Tiggre
Overview
Executive Summary
Tiggre (often detected as Trojan.Tiggre or CoinMiner.Tiggre) is a malicious Trojan heavily associated with unauthorized cryptocurrency mining (cryptojacking). It covertly infiltrates Windows systems and aggressively hijacks the host's CPU and GPU resources to mine cryptocurrencies (typically Monero) for the financial benefit of the attackers. Tiggre is known for its aggressive persistence mechanisms and significant impact on system performance.Infection Vector and Technical Capabilities
Tiggre is primarily distributed through untrustworthy file-sharing networks, often bundled with pirated software, cracked games, or illegal keygens. Users unwittingly install the miner when attempting to install the pirated application. Once active, it focuses entirely on resource hijacking and stealth:- Resource Hijacking (Cryptojacking): Upon execution, Tiggre silently launches mining software (often a modified version of open-source miners like XMRig) in the background. It configures the miner to utilize a massive percentage of the system's processing power, connecting to attacker-controlled mining pools.
- Aggressive Persistence: Tiggre ensures it runs continuously by copying itself to deep system directories (like `%AppData%` or `C:\ProgramData`) and creating hidden Scheduled Tasks or modifying registry `Run` keys.
- Evasion (Task Manager Hiding): To prevent the user from noticing the massive CPU spike, some Tiggre variants monitor active processes. If the user opens the Windows Task Manager or Process Explorer, the malware will temporarily suspend the mining process, making the system appear normal until the monitoring tool is closed.
Threat Assessment
While Tiggre generally does not steal data or deploy ransomware, it severely degrades endpoint performance. The intense, continuous workload placed on the CPU/GPU causes excessive heat, significantly reduces hardware lifespan, and renders the machine practically unusable for legitimate business tasks, resulting in high IT support costs.Incident Response and Remediation
- Performance Monitoring: IT administrators should utilize centralized monitoring tools to identify workstations exhibiting consistent, inexplicable CPU usage near 100%, which is the primary indicator of a cryptomining infection.
- Network Blocking (Mining Pools): Implement strict egress filtering on the corporate firewall to block traffic to known cryptocurrency mining pools (e.g., ports 3333, 4444, 5555 commonly used by Stratum protocols) and sinkhole mining domain names.
- Targeted Malware Removal: Standard AV may struggle with the persistence mechanisms. Utilize EDR or a dedicated anti-malware scan to identify the hidden executables, terminate the mining process, and remove the associated Scheduled Tasks.
Known aliases
Threat reports may refer to this family under multiple names:
MITRE ATT&CK Techniques
This family has been observed using the following ATT&CK techniques: T1496 T1547.001 T1562.001
Generated Detections (Boilerplate)
These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.
YARA Rule
rule MALWARE_WIN_TIGGRE {
meta:
description = "Detects Tiggre (cryptominer)"
author = "SystemHelpdesk Boilerplate Generator"
date = "2026-07-06"
strings:
$s1 = "tiggre" ascii wide nocase
$s2 = "trojan.tiggre" ascii wide nocase
$s3 = "coinminer.tiggre" ascii wide nocase
$s4 = "win32/tiggre" ascii wide nocase
condition:
uint16(0) == 0x5a4d and any of them
}Sigma Rule
title: Suspicious Tiggre Activity
id: 1e147f3cc609225a5aabe3e11d96bb8a
status: experimental
description: Detects generic indicators of the tiggre malware family.
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
CommandLine|contains:
- "*tiggre*"
- "*trojan.tiggre*"
- "*coinminer.tiggre*"
- "*win32/tiggre*"
condition: selection
level: mediumReferences & External Analysis
- Search "tiggre" on VirusTotal (External Analysis)
Frequently Asked Questions
Where can I learn more about tiggre?
Refer to the linked MITRE ATT&CK technique pages, which document the behaviors associated with this family.
How do I remove the Tiggre Cryptominer from Windows?
Manual removal of Tiggre is highly discouraged as it may leave persistence mechanisms intact. We recommend disconnecting the device from the internet and utilizing a professional incident response service or enterprise-grade EDR software to conduct a full forensic sweep.
Is Tiggre a virus or a Cryptominer?
Tiggre is classified as a Cryptominer. Unlike traditional viruses that infect files, modern malware like Tiggre typically operates as a standalone payload designed to compromise systems, steal data, or deploy secondary stage implants.
What are the main symptoms of a Tiggre infection?
Symptoms of Tiggre can include unexpected system slowness, unauthorized outbound network traffic to unknown IP addresses, disabled security software, and suspicious background processes running from AppData or Temp directories.
Related Families (Category: cryptominer)
Explore other malware families in the same category:
Protect Your Network Against Cryptominers
Want to prevent Tiggre and similar threats from compromising your organization? Read our comprehensive defensive guide: Cryptominer Protection Guide.
Machine-readable
Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/tiggre.json
Ecosystem & Interactive Environments
This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.