Win.Worm.Coinminer
Win.Worm.Coinminer is a Windows malware detection name observed repeatedly in Cisco Talos telemetry as a prevalent malware file. The provided content identifies it as "Win.Worm.Coinminer::1201" and includes one sample with SHA256 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507, MD5 2915b3f8b703eb744fc54c81f4a9c67f, and example filename e74d9994a37b2b4c693a76a580c3e8fe_1_Exe.exe. Based on the detection naming, it is associated with worm-like behavior and cryptocurrency mining on Windows systems. The content does not provide specific infection vectors, propagation details, persistence mechanisms, targeted industries, or attribution to a threat actor. High-confidence indicators directly mentioned are the detection name Win.Worm.Coinminer::1201, SHA256 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507, MD5 2915b3f8b703eb744fc54c81f4a9c67f, and the example filename e74d9994a37b2b4c693a76a580c3e8fe_1_Exe.exe.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
IOCs tracked for this family
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A worm that includes coinmining functionality, likely spreading laterally and using infected systems to mine cryptocurrency.
A worm that includes coinmining functionality, likely spreading laterally and using infected systems to mine cryptocurrency.
Coinminer is a malware family that infects systems to mine cryptocurrency illicitly, often spreading via worm-like propagation.
Coinminer is a worm-like cryptomining malware that infects systems to mine cryptocurrency illicitly, often spreading laterally within networks.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.