Remote Miner
General description of the bot
This is a hidden Telegram bot written in Python that runs on Windows. Main features:
Mining Monero (XMR) via XMRig — downloads the miner, accepts the config, runs hidden
Automatic startup of the bot and miner after PC reboot (via a shortcut in Startup)
Real-time monitoring of user activity (sends notifications when the person opens a browser, game, Discord, Telegram, etc.)
File management on the victim's computer (viewing, reading, writing, deleting, launching, downloading)
Gathering information about startup, processes, and autostart at startup
The bot is completely hidden (the window is not visible, runs in the background via pythonw.exe).
Commands and what they do
Main miner commands
/downloadminer
Downloads an archive with XMRig from a direct link (for example, from GitHub), unpacks it into a hidden folder %APPDATA%\Microsoft\Windows\SysUpdate, hides the files (+h +s) and automatically starts mining.
/uploadconfig
Enables file waiting mode. After sending a .json or .txt file, the bot saves it as config.json in the miner's folder and automatically starts mining with the new config.
/startmine
Starts the miner (xmrig.exe) hidden (without a window).
/stopmine
Forcefully kills all xmrig.exe processes.
/minerstatus
Shows whether the miner is currently running (Running / Not started).
Autostart and system information
/autopath
Resends:
the path to the script itself (.py or .exe)
the path to the autostart shortcut (StealerBot.lnk)
the list of processes of the current user (PID + name)
/removeautostart
Removes the autostart shortcut from the Startup folder. After this, the bot will not start automatically after rebooting.
Processes and activity monitoring
/userprocesses
Shows a list of all processes running under the current user's name (up to 30 lines + total count).
Automatic monitoring (always runs in the background):
The bot checks the active window every ~1.5 seconds and sends a notification when the user opens:
Google Chrome (chrome.exe)
Microsoft Edge (msedge.exe)
Mozilla Firefox (firefox.exe)
Opera (opera.exe)
Brave (brave.exe)
Vivaldi (vivaldi.exe)
Telegram (telegram.exe)
Example message:
User opened Google Chrome (chrome.exe)
File management
/ls [path]
Simple text list of files and folders in the specified directory (or current if no path is specified).
/listfiles
A nice list of files with pagination and inline "Download" buttons (like in stealer).
Supports:
sorting (photos/videos on top)
"Back" / "Forward" / "Refresh" buttons
download buttons under each file
/downloadfile
Downloads the specified file directly into the chat (up to 50 MB).
/read
Reads and sends the content of a text file.
/write
Creates or overwrites a file with the specified text.
/rm
Deletes a file or folder.
/run [visible]
Launches a file/program.
If you write visible — with a window, otherwise hidden.
/download
Downloads a file into the chat (alternative to /downloadfile).
How the bot behaves after rebooting the PC
Automatically starts (if the shortcut in Startup is not deleted)
Sends a message with the path to the script, the path to the shortcut, and the list of processes
If xmrig.exe is already in the miner's folder — immediately starts mining hidden and sends:
Miner found — starting automatically after reboot
Mining started
This is a hidden Telegram bot written in Python that runs on Windows. Main features:
Mining Monero (XMR) via XMRig — downloads the miner, accepts the config, runs hidden
Automatic startup of the bot and miner after PC reboot (via a shortcut in Startup)
Real-time monitoring of user activity (sends notifications when the person opens a browser, game, Discord, Telegram, etc.)
File management on the victim's computer (viewing, reading, writing, deleting, launching, downloading)
Gathering information about startup, processes, and autostart at startup
The bot is completely hidden (the window is not visible, runs in the background via pythonw.exe).
Commands and what they do
Main miner commands
/downloadminer
Downloads an archive with XMRig from a direct link (for example, from GitHub), unpacks it into a hidden folder %APPDATA%\Microsoft\Windows\SysUpdate, hides the files (+h +s) and automatically starts mining.
/uploadconfig
Enables file waiting mode. After sending a .json or .txt file, the bot saves it as config.json in the miner's folder and automatically starts mining with the new config.
/startmine
Starts the miner (xmrig.exe) hidden (without a window).
/stopmine
Forcefully kills all xmrig.exe processes.
/minerstatus
Shows whether the miner is currently running (Running / Not started).
Autostart and system information
/autopath
Resends:
the path to the script itself (.py or .exe)
the path to the autostart shortcut (StealerBot.lnk)
the list of processes of the current user (PID + name)
/removeautostart
Removes the autostart shortcut from the Startup folder. After this, the bot will not start automatically after rebooting.
Processes and activity monitoring
/userprocesses
Shows a list of all processes running under the current user's name (up to 30 lines + total count).
Automatic monitoring (always runs in the background):
The bot checks the active window every ~1.5 seconds and sends a notification when the user opens:
Google Chrome (chrome.exe)
Microsoft Edge (msedge.exe)
Mozilla Firefox (firefox.exe)
Opera (opera.exe)
Brave (brave.exe)
Vivaldi (vivaldi.exe)
Telegram (telegram.exe)
Example message:
User opened Google Chrome (chrome.exe)
File management
/ls [path]
Simple text list of files and folders in the specified directory (or current if no path is specified).
/listfiles
A nice list of files with pagination and inline "Download" buttons (like in stealer).
Supports:
sorting (photos/videos on top)
"Back" / "Forward" / "Refresh" buttons
download buttons under each file
/downloadfile
Downloads the specified file directly into the chat (up to 50 MB).
/read
Reads and sends the content of a text file.
/write
Creates or overwrites a file with the specified text.
/rm
Deletes a file or folder.
/run [visible]
Launches a file/program.
If you write visible — with a window, otherwise hidden.
/download
Downloads a file into the chat (alternative to /downloadfile).
How the bot behaves after rebooting the PC
Automatically starts (if the shortcut in Startup is not deleted)
Sends a message with the path to the script, the path to the shortcut, and the list of processes
If xmrig.exe is already in the miner's folder — immediately starts mining hidden and sends:
Miner found — starting automatically after reboot
Mining started
Rovno 
Available for hire
Offer work