Security tipsTech News

What is Trojan.CoinMiner csrss.exe

Trojan.CoinMiner uses the computing resources of the infected computer to receive cryptocurrency, most often in BitCoin.

The owner of such infected computers may notice that some processes in their system use a lot of CPU % which often slow down the computer or even freeze it completely. The main problem with a miner program that they use your PC to make money.

Small overheat you say?
Small overheat you say?

For the average user, it can be just a slow down of the computer but be careful, if you ignore this problem you can lose part of your PC because of overheating. So if you notice that CPU temperatures over 50 degrees, then be ready that someone already using your PC for mining.


Such viruses often can be downloaded from the Internet by the users themselves, often when users open unknown files from the spam message they infect the computer with different kinds of virus-like malware or adware. But the developer often has a plan B, they attach alike viruses to the installation of different free programs, so if you skip the installation process and didn’t look to advantage setting then ready that your computer will be infected with virus-like this.

We discovered a sample of Trojan.CoinMiner written in Delphi, which is distributed via spam mail:

Trojan Coin Miner PEiD v0.95

GridinSoft Antim-Malware detect it as “Trojan.Win32.CoinMiner.dd” (like on image below):

MD5: 922e0891ae30ac3adb3a09cb963570cc
SHA1: 77feeefff422519cdb63faa438fea87e5e70882a

Other antivirus programs detect Trojan.CoinMiner (csrss.exe) as:

EmsisoftTrojan.Agent.CEQQ (B)
ESET-NOD32a variant of Win64/BitCoinMiner.AP potentially unsafe

The virus creates the next folder:


And create these files:

  • Auto.bat
  • Start.vbs
  • Start2.vbs
  • Hide.bat
  • Start.bat
  • Start2.bat
  • 1.bat
  • 2.bat
  • Srvany.exe
  • Csrss.exe
  • Srvanyx.exe

After Trojan.CoinMiner has been unpacked, it hides its presence using the strings in Hide.bat, setting the hidden and system attributes to the folder and files in it.
Attrib C:\Windows\MicrosoftU + S + H / S / D
Attrib C:\Windows\MicrosoftU\*. * + S + H / S / D

“Miner” uses the name of one of the system files “csrss.exe” to hide its presence in the system.

The virus starts with the following parameters:
Stratum + tcp: // 45560 – Resource for which “mining” will be entered – user login from whom the extraction will be introduced
Cryptonight – Mining algorithm

Another parameter is how many threads the program will work in, this “miner” has a formula for calculating the number of processor cores involved, it is in the .bat file that launches the “miner” for the first time:

Set / a cpu =% NUMBER_OF_PROCESSORS% / 2 + 1
Srvanyx -a cryptonight -o stratum + tcp: // 45560 -u -p x -t% cpu%

tadjukbm Trojan.CoinMiner
Nah, it’s fine, the computer just a slily slow down

Another good miner example – Adylkuzz. This miner use SMB vulnerability for several weeks and this is a similar vulnerability that uses widespread WannaCry (Wana Decrypt0r) what infect millions of the computer last week. The main difference between those two viruses is that Adylkuzz miner hides as deep as possible and just uses computer performance to mine Bitcoin and WCry (Wana Decryptor) aggressively encrypt data on the user’s computer.
Moreover, the researchers are sure that the malicious Adylkuzz miner infects the computer much earlier than WannaCry, at least on May 2, 2017. Adylkuzz did not attract as much attention as the sWana Decrypt0r, for the simple reason that it is much more difficult to notice infection in this case. The only “symptoms” that the victim can notice is the slowdown of the PC, as the miner uses the system’s resources. Specialists say that Adylkuzz protected the users affected by it from WannaCry ransomware attacks. After the miner infects the user’s computer, it closes the “hole” in SMB and does not allow other malware to use the gap.
Trojan Coin Miner REMOVAL
The specialists of both companies remind everyone who for some reason has not yet installed the update MS17-010, which closes the gap in SMB, that it should be done immediately, and also close the 445 port.

The miners are worth noting that the program that is used only for “mining” and does not carry a direct threat, but can be used for undesirable actions. We highly recommend you to download and scan your PC with professional anti-malware tool and clean up your PC.

Related Articles

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Back to top button