How to remove MintsLoader

What is MintsLoader

MintsLoader is a sophisticated malware loader that has been actively utilized in recent cyberattack campaigns, primarily targeting critical sectors like electricity, oil and gas, and legal services in the United States and Europe. This PowerShell-based threat is known for distributing secondary payloads, such as the StealC information stealer and the legitimate open-source platform BOINC. Attackers typically deliver MintsLoader via spam emails containing links to malicious pages or compromised JScript files. These attacks often exploit deceptive techniques, like fake CAPTCHA prompts, to trick users into executing harmful scripts. Once initiated, MintsLoader employs obfuscated JavaScript files to trigger PowerShell commands that download and execute the loader, while simultaneously erasing traces to avoid detection. It connects to a Command-and-Control server to download additional malicious payloads, using advanced evasion methods like a Domain Generation Algorithm to dynamically create C2 domains. By leveraging intricate delivery mechanisms and exploiting user trust, MintsLoader represents an evolving threat in the landscape of cyberattacks, underscoring the need for heightened user vigilance and robust cybersecurity measures.

How MintsLoader infected your system

MintsLoader is a sophisticated malware loader that primarily infiltrates computers through deceptive tactics, often leveraging spam emails as its initial entry point. These emails typically contain fraudulent links that, once clicked, download an obfuscated JavaScript file. This file then triggers a PowerShell command to silently download and execute MintsLoader on the victim’s system, effectively erasing itself afterward to evade detection. Additionally, MintsLoader utilizes fake CAPTCHA prompts, posing as routine human verification checks on compromised web pages, to trick users into executing malicious PowerShell scripts. Once installed, MintsLoader connects to a Command-and-Control (C2) server to download further malicious payloads, such as information stealers, while employing sophisticated evasion techniques like sandboxes avoidance and a Domain Generation Algorithm (DGA) for dynamic C2 domain generation. This intricate infection chain highlights the evolving tactics of cybercriminals, emphasizing the need for heightened user vigilance and advanced security solutions to thwart such threats.

1. Download MintsLoader Removal Tool
2. Use Windows Malicious Software Removal Tool to remove MintsLoader
3. Use Autoruns to remove MintsLoader
4. Files, folders and registry keys of MintsLoader
5. Other aliases of MintsLoader
6. How to protect from threats, like MintsLoader

Remove MintsLoader manually

Manual removal of MintsLoader by inexperienced users may become a difficult task because it does not create entries in Add/Remove Programs under Control Panel, does not install browser extensions, and uses random file names. However, there are pre-installed instruments in the Windows system, that allow you to detect and remove malware without using third-party applications. One of them is Windows Malicious Software Removal Tool. It comes with Windows Update in Windows 11, 10, 8. 8.1. For older operating system you can download it here: 64-bit version | 32-bit version.

Remove MintsLoader using Windows Malicious Software Removal Tool

1. Type mrt in the search box near Start Menu.
2. Run mrt clicking on found item.
3. Click Next button.
4. Choose one of the scan modes Quick scan, Full scan, Customize scan (Full scan recommended).
5. Click Next button.
6. Click on View detailed results of the scan link to view the scan details.
7. Click Finish button.

Remove MintsLoader using Autoruns

MintsLoader often sets up to run at Windows startup as an Autorun entry or Scheduled task.

1. Download Autoruns using this link.
2. Extract the archive and run Autoruns.exe file.
3. In Options menu make sure there are checkboxes near Hide Empty Locations, Hide Microsoft Entries, and Hide Windows Entries.
4. Search for suspicious entries with weird names or running from locations like: C:\{username}\AppData\Roaming.
5. Right-click on suspicious entry and choose Delete. This will prevent the threat to run at startup.
6. Switch to Scheduled Tasks tab and do the same.
7. To remove files themselves, click on suspicious entries and choose Jump to Entry…. Remove files or registry keys found.

Remove files, folder and registry keys of MintsLoader

MintsLoader files and folders


{randomname}.exe


MintsLoader registry keys


no information


Aliases of MintsLoader

How to protect from threats, like MintsLoader, in future

Standard Windows protection or any decent third-party antivirus (Norton, Avast, Kaspersky) should be able to detect and remove MintsLoader. However, if you got infected with MintsLoader with existing and updated security software, you may consider changing it. To feel safe and protect your PC from MintsLoader on all levels (browser, e-mail attachments, Word or Excel scripts, file system) we recommend a leading provider of internet security solutions – BitDefender. Its solutions both for home and business users proved to be one of the most advanced and effective. Choose and get your BitDefender protection via the button below:

Download BitDefender