Coinminer.Win64.TOOLXMR.YXBD2

コインマイナーは、リモートサイトから他のマルウェア、グレイウェアまたはスパイウェアにダウンロードされ、コンピュータに侵入します。

侵入方法

コインマイナーは、リモートサイトから他のマルウェア、グレイウェアまたはスパイウェアにダウンロードされ、コンピュータに侵入します。

その他

コインマイナーは、以下を実行します。

• It uses the system's central processing unit (CPU) and/or graphical processing unit (GPU) resources to mine cryptocurrency. This behavior makes the system run abnormally slow.
• Accepts the following configuration file:
  • {Coinminer directory}\configXXX1.json
• Uses the following pools for mining:
  • api.{BLOCKED}.la:6363
  • api.{BLOCKED}.sh:6363
• Uses the following http host for HTTP API:
  • {BLOCKED}.{BLOCKED}.0.1:53669
• Uses the following credentials:
  • Username: x
  • password:
• Has an embedded configuration if config file is not found.

マルウェアは、以下のパラメータを受け取ります。

• -o or --url=URL -URL of mining server
• -a or --algo=ALGO -mining algorithm
• --coin=COIN -specify coin instead of algorithm
• -u or --user=USERNAME -username for mining server
• -p or --pass=PASSWORD -password for mining server
• -O or --userpass=U:P -username:password pair for mining server
• -x or --proxy=HOST:PORT -connect through a SOCKS5 proxy
• -k or --keepalive -send keepalive packet for prevent timeout (needs pool support)
• --nicehash -enable nicehash support
• --rig-id=ID -rig identifier for pool-side statistics (needs pool support)
• --tls -enable SSL/TLS support (needs pool support)
• --tls-fingerprint=HEX -pool TLS certificate fingerprint for strict certificate pinning
• --daemon use daemon RPC -instead of pool for solo mining
• --daemon-poll-interval=N -daemon poll interval in milliseconds (default: 1000)
• --self-select=URL -self-select block templates from URL
• -r or --retries=N -number of times to retry before switch to backup server (default: 5)
• -R or --retry-pause=N -time to pause between retries (default: 5)
• --user-agent -set custom user-agent string for pool
• --donate-level=N -donate level, default 1% (1 minute in 100 minutes)
• --donate-over-proxy=N -control donate over xmrig-proxy feature
• --no-cpu -disable CPU mining backend
• -t or --threads=N -number of CPU threads. Proper CPU affinity required for some optimizations.
• --cpu-affinity -set process affinity to CPU core(s), mask 0x3 for cores 0 and 1
• -v or --av=N -algorithm variation, 0 auto select
• --cpu-priority -set process priority (0 idle, 2 normal to 5 highest)
• --cpu-max-threads-hint=N -maximum CPU threads count (in percentage) hint for autoconfig
• --cpu-memory-pool=N -number of 2 MB pages for persistent memory pool, -1 (auto), 0 (disable)
• --cpu-no-yield -prefer maximum hashrate rather than system response/stability
• --no-huge-pages -disable huge pages support
• --hugepage-size=N -custom hugepage size in kB (Linux only)
• --asm=ASM -ASM optimizations, possible values: auto, none, intel, ryzen, bulldozer
• --randomx-init=N -thread count to initialize RandomX dataset
• --randomx-no-numa -disable NUMA support for RandomX
• --randomx-mode=MODE -RandomX mode: auto, fast, light
• --randomx-1gb-pages -use 1GB hugepages for RandomX dataset (Linux only)
• --randomx-wrmsr=N -write custom value(s) to MSR registers or disable MSR mod (-1)
• --randomx-no-rdmsr -disable reverting initial MSR values on exit
• --astrobwt-max-size=N -skip hashes with large stage 2 size, default: 550, min: 400, max: 1200
• --astrobwt-avx2 -enable AVX2 optimizations for AstroBWT algorithm
• --opencl -enable OpenCL mining backend
• --opencl-devices=N -comma separated list of OpenCL devices to use
• --opencl-platform=N -OpenCL platform index or name
• --opencl-loader=PATH -path to OpenCL-ICD-Loader (OpenCL.dll or libOpenCL.so)
• --opencl-no-cache -disable OpenCL cache
• --print-platforms -print available OpenCL platforms and exit
• --cuda -enable CUDA mining backend
• --cuda-loader=PATH -path to CUDA plugin (xmrig-cuda.dll or libxmrig-cuda.so)
• --cuda-devices=N -comma separated list of CUDA devices to use
• --cuda-bfactor-hint=N -bfactor hint for autoconfig (0-12)
• --cuda-bsleep-hint -bsleep hint for autoconfig
• --no-nvml -disable NVML (NVIDIA Management Library) support
• --api-worker-id=ID -custom worker-id for API
• --api-id=ID -custom instance ID for API
• --http-host=HOST -bind host for HTTP API (default: 127.0.0.1)
• --http-port=N -bind port for HTTP API
• --http-access-token=T -access token for HTTP API
• --http-no-restricted -enable full remote access to HTTP API (only if access token set)
• -S or --syslog -use system log for output messages
• -l or --log-file=FILE -log all output to a file
• --print-time=N -print hashrate report every N seconds
• --health-print-time=N -print health report every N seconds
• --no-color -disable colored output
• --verbose -verbose output
• -c or --config=FILE -load a JSON-format configuration file
• -B or --background -run the miner in the background
• -V or --version -output version information and exit
• -h or --help -display this help and exit
• --dry-run -test configuration and exit
• --export-topology -export hwloc topology to a XML file and exit
• --title set -custom console window title
• --no-title -disable setting console window title