Bitmin

Overview

Trojan:Win32/Bitmin is a generic classification for stealthy cryptocurrency mining trojans designed to quietly commandeer endpoint CPU and GPU resources to mine digital currencies (most commonly Monero/XMR) for the attacker.

Understanding Bitmin
To the end-user, a Bitmin infection manifests as severe system sluggishness, loud cooling fans, and a rapidly draining laptop battery. For incident responders, Bitmin represents a resource theft threat that significantly degrades operational productivity and increases hardware wear. While it does not typically steal data, its presence indicates a failure in perimeter defenses.

Execution and Evasion Strategies
Bitmin variants are distributed via drive-by downloads, fake software installers, or as secondary payloads dropped by exploit kits. Upon execution, the trojan typically drops a modified, command-line version of the open-source XMRig miner into the <code>%AppData% or %Temp% directory. It establishes persistence via a Scheduled Task or Registry Run key. To evade detection, Bitmin employs resource throttling (e.g., only utilizing 50% of the CPU so the user doesn't notice) or pausing the mining operation entirely if it detects Task Manager or a popular PC game being launched.

Indicators of Compromise & Impact
The primary impact is endpoint performance degradation. Threat hunters should investigate EDR alerts for 'High CPU Utilization by Unknown Process'. Network logs will show continuous, low-bandwidth outbound connections to known mining pools (using the Stratum protocol) over non-standard ports (e.g., 3333, 4444). Analysts should look for processes executing from user directories with long command-line arguments specifying wallet addresses and pool URLs.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1059.003: Restrict execution of Windows Command Shell (cmd.exe) and block unauthorized batch scripts.
• T1105: Implement network intrusion detection systems (NIDS) and host-based firewalls to block unauthorized inbound or outbound file transfers.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_BITMIN {
    meta:
        description = "Detects Bitmin (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "bitmin" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Bitmin Activity
id: 13960bc5424fed986d262d1b8fc0d9d0
status: experimental
description: Detects generic indicators of the bitmin malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*bitmin*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Isolate the endpoint from the network; this immediately severs the connection to the mining pool, rendering the attacker's operation unprofitable.
2. Utilize EDR to identify and terminate the process aggressively consuming CPU cycles, paying close attention to hidden or injected processes.
3. Audit the Windows Task Scheduler and Registry Run keys to remove the persistence mechanisms responsible for launching the miner.
4. Block the identified mining pool IP addresses and domains at the corporate firewall to prevent future infections from communicating outward.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not ignore the infection as 'just a miner'; the initial vector that delivered the miner must be identified, as it could just as easily deliver ransomware.
2. Avoid relying solely on Task Manager to find the process; advanced miners will suspend execution when Task Manager is opened.

References & External Analysis

• Search "bitmin" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Scarcruft
• Slowpcfighter
• Iezones
• Gamevance
• Ciadoor

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/bitmin.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.