Coinminer.Win64.MALXMR.TIAOODEB

This Coinminer arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It uses the system's central processing unit (CPU) and/or graphical processing unit (GPU) resources to mine cryptocurrency.

Arrival Details

This Coinminer arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Coinminer adds the following processes:

• %System%\schtasks.exe

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It injects codes into the following process(es):

• Created %System%\schtasks.exe

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

Other Details

This Coinminer does the following:

• It accepts the following parameters:
  • --algo=ALGO -> mining algorithm
  • --coin=COIN -> specify coin instead of algorithm
  • --api-worker-id=ID -> custom worker-id for API
  • --api-id=ID -> custom instance ID for API
  • --http-host=HOST -> bind host for HTTP API
  • --http-access-token=T -> access token for HTTP API
  • --http-port=N -> bind port for HTTP API
  • --http-no-restricted -> enable full remote access to HTTP API (only if access token set)
  • --daemon -> use daemon RPC instead of pool for solo mining
  • --daemon-poll-interval=N -> daemon poll interval in milliseconds (default: 1000)
  • --self-select=URL -> self-select block templates from URL
  • --background -> run the miner in the background
  • --config=FILE -> load a JSON-format configuration file
  • --cpu-affinity -> set process affinity to CPU core(s), mask 0x3 for cores 0 and 1
  • --cpu-priority -> set process priority (0 idle, 2 normal to 5 highest)
  • --donate-level=N -> donate level, default 5%% (5 minutes in 100 minutes)
  • --donate-over-proxy=N -> control donate over xmrig-proxy feature
  • --dry-run -> test configuration and exit
  • --keepalive -> send keepalived packet for prevent timeout (needs pool support)
  • --log-file=FILE -> log all output to a file
  • --nicehash -> enable nicehash.com support
  • --no-color -> disable colored output
  • --no-huge-pages -> disable huge pages support
  • --pass=PASSWORD -> password for mining server
  • --print-time=N -> print hashrate report every N seconds
  • --retries=N -> number of times to retry before switch to backup server (default: 5)
  • --retry-pause=N -> time to pause between retries (default: 5)
  • --threads=N -> number of CPU threads
  • --user=USERNAME -> username for mining server
  • --cpu-max-threads-hint=N -> maximum CPU threads count (in percentage) hint for autoconfig\
  • --cpu-memory-pool=N -> number of 2 MB pages for persistent memory pool, -1 (auto), 0 (disable)
  • --randomx-init=N -> threads count to initialize RandomX dataset
  • --randomx-no-numa -> disable NUMA support for RandomX
  • --opencl -> enable OpenCL mining backend\n
  • --opencl-devices=N -> comma separated list of OpenCL devices to use
  • --opencl-platform=N -> OpenCL platform index or name\n
  • --opencl-loader=PATH -> path to OpenCL-ICD-Loader (OpenCL.dll or libOpenCL.so)
  • --opencl-no-cache -> disable OpenCL cache\n
  • --cuda -> enable CUDA mining backend\n
  • --cuda-loader=PATH -> path to CUDA plugin (xmrig-cuda.dll or libxmrig-cuda.so)\n
  • --cuda-devices=N -> comma separated list of CUDA devices to use\n
  • --cuda-bfactor-hint=N -> bfactor hint for autoconfig (0-12)\n
  • --cuda-bsleep-hint=N -> bsleep hint for autoconfig\n
  • --no-nvml -> disable NVML (NVIDIA Management Library) support\n
  • --health-print-time=N -> print health report every N seconds
  • --help -> display this help and exit
  • --version -> output version information and exit
  • --export-topology -> export hwloc topology to a XML file and exit
  • --print-platforms -> print available OpenCL platforms and exit
  • --url=URL -> URL of mining server
  • --userpass=U:P -> username:password pair for mining server
  • --rig-id=ID -> rig identifier for pool-side statistics (needs pool support)
  • --user-agent -> set custom user-agent string for pool
  • --no-cpu -> disable CPU mining backend
  • --av=N -> algorithm variation, 0 auto select
  • --asm=ASM -> ASM optimizations, possible values: auto, none, intel, ryzen, bulldozer
• Supported algorithm options:
  • cn/gpu
  • rx/wow
  • rx/wow
  • rx/arq
  • cn/gpu
  • rx/arq
  • rx/wow
  • cn/2
  • cn/gpu
  • rx/arq
  • rx/wow
  • cn/msr
  • cn/2
  • cn/rwz
  • cn/rto
  • cn/xao
  • cn/gpu
  • cn/zls
  • rx/wow
  • rx/arq
  • cn/2
  • cn/0
  • cryptonight/1
  • cryptonight/0
  • cryptonight/r
  • cn/2
  • cryptonight/2
  • cn/1
  • cn/half
  • cryptonight/half
  • cryptonight/msr
  • cn/fast
  • cryptonight/fast
  • cn/r
  • cryptonight/zls
  • cryptonight/rwz
  • cryptonight/rto
  • cryptonight/xao
  • cn-lite/0
  • cryptonight-lite/0
  • cryptonight/gpu
  • cn/double
  • cryptonight/double
  • cn-lite/1
  • cryptonight-lite/1
  • cn-heavy/xhv
  • cryptonight-heavy/xhv
  • cn-heavy/0
  • cryptonight-heavy/0
  • cn-pico/trtl
  • cryptonight-pico/trtl
  • cn-heavy/tube
  • cryptonight-heavy/tube
  • rx/0
  • randomx/0
  • randomx/loki
  • randomx/wow
  • rx/test
  • randomx/test
  • argon2/wrkz
  • argon2/chukwa
  • randomx/arq
  • rx/loki
• Supported coin options:
  • monero
  • arqma

It uses the system's central processing unit (CPU) and/or graphical processing unit (GPU) resources to mine cryptocurrency. This behavior makes the system run abnormally slow.