» cpuminer-gw64.exe
Overview
Analysis
File Details
Behaviors (1)
Network (2)

cpuminer-gw64.exe

Realinvest SOFT, TOV

The application cpuminer-gw64.exe by Realinvest SOFT, TOV has been detected as a potentially unwanted program by 4 anti-malware scanners. It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘cpuminer’. This is a malicious Bitcoin miner. Bitcoin-mining malware is designed to force computers to generate Bitcoins for cybercriminals' use and consumes computing power. While running, it connects to the Internet address livingston.shortysmalls.biz on port 3202.

File name:

cpuminer-gw64.exe

Publisher:

Realinvest SOFT, TOV (signed and verified)

MD5:

ca32d208f7602ebb369a27bea123eb30

SHA-1:

747d56ec6494ec3104c14a1263818d549a25a4f2

SHA-256:

e4a2c4b4f767635d1ef134c0381cc922c0d2d7148974ab943e371e29337e1688

Scanner detections:

4 / 68

Status:

Potentially unwanted

Explanation:

The program will mine for BitCoins using the computer's GPU in the background and may be installed and run without the user's knowledge.

Analysis date:

11/24/2024 3:51:11 PM UTC (today)

Scan engine

Detection

Engine version

Baidu Antivirus

Hacktool.Win64.BitCoinMiner

4.0.3.15618

Dr.Web

Trojan.BtcMine.709

9.0.1.0169

ESET NOD32

Win64/BitCoinMiner.AP potentially unsafe

9.11804

Reason Heuristics

PUP.BitcoinMiner.RealinvestSOFTTOV.Meta

15.6.18.10

File size:

1.3 MB (1,413,920 bytes)

File type:

Executable application (Win64 EXE)

Common path:

C:\Windows\System32\cpuminer-gw64.exe

Digital Signature

Signed by:

Realinvest SOFT, TOV

Authority:

COMODO CA Limited

Valid from:

5/29/2015 8:00:00 AM

Valid to:

5/29/2016 7:59:59 AM

Subject:

CN="Realinvest SOFT, TOV", O="Realinvest SOFT, TOV", STREET=Bud. 7a vul.Lodzka, L=Kharkiv, S=Kharkiv, PostalCode=61000, C=UA

Issuer:

CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

00FE321D16ABD978B89260FC92F22CF774

File PE Metadata

OS version:

4.0

OS bitness:

Win64

Subsystem:

Windows Console

Linker version:

2.24

CTPH (ssdeep):

24576:8MXNvhTboRjwA/h+NcHqhMWXm41yI1EiEP/Uw78FqpCBUBpYMYgQoBPA:8MXNvd05wA/h+9h7T11nkfptBpYMYo2

Entry address:

0x38C170

Entry point:

53, 56, 57, 55, 48, 8D, 35, AA, CE, EA, FF, 48, 8D, BE, DB, 7F, DC, FF, 48, 8D, 87, 0C, AB, 37, 00, FF, 30, C7, 00, FA, 29, 39, 48, 50, 57, 31, DB, 31, C9, 48, 83, CD, FF, E8, 50, 00, 00, 00, 01, DB, 74, 02, F3, C3, 8B, 1E, 48, 83, EE, FC, 11, DB, 8A, 16, F3, C3, 48, 8D, 04, 2F, 83, F9, 05, 8A, 10, 76, 21, 48, 83, FD, FC, 77, 1B, 83, E9, 04, 8B, 10, 48, 83, C0, 04, 83, E9, 04, 89, 17, 48, 8D, 7F, 04, 73, EF, 83, C1, 04, 8A, 10, 74, 10, 48, FF, C0, 88, 17, 83, E9, 01, 8A, 10, 48, 8D, 7F, 01, 75, F0, F3, C3... 
[+]

Entropy:

7.9411 (probably packed)

Code size:

1.3 MB (1,392,640 bytes)

Startup File (All Users Run)

Registry location:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

cpuminer

Command:

C:\Windows\System32\cpuminer-gw64.exe

The executing file has been seen to make the following network communications in live environments.

TCP:

Connects to livingston.shortysmalls.biz (66.117.6.3:3202)

TCP:

Connects to 198-178-124-50.static.hvvc.us (198.178.124.50:3202)

Remove cpuminer-gw64.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.