Stealth mining

Kubilay
3 min readApr 8, 2021

How is stealth mining controlled?

The first and most obvious sign of computer infection is slowing down. If the equipment is running normally most of the time and is only starting to slow down on one site, it’s possible that black miners have entered your computer through a browser. The most dangerous in this regard are sites that require a long time spent by the user — torrent viewers, computer games, and watching movies. Most often, the technology of gamers is powerful processors and video cards. Another sign of infection is a sharp increase in electricity consumption. The main difficulty in controlling stealth mining is that anti-virus programs identify it as potentially dangerous software, not a virus. After all, miners actually only steal resources from someone else’s computer, but they cannot cause technical malfunctions or malfunctions. It is also important to understand this.

Virus programs for stealth mining

Let’s list the main malicious programs that users should know to improve the security of their equipment.

Miner Bitcoin (Trojan Horse). As a rule, people load their computers at about 18–20% of the power, while Bitcoin Miner increases this figure to 80, sometimes 100%. Besides illegal use of resources, spyware steals personal information and can even allow intruders to access your wallets. Distributed by opinion Trojan horse mainly via Skype; photos or Word documents can also be downloaded.
EpicScale. This program was discovered by uTorrent visitors. Responding to the well-grounded accusations, the company owners said that the funds received in this way were sent to charity. At the same time, users did not receive any explanation as to why they “forgot” to inform them in a timely manner about their participation in this “charity event”. It is noteworthy that it is impossible to completely get rid of EpicScale; Once removed, the virus software’s executable files remain on the computer. Later, a similar scandal erupted around the Pirate Bay torrent audience.
JS / Coin Miner. A malicious program that allows you to mine cryptocurrencies through the browsers of other people’s computers by offering custom scripts. There are users of online video surveillance portals and gaming sites, especially in the risk zone. Sites like this are CPU-intensive, so JS / CoinMiner won’t go unnoticed in most cases. To detect a fake script, you need to check if it is in the list of miner scripts.

How to prevent incognito browser mining
Today there are several effective ways to protect against attacks by black miners in the browser:

Edit the hosts file.
Install the NoCoin browser extension and Anti-Web Miner utility.
Disable javaScript browser without Using Scripting.
Add UBlock and AdBlock anti-mining.
But if everything about JavaScript and utilities is clear enough, the host version needs to be further evaluated. Below we post instructions on how to do this:

Protection from hidden virus mining: precautions

Basic protection rules: do not follow suspicious links, do not download unlicensed products; do not enable switches from unknown sources.

And now a few important rules for safe working with a computer:

It is not enough just to install an antivirus, you have to update it systematically.
Create yourself a Windows account and log in daily. Since all programs require administrator rights to install, the risk of accidentally downloading and running malware is eliminated.
For Apple technology, the best solution would be to install a function that allows downloading the software from the AppStore only.
At the first sign of slowing down, start the “task manager” and check if there is a program on your computer that is using it at its maximum capacity (80–100%). Even if you don’t find it, don’t rush to calm down because there are viruses that use less force.
Install special tools that protect against viruses and notify the registry of updates. The best option is Google Chrome for those who install and use Request Policy Continued and uMatrix at the same time, plus Antiminer blocker.

--

--