Multiminer

Overview

CoinMiner:Win32/Multiminer represents a prevalent class of malware known as **Cryptojackers or Cryptocurrency Miners**. Unlike ransomware that destroys data, Multiminer's objective is entirely parasitic: it silently hijacks the infected computer's processing power (CPU and/or GPU) to solve complex cryptographic algorithms, mining cryptocurrency (like Monero or Bitcoin) and sending the profits directly to the attacker's wallet.

Understanding Multiminer (Cryptojacking)
To an end-user, the primary symptom of a Multiminer infection is severe system sluggishness. The computer's fans will spin constantly at maximum speed, applications will hang, and laptop batteries will drain rapidly. For an enterprise, widespread cryptomining infections represent a massive, unauthorized consumption of electricity and cloud computing resources, resulting in tangible financial loss and hardware degradation.

Execution and Resource Hijacking Mechanics
Multiminer is often distributed via opportunistic botnets scanning for unpatched vulnerabilities (like EternalBlue), malicious email attachments (`T1566.001`), or bundled with pirated software. Upon execution, it establishes persistence, often running as a hidden Windows Service (`T1543.003`) or via a scheduled task. The core payload (`T1496`) is a mining binary (often a modified version of open-source tools like XMRig). The malware configures the miner to connect to a specific mining pool over the internet (`T1071.001`), providing the attacker's wallet address. Advanced variants use defense evasion techniques to detect if Task Manager or security tools are opened, temporarily pausing the mining process to avoid detection (`T1562.001`).

Indicators of Compromise & Impact
The impact is significant resource theft, hardware wear, and inflated cloud infrastructure bills. Host-based IoCs include EDR alerts for sustained, 100% CPU/GPU utilization by unknown processes (often disguised as `svchost.exe` or `wuauclt.exe`). Network IoCs are highly distinct: consistent, unencrypted TCP connections to known cryptocurrency mining pools (e.g., using the Stratum protocol on ports 3333, 14444, or 443).

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1071.001: Implement web filtering and SSL/TLS inspection to detect malicious command and control (C2) traffic hiding in HTTP/HTTPS.

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_MULTIMINER_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Multiminer"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "multiminer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Multiminer (Ransomware) Execution & Triage
id: 14193ed5-0cca-5db1-b74f-cd627ca92a25
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Multiminer malware family. Detects volume shadow copy deletion, boot status
  tampering, and recovery inhibition characteristic of modern ransomware operations.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/multiminer
- https://malware-families-catalog.systemhelpdesk.com/defensive/ransomware-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.ransomware
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1071_001
- attack.t1496
- attack.t1543_003
- attack.t1562_001
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \vssadmin.exe
    - \wmic.exe
    - \wbadmin.exe
    - \bcdedit.exe
    CommandLine|contains:
    - delete shadows
    - shadowcopy delete
    - resize shadowstorage
    - recoveryenabled no
    - ignoreallfailures
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: critical

rule MALWARE_WIN_MULTIMINER_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Multiminer tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "multiminer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Isolate the endpoint to immediately sever the connection to the mining pool and halt the unauthorized resource consumption.
2. Use EDR or Process Explorer to identify the heavily obfuscated mining process consuming CPU cycles and terminate it.
3. Audit Windows Services and Scheduled Tasks to locate and remove the persistence mechanisms used to restart the miner.
4. Implement network-level blocking of known cryptocurrency mining pool IP addresses and domains at the corporate firewall.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not ignore complaints of 'slow computers'; while often a benign IT issue, widespread sluggishness is a primary indicator of a cryptojacking outbreak.
2. Avoid assuming cryptominers are harmless; threat actors often deploy miners as a secondary payload after establishing a backdoor, meaning data theft may have also occurred.

References & External Analysis

• Search "multiminer" on VirusTotal (External Analysis)
• Search "multiminer" on Any.Run (Sandbox Sandbox)
• Search "multiminer" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Ransomware)

Explore other documented threats in the same operational category:

• Bacalid
• Genericrxgj
• Foxhiex
• Badjoke
• Dominator
• Murlo
• Detplock
• Phires

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/multiminer.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.