WinstarNssmMiner Cryptojacking

The WinstarNssmMiner Cryptojacking is a Trojan that mines, or generates cryptocurrency, using the infected PC's hardware. This threat also includes features for avoiding detection by different cyber-security products and may cause crashes, if it terminates improperly. Malware experts recommend using system reboot strategies that keep the Trojan from starting before having an appropriate anti-malware tool remove the WinstarNssmMiner Cryptojacking from the computer.

Another Trojan Star, Thanks to XMRig

The Bitcoin-mining application of XMRig is becoming responsible for a quickly-growing range of non-consensual equivalents, encompassing RubyMiner, the BlackRuby Ransomware, and the newest the WinstarNssmMiner Cryptojacking. While the WinstarNssmMiner Cryptojacking's feature for creating illicit profit is unoriginal, it also uses some especially invasive features for guaranteeing its persistence. Even after a victim identifies the WinstarNssmMiner Cryptojacking's disguised process, closing it also crashes the operating system.

The WinstarNssmMiner Cryptojacking is a Windows Trojan that maintains two svchost.exe processes, which malware experts often see in use as disguises for similar, constantly-running threats. One of these processes performs the Bitcoin-mining function of XMRig, which takes up CPU resources for creating Bitcoins that it transfers to the threat actor's wallet. The second one monitors the PC for any open cyber-security products actively and closes the Trojan automatically, if it detects them, to circumvent any attempts at identifying the infection preemptively.

The other feature of the WinstarNssmMiner Cryptojacking that malware analysts are noting as worth mention is the CriticalProcess attribute on the first of the two svchost.exe processes. This flag means that the closing of the Bitcoin miner also crashes the entire Windows OS, although users can recover by rebooting. Therefore, counteracting a WinstarNssmMiner Cryptojacking infection safely requires stopping its auto-startup routine, in the first place.

Stopping Your PC from Starring in the WinstarNssmMiner Cryptojacking's Profits

The WinstarNssmMiner Cryptojacking is making the equivalent of tens of thousands of dollars in Bitcoins, in exchange for hijacking the hardware of infected PCs. While malware experts are continuing their investigation into the delivery methods for this threat and how long its campaign has run, most Trojans with similar payloads use e-mail or RDP-based exploits for the installation phase of their attacks. Users can expect spam e-mails to disguise themselves as some form of non-hostile content, such as an invoice, and the use of in-document exploits for PDFs and Word documents, especially, is endemic.

Even though XMRig isn't a threatening program naturally, its non-consensual use can damage a compromised PC's hardware, cause overheating, and may create performance and stability problems. Users should reboot their PCs directly through a recovery USB device or use the Windows 'Safe Mode' feature for blocking the Trojan's startup. Without its being present in memory, any standard anti-malware software can delete the WinstarNssmMiner Cryptojacking safely.

It's rare for malware analysts to see a Bitcoin-mining threat using such overtly aggressive methods of preserving itself. What the WinstarNssmMiner Cryptojacking lacks in subtlety, it makes up for in brute force, which is, evidently, to the profit of its threat actors.