data files (such as wallet.dat, Electrum seeds, and Metamask browser extension vaults) and exfiltrates them to remote C2 endpoints over HTTP or Telegram bots.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Coinstealer",
    "Trojan:Win32/Coinstealer!rfn",
    "Trojan.CoinStealer",
    "Win32/Coinstealer",
    "CryptoStealer"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Coinstealer?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Coinstealer is a cryptocurrency-stealing trojan that replaces wallet addresses copied to the clipboard and steals wallet files."
      }
    },
    {
      "@type": "Question",
      "name": "How does Coinstealer hijack cryptocurrency payments?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It monitors clipboard text with regex and swaps copied Bitcoin/Ethereum addresses with the attacker's wallet address."
      }
    },
    {
      "@type": "Question",
      "name": "What cryptocurrency wallets and file formats are targeted?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It searches for wallet.dat files, Electrum seed vaults, Exodus keys, and browser extension storage (MetaMask)."
      }
    },
    {
      "@type": "Question",
      "name": "How does Coinstealer maintain persistence on Windows?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It adds startup keys to HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and creates hidden scheduled tasks."
      }
    },
    {
      "@type": "Question",
      "name": "How can users protect cryptocurrency transactions from Coinstealer?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Always visually verify every character of destination wallet addresses before confirming transactions, and use hardware wallets."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1115",
    "T1555.004",
    "T1547.001",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1555",
      "name": "Credentials from Password Stores",
      "tactic": "Credential Access"
    },
    {
      "id": "T1115",
      "name": "Clipboard Data",
      "tactic": "Collection"
    },
    {
      "id": "T1005",
      "name": "Data from Local System",
      "tactic": "Collection"
    },
    {
      "id": "T1048",
      "name": "Exfiltration Over Alternative Protocol",
      "tactic": "Exfiltration"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network to halt the exfiltration of the `wallet.dat` files or seed phrases.",
    "If the user has not yet entered their master password to unlock a stolen (but encrypted) wallet, advise them to immediately move funds using a different, clean device.",
    "Capture a forensic memory image to identify the specific C2 server the stolen wallets were sent to.",
    "Assume all locally saved passwords and seed phrases have been compromised; a complete OS rebuild is necessary to ensure clipboard hijackers are removed."
  ],
  "what_to_avoid": [
    "Do not allow the user to perform any cryptocurrency transactions on the infected machine, as the clipboard hijacker will steal the funds.",
    "Avoid assuming the threat is contained just by running a basic AV scan; the exfiltrated wallet data must be considered compromised."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Direct Financial Cryptocurrency Theft",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2017,
  "threat_actor": null,
  "delivery_mechanism": [
    "Trojanized Cryptocurrency Miners",
    "Cracked Software & Activators",
    "Crypto Forum Phishing Links"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Real-Time Clipboard Address Swapping",
    "Cryptocurrency Regex Detection (BTC, ETH, XMR)",
    "Local Wallet.dat & Seed File Theft",
    "Registry Autostart Persistence",
    "Encrypted Telegram Bot Exfiltration"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (C++ / .NET)",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "HTTPS requests to Telegram Bot API (api.telegram.org) transmitting stolen wallet archives",
      "HTTP POST beacons reporting hijacked transaction amounts"
    ],
    "evasion_techniques": [
      "Lightweight standalone binary with minimal memory footprint",
      "Instantaneous in-memory string replacement without disk writes",
      "Anti-debugging loops monitoring Process Environment Block"
    ],
    "indicators": {
      "file_paths": [
        "%AppData%\\CryptoClip\\clipsvc.exe",
        "%Temp%\\wallet_backup.tmp"
      ],
      "registry_keys": [
        "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\CryptoClipboardHelper"
      ]
    }
  },
  "severity": "high",
  "lineage": {
    "derived_from": [
      "Clipboard Crypto Stealer Engine"
    ],
    "variants": [
      "Coinstealer.BTC",
      "Coinstealer.Multi"
    ]
  },
  "iocs": {
    "file_hashes": [
      "90123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
      "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0"
    ],
    "delivery": [
      "nicehash_miner_optimization_patch.exe",
      "metamask_wallet_updater.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\CryptoClipboardHelper"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Trojan:Win32/Coinstealer",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Coinstealer"
    },
    {
      "name": "Malwarebytes Labs Threat Encyclopedia - Trojan.CoinStealer",
      "url": "https://www.malwarebytes.com/blog/threat-intelligence"
    }
  ]
}