640715b013a5ee3646129fc00d58caf8
Jump to navigation
Jump to search
Description
Summary
INCOMPLETE SECTION OR ARTICLE
This section/article is being written and is therefore not complete.
Thank you for your comprehension.
Thank you for your comprehension.
Identification
MD5 | 640715b013a5ee3646129fc00d58caf8 |
---|---|
SHA1 | 91eb79bffdd7524bfc80f367cb958616534ed3e6 |
SHA256 | 9d9ad9271e3fc4ad67106e0c51da3e92de6d1cc017797919e7ad1511fd0b6586 |
ssdeep | 3072:oHidscHrfc99K+WjK8LXerhMmCBFRyVj7Ahf8xmszPc:oHpUfSB8LXerhMmCBF3JvSP |
imphash | 1962c275ba28ca92b087db70092dd854 |
File name |
|
File size | 188.0 KB ( 192512 bytes ) |
File type | Win32 EXE |
Magic literal | PE32 executable for MS Windows (console) Intel 80386 32-bit |
TrID |
|
Antivirus detection
Antivirus | Result | Update |
---|---|---|
Ad-Aware | Application.Bitcoinminer.F | 20140409 |
AegisLab | 20140409 | |
Agnitum | Riskware.Agent! | 20140408 |
AhnLab-V3 | 20140408 | |
AntiVir | SPR/BitCoin.aged | 20140409 |
Antiy-AVL | RiskWare[RiskTool:not-a-virus,HEUR]/Win32.BitCoinMiner | 20140408 |
Avast | Win32:BitCoinMiner-FA [PUP] | 20140409 |
AVG | 20140408 | |
Baidu-International | 20140408 | |
BitDefender | Application.Bitcoinminer.F | 20140409 |
Bkav | 20140408 | |
ByteHero | 20140409 | |
CAT-QuickHeal | RiskTool.BitCoinMiner.heu (Not a Virus) | 20140409 |
ClamAV | 20140409 | |
CMC | 20140408 | |
Commtouch | W32/Trojan.YOXT-2363 | 20140408 |
Comodo | Application.Win32.Bitcoinminer.~F | 20140409 |
DrWeb | Tool.BtcMine.284 | 20140409 |
Emsisoft | 20140409 | |
ESET-NOD32 | a variant of Win32/BitCoinMiner.AX | 20140409 |
F-Prot | 20140409 | |
F-Secure | Application.Bitcoinminer.F | 20140409 |
Fortinet | Riskware/BitCoinMiner | 20140408 |
GData | Application.Bitcoinminer.F | 20140409 |
Ikarus | Win32.SuspectCrc | 20140409 |
Jiangmin | 20140409 | |
K7AntiVirus | Trojan ( 00490e111 ) | 20140409 |
K7GW | Trojan ( 00490e111 ) | 20140409 |
Kaspersky | not-a-virus:RiskTool.Win32.BitCoinMiner.nkm | 20140409 |
Kingsoft | Win32.Troj.Generic.a.(kcloud) | 20140409 |
Malwarebytes | Riskware.BitcoinMiner | 20140409 |
McAfee | RDN/Generic PUP.x!bwf | 20140409 |
McAfee-GW-Edition | RDN/Generic PUP.x!bwf | 20140409 |
Microsoft | 20140409 | |
MicroWorld-eScan | Application.Bitcoinminer.F | 20140409 |
NANO-Antivirus | Riskware.Win32.BitCoinMiner.cuwlis | 20140409 |
Norman | BitCoinMiner.STR | 20140408 |
nProtect | 20140408 | |
Panda | Trj/dtcontx.L | 20140408 |
Qihoo-360 | 20140409 | |
Rising | 20140408 | |
Sophos | Generic PUA JB | 20140409 |
SUPERAntiSpyware | 20140409 | |
Symantec | WS.Reputation.1 | 20140409 |
TheHacker | 20140408 | |
TotalDefense | 20140408 | |
TrendMicro | 20140409 | |
TrendMicro-HouseCall | 20140409 | |
VBA32 | 20140408 | |
VIPRE | Trojan.Win32.Generic!BT | 20140409 |
ViRobot | 20140409 |
Links
- Virustotal: https://www.virustotal.com/en/file/9d9ad9271e3fc4ad67106e0c51da3e92de6d1cc017797919e7ad1511fd0b6586/analysis/1397023919/
- Download: https://www.dropbox.com/s/t6o278ojp0y6ied/minerd.zip (package containing all sources, pass: infected)
Artifacts
Options
The program is intended to be used in command line (CLI) and accepts following options:
C:\malware>m32.exe --help Usage: minerd [OPTIONS] Options: -a, --algo=ALGO specify the algorithm to use scrypt scrypt(1024, 1, 1) (default) sha256d SHA-256d -o, --url=URL URL of mining server -O, --userpass=U:P username:password pair for mining server -u, --user=USERNAME username for mining server -p, --pass=PASSWORD password for mining server --cert=FILE certificate for mining server using SSL -x, --proxy=[PROTOCOL://]HOST[:PORT] connect through a proxy -t, --threads=N number of miner threads (default: number of processors) -r, --retries=N number of times to retry if a network call fails (default: retry indefinitely) -R, --retry-pause=N time to pause between retries, in seconds (default: 30) -T, --timeout=N network timeout, in seconds (default: 270) -s, --scantime=N upper bound on time spent scanning current work when long polling is unavailable, in seconds (default: 5) --no-longpoll disable X-Long-Polling support --no-stratum disable X-Stratum support -q, --quiet disable per-thread hashmeter output -D, --debug enable debug output -P, --protocol-dump verbose dump of protocol-level activities --benchmark run in offline benchmark mode -c, --config=FILE load a JSON-format configuration file -V, --version display version information and exit -h, --help display this help text and exit
Static analysis
Sections
Name VirtAddr VirtSize RawSize Entropy -------------------------------------------------------------------------------- .text 0x1000 0x2a6e4 0x2a800 6.271820 .data 0x2c000 0x748 0x800 5.827326 .rdata 0x2d000 0x26bc 0x2800 4.987305 .bss 0x30000 0x1240 0x0 0.000000 [SUSPICIOUS] .idata 0x32000 0xeb8 0x1000 4.930931 .CRT 0x33000 0x34 0x200 0.275021 [SUSPICIOUS] .tls 0x34000 0x20 0x200 0.204488 [SUSPICIOUS]
Dependencies
Dependency | Hash | Size |
---|---|---|
libcurl-4.dll |
|
208 KB (212480 bytes) |
libwinpthread-1.dll |
|
71 KB (72206 bytes) |
zlib1.dll |
|
110 KB (112640 bytes) |
IAT
Module | Function |
---|---|
KERNEL32.dll |
|
USER32.dll |
|
WS2_32.dll |
|
libcurl-4.dll |
|
libwinpthread-1.dll |
|
msvcrt.dll |
|
TLS callbacks
- 0x420bd0
- 0x420b80
Strings
54#C [^_] \$<1 UWVS [^_] [^_] UWVS [^_] UWVS D$(t iL$H [^_] ;D$, -4#C D$0; ;D$0 ;D$, [^_] T$0; UUUU D$4P D$8P u f1 [^_] [^_] UWVS [^_] [^_] [^_] [^_] UWVS ,[^_] UWVS ,[^_] ,[^_] [^_] D$,t, [^_] UWVS [^_] UWVS [^_] UWVS {"id ": 1 , "m etho d": "min ing. subs @ crib @$e", @("par @,ams" @0: []f [^_] D$D1 \$H1 L$,t |$@1 9|$Dt\ D$H1 UWVS [^_] [^_] l$81 UWVS L$$1 t$(1 \$,1 l$4! L$<1 |$@1 \$ #|$ #\$ l$P! \$ t$l1 L$p! D$x1 9RQ> LwH' |$ ! [^_] UWVS [^_] [^_] [^_] >g)) 1LwH' LwH' [^_] 66665\\\\ 66665\\\\ 66665\\\\ \\\\ \\\\5\\\\ \\\\ \\\\ \\\\5\\\\ \\\\ \\\\ \\\\5\\\\ 5\\\\ 5\\\\ 56666 6666 666656666 6666 6666 666656666 6666 6666 666656666 56666 [^_] \\\\ \\\\ 6666 6666 [^_] o~pf D$0f L$@f T$Pf \$`f d$pf D$0f D$Pf D$pf owpf t$ 1 t$ f T$ f oW0f oF0f oX f ox0f \$Pf |$`f o@@f D$pf o@`f o`pf o` f o` f o@0f o`@f o@Pf o``f o@pf oI f oQ0f oq@f oyPf oi`f oapf t$ f T$ f t$ f T$ f op f t$ f T$ f op0f t$ f T$ f op@f t$ f T$ f opPf t$ f T$ f op`f t$ f T$ f oppf t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f oL$Pf oT$`f ot$pf ot$ f |$0f l$@f d$Pf \$`f D$pf t$ f T$ f t$ f T$ f t$ f T$ f t$ f T$ f |$81 |$ 1 |$ 1 |$$1 t$ 1 t$ 1 t$(1 t$81 |$81 |$ 1 |$ 1 |$$1 t$ 1 t$ 1 t$(1 t$81 SUWV G 3G` G$3Gd G(3Gh G,3Gl G03Gp G43Gt G83Gx G<3G| _@3\ _D3\ _H3\ _L3\ _P3\ _T3\ _X3\ _\3\ G 3D _`3\ G$3D _d3\ G(3D _h3\ G,3D _l3\ G03D _p3\ G43D _t3\ G83D _x3\ G<3D _|3\ G 3G` G$3Gd G(3Gh G,3Gl G03Gp G43Gt G83Gx G<3G| H^_][ T$xf ot$`f o|$p oT$ f o\$0f od$@f ol$Pf T$ f \$0f D$@f L$Pf D$@f L$Pf D$@f L$Pf D$@f od$@f ol$P oT$ f o\$0 T$ f \$0f T$ f \$0f T$ f \$0f D$@f L$Pf D$@f L$Pf D$@f L$Pf D$@f t$`f ^_][ [^_] [^_] [^_] ,[^_] uN9C ,[^_] [^_] ,[^_] UWVS L[^_] D$<t UWVS Ct$H \[^_] \[^_] \[^_] 9L$Lsd 9L$Lr \[^_] D$0tL L$,9 T$08T :D$0t [^_] k 9l$H s 9t$H \$0t T$(<- T$(v <\t% <utl<f T$(v D$0- T$(8 [^_] [^_] ,[^_] ,[^_] ,[^_] t$T1 [^_] L[^_] [^_] [^_] [^_] ED$@ D$,% T$@1 l$(% 9|$4 u[9|$< ;|$( [^_] [^_] [^_] 9|$(|x 9|$( 9|$(|< D,l. D,m0 ;|$, 9|$0 t$(1 t$P9D$< \$(t ;|$< ur9|$X |$\1 ;l$( |$\1 9l$(|9 |$(1 T$41 T$(1 UWVS ,[^_] UWVS ,[^_] UWVS L$H1 ,[^_] T$H9 UWVS ,[^_] ,[^_] UWVS tZ;} ts;} ,[^_] ,[^_] UWVS ,[^_] UWVS ,[^_] ,[^_] UWVS [^_] [^_] UWVS [^_] ,[^_] D$$t 5H#C l[^_] 5H#C 5D#C l[^_] [^_] =H#C |$D=N 3l$(3l$,1 UWVS -<#C [^_] :MZt UWVS1 [^_] [^_] B' t [^_] UWVS DD$, L[^_] T$81 :^_] UWVS ;l$( T$$; <[^_] [^_] <[^_] 9D$( L$,1 9D$( UWVS ,[^_] L$T1 t$T1 L$T1 D$\1 UWVS [^_] |$`1 t$D+D$l t$D~ +t$X +L$h T$D1 |$\5 +t$\ +t$\ +l$l l$D:E |$`1 ID$` D$| L$xu 9L$\ D$4uX 9D$@~' D$l9 l$p1 O|$d T$@x l$H+D$H+l$\9l$l~ +l$l +T$P 9D$@ 9D$\ ED$X l$l9 D$\1 L$P;D$@ +D$| T$| D$| l$\) |$`1 9T$l T$H9T$\ D$\1 9l$l D$(1 D$(1 Z 9Z$~ L[^_] tL9M [^_] VUUU ti;] [^_] VUUU [^_] [^_] VUUU [^_] VUUU UWVS gfff gfff ,[^_] UWVS L[^_] L[^_] UWVS L[^_] L[^_] D$8f T$<1 gfff gfff D$Nu}9 \[^_] D$ . \$!t UWVS T$$1 |[^_] 9|$8 L$nf L$8@ 54#C ,[^_] UWVS L$8s |$(sY t$$1 9|$ 9L$(w L[^_] UWVS [^_] UWVS l$,) 9T$ w <[^_] UWVS 9t$ L$ 9 <[^_] D$$t <[^_] 8WVS T$P9 ,[^_] T$8+T$< )D$, UWVS [^_] UWVS [^_] [^_] UWVS L$ 1 9D$ t$ +\$, T$(;P <[^_] UWVS T$\1 D$ 1 l$\1 [^_] |$,1 D$(t +|$( l$$;j 9D$$ +|$$9 [^_] [^_] )|$$ <[^_] +D$` D$ ;p l$$;j T$Tf UWVS h;\$ l$$;\$X 9\$X 9T$X <[^_] ;\$Xv +L$, 9\$Xs [^_] [^_] UWVS L$4;J D$ 1 D$$ ;|$P L$$ [^_] 9D$ s +T$4 [^_] [^_] [^_] L$ 1 +L$ |$x1 D$Xt MD$X D$Xt +D$X )D$@ +|$@ D$L) 9D$D D$H9l$H )D$\) )D$H D$`) D$8~ +|$H T$4)T$\ 9D$` |$`) 9T$D t$$1 D$$ +T$` |$09 D$$ D$$ |$09 D$$ D$$ |$09 D$$ |$09 D$$ DD$$ D$$ T$,u 9|$Xv( [^_] [^_] [^_] 9|$Xv t$P1 L$(tX UWVS [^_] t$(f T$41 +D$ 9t$, T$ s 9L$@ 9\$, 9D$@s \[^_] %\#C %l#C %<$C %|#C %x#C %`$C %x$C %,$C %d$C %D$C %L$C %H$C %($C %4$C %0$C %@$C %h$C %T$C %P$C %8$C %X#C %X$C %$$C %p#C %\$C %t$C %l$C %p$C % $C u(;|$ r/9D$ WVSQ Y[^_] vRQ> 8STs LwH'LwH'LwH'LwH' libgcj-12.dll _Jv_RegisterClasses Try `minerd --help' for more information. Usage: minerd [OPTIONS] Options: -a, --algo=ALGO specify the algorithm to use scrypt scrypt(1024, 1, 1) (default) sha256d SHA-256d -o, --url=URL URL of mining server -O, --userpass=U:P username:password pair for mining server -u, --user=USERNAME username for mining server -p, --pass=PASSWORD password for mining server --cert=FILE certificate for mining server using SSL -x, --proxy=[PROTOCOL://]HOST[:PORT] connect through a proxy -t, --threads=N number of miner threads (default: number of processors) -r, --retries=N number of times to retry if a network call fails (default: retry indefinitely) -R, --retry-pause=N time to pause between retries, in seconds (default: 30) -T, --timeout=N network timeout, in seconds (default: 270) -s, --scantime=N upper bound on time spent scanning current work when long polling is unavailable, in seconds (default: 5) --no-longpoll disable X-Long-Polling support --no-stratum disable X-Stratum support -q, --quiet disable per-thread hashmeter output -D, --debug enable debug output -P, --protocol-dump verbose dump of protocol-level activities --benchmark run in offline benchmark mode -c, --config=FILE load a JSON-format configuration file -V, --version display version information and exit -h, --help display this help text and exit scrypt sha256d JSON decode of %s failed http: https:// stratum+tcp:// http:%s stratum socks4:// socks5:// socks4a:// socks5h:// cpuminer 2.3.3 %.0f %.2f (yay!!!) (booooo) accepted: %lu/%lu (%.2f%%), %s khash/s %s DEBUG: reject reason: %s DEBUG: job_id='%s' extranonce2=%s ntime=%08x Starting Stratum on %s ...terminating workio thread ...retry after %d seconds Stratum detected new block Stratum connection timed out Stratum connection interrupted JSON decode failed(%d): %s result error DEBUG: stale work detected, discarding {"method": "mining.submit", "params": ["%s", "%s", "%s", "%s", "%s"], "id":4} submit_upstream_work stratum_send_line failed submit_upstream_work OOM {"method": "getwork", "params": [ "%s" ], "id":1} submit_upstream_work json_rpc_call failed reject-reason data JSON key '%s' not found JSON key '%s' is not a string JSON inval data target JSON inval target CURL initialization failed %s%s%s Long-polling activated for %s {"method": "getwork", "params": [], "id":0} LONGPOLL detected new block submitold DEBUG: got new work json_rpc_call failed, terminating workio thread json_rpc_call failed, retry after %d seconds DEBUG: got new work in %d ms Binding thread %d to cpu %d thread %d: %lu hashes, %s khash/s Total: %s khash/s work retrieval failed, exiting mining thread %d algo %s: unsupported non-option argument '%s' config JSON option %s invalid %s: no URL supplied %s:%s https: workio thread create failed longpoll thread create failed stratum thread create failed thread %d create failed %d miner threads started, using '%s' algorithm. workio thread dead, exiting. a:c:Dhp:Px:qr:R:s:t:T:o:u:O:V benchmark cert debug help no-longpoll no-stratum pass protocol-dump proxy quiet retries retry-pause scantime threads timeout user userpass version MbP? X-Reject-Reason X-Stratum X-Long-Polling [%d-%02d-%02d %02d:%02d:%02d] %s JSON protocol request: Content-Length: %lu Content-Type: application/json User-Agent: cpuminer/2.3.3 X-Mining-Extensions: midstate Accept: Expect: HTTP request failed: %s stratum+tcp:// Empty data received in json_rpc_call. JSON decode failed(%d): %s JSON protocol response: result error (unknown reason) JSON-RPC call failed: %s reject-reason %02x hex2bin str truncated hex2bin failed on '%s' hash <= target hash > target (false positive) DEBUG: %s Hash: %s Target: %s > %s stratum_recv_line failed stratum_recv_line failed to parse a newline-terminated string < %s stratum_recv_line timed out CURL initialization failed http%s http_proxy all_proxy ALL_PROXY Stratum connection failed: %s {"id": 1, "method": "mining.subscribe", "params": ["cpuminer/2.3.3", "%s"]} {"id": 1, "method": "mining.subscribe", "params": ["cpuminer/2.3.3"]} mining.notify Failed to get Stratum session id Failed to get extranonce1 Failed to get extranonce2_size Stratum session id: %s stratum_subscribe timed out method params Stratum notify: invalid parameters Stratum notify: invalid Merkle branch mining.set_difficulty Stratum difficulty set to %g client.reconnect stratum+tcp://%s:%d Server requested reconnection to %s client.get_version cpuminer/2.3.3 client.show_message MESSAGE FROM SERVER: %s {"id": 2, "method": "mining.authorize", "params": ["%s", "%s"]} Stratum authentication failed %s near '%s' %s near end of file load.c count >= 2 unable to decode byte 0x%x at position %d stream->buffer_pos > 0 stream->buffer[stream->buffer_pos] == c c == d premature end of input unexpected newline control character 0x%x invalid escape invalid Unicode '\u%04X\u%04X' invalid Unicode '\u%04X' \u0000 is not allowed end == saved_text + lex->saved_text.length real number overflow true false null too big integer too big negative integer string or '}' expected ':' expected '}' expected ']' expected invalid token unexpected token '[' or '{' expected end of file expected unable to open %s: %s \u%04x \u%04x\u%04x null true false %.17g dump.c i == size value Unknown error _matherr(): %s in %s(%g, %g) (retval=%g) Argument domain error (DOMAIN) Argument singularity (SIGN) Overflow range error (OVERFLOW) The result is too small to be represented (UNDERFLOW) Total loss of significance (TLOSS) Partial loss of significance (PLOSS) Mingw-w64 runtime failure: Address %p has no image-section VirtualQuery failed for %d bytes at address %p VirtualProtect failed with code 0x%x Unknown pseudo relocation protocol version %d. Unknown pseudo relocation bit size %d. %s: POSIXLY_CORRECT unknown option -- %c option requires an argument -- %c ambiguous option -- %.*s option doesn't take an argument -- %.*s option requires an argument -- %s unknown option -- %s inity (null) PRINTF_EXPONENT_DIGITS vH7B W4vC [%Co O8M2 Infinity ?aCoc <2ZGU ?ABCDEF abcdef 0123456789 _get_output_format _set_output_format ___lc_codepage_func __lc_codepage curl_easy_cleanup curl_easy_init curl_easy_perform curl_easy_reset curl_easy_setopt curl_global_init curl_slist_append curl_slist_free_all curl_version DeleteCriticalSection EnterCriticalSection GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetStartupInfoA GetSystemInfo GetSystemTimeAsFileTime GetTickCount GetTimeZoneInformation InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection MultiByteToWideChar QueryPerformanceCounter SetThreadPriority SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WideCharToMultiByte __argv __dllonexit __getmainargs __initenv __lconv_init __mb_cur_max __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _errno _exit _fmode _initterm _iob _lock _onexit _snwprintf time localtime _stricmp _strnicmp exit fclose feof fflush fgetc fopen fprintf fputc free fwprintf fwrite getenv islower isspace isupper isxdigit localeconv malloc memchr memcmp memcpy memmove memset printf puts qsort raise realloc setlocale signal sprintf strchr strcmp strcpy strerror strlen strncmp strncpy strrchr strstr strtok strtol _unlock abort atoi calloc vfprintf wcscpy wcslen _vsnprintf _strdup pthread_cond_destroy pthread_cond_init pthread_cond_signal pthread_cond_timedwait pthread_cond_wait pthread_create pthread_join pthread_mutex_destroy pthread_mutex_init pthread_mutex_lock pthread_mutex_unlock MessageBoxW WSAGetLastError WSAIoctl recv select send socket libcurl-4.dll KERNEL32.dll msvcrt.dll libwinpthread-1.dll USER32.dll WS2_32.dll