How to remove CoinLurker

What is CoinLurker

CoinLurker is a stealer-type malware designed specifically to extract sensitive data related to cryptocurrency wallets from infected systems. This Trojan employs sophisticated methods to avoid detection and executes its malicious payloads in-memory, making it particularly elusive. By targeting both popular and obscure cryptocurrencies, CoinLurker poses significant risks to users who utilize digital wallets for Bitcoin, Ethereum, and other digital currencies like BBQCoin and MemoryCoin. The malware propagates through deceptive means such as fake update scams, leveraging Web3 technology to conceal its malicious payloads. Once a system is compromised, CoinLurker searches for valuable data not only from cryptocurrency wallets but also from FTP clients and messaging platforms like Discord and Telegram. Due to its targeted nature, CoinLurker can lead to severe financial losses, privacy invasions, and identity theft. The malware’s developers continuously refine its capabilities, potentially expanding its target range, which underscores the importance of robust security practices and tools to prevent infection.

How CoinLurker infected your system

CoinLurker is a sophisticated stealer-type malware that primarily infiltrates computers through deceptive fake update scams. The malware’s propagation often leverages Web3 technology, which helps it to conceal its malicious payloads within otherwise legitimate-looking updates for popular browsers. Users are typically lured to these malicious websites through rogue advertising networks, phishing emails, or social engineering tactics, where they are tricked into downloading what appears to be critical security patches or software updates. Once the user interacts with the fake update interface, CoinLurker utilizes a technique known as EtherHiding, embedding encoded data within a Binance Smart Contract to communicate with its Command and Control (C&C) server. This method allows the malware to discreetly download additional instructions and payloads, ultimately leading to the execution of CoinLurker within the user’s system memory. Its advanced evasion tactics, including the utilization of Microsoft’s Edge WebView2 for detection avoidance, make it a formidable threat that can silently extract sensitive data from cryptocurrency wallets and other personal information stored on the infected device.

1. Download CoinLurker Removal Tool
2. Use Windows Malicious Software Removal Tool to remove CoinLurker
3. Use Autoruns to remove CoinLurker
4. Files, folders and registry keys of CoinLurker
5. Other aliases of CoinLurker
6. How to protect from threats, like CoinLurker

Remove CoinLurker manually

Manual removal of CoinLurker by inexperienced users may become a difficult task because it does not create entries in Add/Remove Programs under Control Panel, does not install browser extensions, and uses random file names. However, there are pre-installed instruments in the Windows system, that allow you to detect and remove malware without using third-party applications. One of them is Windows Malicious Software Removal Tool. It comes with Windows Update in Windows 11, 10, 8. 8.1. For older operating system you can download it here: 64-bit version | 32-bit version.

Remove CoinLurker using Windows Malicious Software Removal Tool

1. Type mrt in the search box near Start Menu.
2. Run mrt clicking on found item.
3. Click Next button.
4. Choose one of the scan modes Quick scan, Full scan, Customize scan (Full scan recommended).
5. Click Next button.
6. Click on View detailed results of the scan link to view the scan details.
7. Click Finish button.

Remove CoinLurker using Autoruns

CoinLurker often sets up to run at Windows startup as an Autorun entry or Scheduled task.

1. Download Autoruns using this link.
2. Extract the archive and run Autoruns.exe file.
3. In Options menu make sure there are checkboxes near Hide Empty Locations, Hide Microsoft Entries, and Hide Windows Entries.
4. Search for suspicious entries with weird names or running from locations like: C:\{username}\AppData\Roaming.
5. Right-click on suspicious entry and choose Delete. This will prevent the threat to run at startup.
6. Switch to Scheduled Tasks tab and do the same.
7. To remove files themselves, click on suspicious entries and choose Jump to Entry…. Remove files or registry keys found.

Remove files, folder and registry keys of CoinLurker

CoinLurker files and folders


{randomname}.exe


CoinLurker registry keys


no information


Aliases of CoinLurker

How to protect from threats, like CoinLurker, in future

Standard Windows protection or any decent third-party antivirus (Norton, Avast, Kaspersky) should be able to detect and remove CoinLurker. However, if you got infected with CoinLurker with existing and updated security software, you may consider changing it. To feel safe and protect your PC from CoinLurker on all levels (browser, e-mail attachments, Word or Excel scripts, file system) we recommend a leading provider of internet security solutions – BitDefender. Its solutions both for home and business users proved to be one of the most advanced and effective. Choose and get your BitDefender protection via the button below:

Download BitDefender