Coinminer.Win64.MALBTC.ANC

コインマイナーは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

概要:プログラムは、コンピュータのCPUおよびGPUのリソースを利用して仮想通貨を発掘します。

侵入方法

コインマイナーは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

その他

コインマイナーは、以下を実行します。

• It supports the following algorithm options:
  • allium → Garlicoin (GRLC)
  • anime → Animecoin (ANI)
  • argon2 → Argon2 Coin (AR2)
  • argon2d250
  • argon2d500 → argon2d-dyn or Dynamic (DYN)
  • argon2d4096 → argon2d-uis or Unitus (UIS)'
  • axiom → Shabal-256 MemoHash
  • blake → blake256r14 (SFR)
  • blake2b → Blake2b 256
  • blake2s → Blake-2 S
  • blakecoin → blake256r8
  • bmw → BMW 256
  • bmw512 → BMW 512
  • c11 → Chaincoin
  • decred → Blake256r14dcr
  • deep → Deepcoin (DCN)
  • dmd-gr → Diamond
  • gr → Ghost Rider - Raptoreum (RTM)
  • groestl → Groestl coin
  • hex → x16r-hex
  • hmq1725 → Espers
  • hodl → Hodlcoin
  • jha → jackppot (Jackpotcoin)
  • keccak → Maxcoin
  • keccakc → Creative Coin
  • lbry → LBC or LBRY Credits
  • lyra2h → Hppcoin
  • lyra2re → lyra2
  • lyra2rev2 → lyrav2
  • lyra2rev3 → lyrav2v3
  • lyra2z
  • lyra2z330 → Lyra2 330 rows
  • m7m → Magi (XMG)
  • myr-gr → Myriad-Groestl
  • minotaur → Ringcoin (RNG)
  • neoscrypt → NeoScrypt(128 or 2 or 1)
  • nist5 → Nist5
  • pentablake → 5 x blake512
  • phi1612 → phi
  • phi2
  • polytimos
  • power2b → MicroBitcoin (MBC)
  • quark → Quark
  • qubit → Qubit
  • scrypt → scrypt(1024 or 1 or 1) (default)
  • scrypt:N → scrypt(N or 1 or 1)
  • sha256d → Double SHA-256
  • sha256q → Quad SHA-256 or Pyrite (PYE)
  • sha256t → Triple SHA-256 or Onecoin (OC)
  • sha3d → Double Keccak256 (BSHA3)
  • shavite3 → Shavite3
  • skein → Skein+Sha (Skeincoin)
  • skein2 → Double Skein (Woodcoin)
  • skunk → Signatum (SIGT)
  • sonoa → Sono
  • timetravel → timeravel8 or Machinecoin (MAC)
  • timetravel10 → Bitcore (BTX)
  • tribus → Denarius (DNR)
  • vanilla → blake256r8vnl (VCash)
  • veltor
  • verthash
  • whirlpool
  • whirlpoolx
  • x11 → Dash
  • x11evo → Revolvercoin (XRE)
  • x11gost → sib (SibCoin)
  • x12 → Galaxie Cash (GCH)
  • x13 → X13
  • x13bcd → bcd
  • x13sm3 → hsr (Hshare)
  • x14 → X14
  • x15 → X15
  • x16r
  • x16rv2
  • x16rt → Gincoin (GIN)
  • x16rt-veil → Veil (VEIL)
  • x16s
  • x17
  • x21s
  • x22i
  • x25x
  • xevan → Bitsend (BSD)
  • yescrypt → Globalboost-Y (BSTY)
  • yescryptr8 → BitZeny (ZNY)
  • yescryptr8g → Koto (KOTO)
  • yescryptr16 → Eli
  • yescryptr32 → WAVI
  • yespower → Cryply
  • yespowerr16 → Yenten (YTN)
  • yespower-b2b → generic yespower + blake2b
  • zr5 → Ziftr

マルウェアは、以下のパラメータを受け取ります。

• -a or --algo=ALGO → specify the algorithm to use
• -N or --param-n → N parameter for scrypt based algos
• -R or --param-r → R parameter for scrypt based algos
• -K or --param-key → Key (pers) parameter for algos that use it
• -o or --url=URL → URL of mining server
• -O or --userpass=U:P → username:password pair for mining server
• -u or --user=USERNAME → username for mining server
• -p or --pass=PASSWORD → password for mining server
• --cert=FILE → certificate for mining server using SSL
• -x or --proxy=[PROTOCOL://]HOST[:PORT] → connect through a proxy
• -t or --threads=N → number of miner threads (default: number of processors)
• -r or --retries=N → number of times to retry if a network call fails (default: retry indefinitely)
• --retry-pause=N → time to pause between retries or in seconds(default: 30)
• --time-limit=N → maximum time [s] to mine before exiting the program.
• -T or --timeout=N → timeout for long poll and stratum (default: 300 seconds)
• -s or --scantime=N → upper bound on time spent scanning current work when long polling is unavailable or in seconds(default: 5)
• --randomize → Randomize scan range start to reduce duplicates
• -f or --diff-factor → Divide req. difficulty by this factor (std is 1.0)
• -m or --diff-multiplier Multiply difficulty by this factor (std is 1.0)
• --hash-meter → Display thread hash rates
• --coinbase-addr=ADDR → payout address for solo mining
• --coinbase-sig=TEXT → data to insert in the coinbase when possible
• --no-longpoll → disable long polling support
• --no-getwork → disable getwork support
• --no-gbt → disable getblocktemplate support
• --no-stratum → disable X-Stratum support
• --no-extranonce → disable Stratum extranonce support
• --no-redirect → ignore requests to change the URL of the mining server
• -q or --quiet → disable per-thread hashmeter output
• --no-color → disable colored output
• -D or --debug → enable debug output
• -P or --protocol-dump → verbose dump of protocol-level activities'
• -B or --background → run the miner in the background
• --benchmark → run in offline benchmark mode
• --benchmark-config → run in offline benchmark mode. Test different Cryptonight configurations
• --cpu-affinity → set process affinity to cpu core(s) or mask0x3 for cores 0 and 1
• --cpu-priority → set process priority (default: 0 idle or 2 normal to 5 highest)
• -b or --api-bind=address[:port] → IP address for the miner API or default port is 4048)
• --api-remote → Allow remote control
• --max-temp=N → Only mine if cpu temp is less than specified value (linux)
• --max-rate=N[KMG] → Only mine if net hashrate is less than specified value
• --max-diff=N → Only mine if net difficulty is less than specified value
• -c or --config=FILE → load a JSON-format configuration file
• --data-file → path and name of data file
• --verify → enable additional time consuming start up tests
• -V or --version → display version information and exit
• -y → disable application of MSR mod on the system
• --no-tune → disable tuning of the miner before mining. Tuning takes 34 minutes.
• --tune-config=FILE → Point to the already created tune config. Default file created by the miner is tune_config
• -h or --help → display this help text and exit

詳細:プログラムは、コンピュータのCPUおよびGPUのリソースを利用して仮想通貨を発掘します。その結果、感染コンピュータの動作が非常に遅くなります。