Minr Cryptojacking

The Minr Cryptojacking or Minr Malware is a threat that uses your PC's hardware for generating the Monero cryptocurrency after your browser loads an infected website. Prolonged exposure to this threat can cause significant performance and stability issues. Users can block Web-browsing scripts indiscriminately or let their anti-malware programs detect and block the Minr Cryptojacking safely, whenever appropriate.

The Monero Miners are Back to Work, Minus a Letter

Coinhive is the statistically-unquestioned dominating force of the browser-based mining marketplace, but there also is room for competing mining scripts. Out of these less densely-populated threats, one that malware analysts see in higher activity than previously is the Minr Cryptojacking. Threat actors are deploying Minr on 'innocent' websites, such as the domain of the University of Winnipeg Foundation, after gaining administrative access by unknown exploits (such as brute-forcing).

The Minr Cryptojacking is very similar to the much more numerous Coinhive Cryptojacking: it runs on JavaScript, requires hosting on an infected website, hijacks the victims' CPUs, and generates the Monero cryptocurrency for arbitrary third parties. However, unlike Coinhive, Minr has no significant uses as a legitimate script statistically and is being hosted on under a thousand websites, at this date.

After loading a site that includes its script, the victim's Web browser begins the 'mining' activity automatically, with an accompanying extreme usage of the CPU. Threat actors are deploying current versions of the Minr Malware's scripts with the additional protection of a layer of JSFuck or the JJencode obfuscator. This obfuscation converts the scripts into a limited series of symbols (such as '[]' brackets) without harming the functionality of the mining routine. Malware researchers speculate that this feature is in use for keeping standard anti-malware protection from detecting the Minr Cryptojacking before it begins mining the Monero coins.

Keeping Your PC from Getting 'Jacked' Through Your Brows

Web-browsing applications without any protection from corrupted JavaScript may launch Minr by default, without giving the victim any signs of the mining function occurring. Current configurations of the Minr Cryptojacking use maximum CPU resources, and malware experts recommend that all PC users familiarize themselves with 'normal' hardware usage percentages for tracking these discrepancies when it's necessary. However, the future versions of Minr may use different setups or have more stealth-oriented implementations.

Website administrators should be notified of the presence of the Minr Cryptojacking scripts on their sites so that they can remove the associated content and take steps for re-securing their sites. Since this threat's campaign often reuses a similar set of domains, searching for known associated Minr Malware sites like Web.clod[.]pw could help admins isolate the compromised pages. Web surfers can use anti-malware protection for blocking the Minr Cryptojacking or removing associated content, such as cookies, that might run it automatically.

Threats like the Minr Cryptojacking can spread via something as supposedly harmless as an official link in a Wikipedia article, as one, February-dated incident attests. Since the con artists are registering new domains for exploiting the Minr up to this article's date of authorship, all Web surfers need to be paying attention to what's running in their browsers.