» cpuminer-x86.exe
Overview
Analysis
File Details
Behaviors (1)
Network (1)

cpuminer-x86.exe

cpuminer-multi

SEIL SOFT, TOV

The application cpuminer-x86.exe by SEIL SOFT, TOV has been detected as a potentially unwanted program by 16 anti-malware scanners. It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘cpuminer’. This is a malicious Bitcoin miner. Bitcoin-mining malware is designed to force computers to generate Bitcoins for cybercriminals' use and consumes computing power. While running, it connects to the Internet address livingston.shortysmalls.biz on port 3202.

File name:

cpuminer-x86.exe

Publisher:

SEIL SOFT, TOV (signed and verified)

Product:

cpuminer-multi

Version:

1.1

MD5:

eed8056f7a1f80093f8858d22da75dfa

SHA-1:

71324ec07234deaed1d444119443a9b3336ddd5a

SHA-256:

efca5b4313c5898b5297d31d04941555572f7197a36ec5f8573e5d3ac5ac62f4

Scanner detections:

16 / 68

Status:

Potentially unwanted

Explanation:

The program will mine for BitCoins using the computer's GPU in the background and may be installed and run without the user's knowledge.

Analysis date:

11/24/2024 3:07:35 PM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Gen:Variant.Graftor.187607

5533056

Agnitum Outpost

Riskware.BitCoinMiner

7.1.1

Avira AntiVirus

TR/BitCoinMiner.2402816

8.3.1.6

avast!

Win32:Malware-gen

150521-0

Baidu Antivirus

Hacktool.Win32.BitCoinMiner

4.0.3.15521

Bitdefender

Gen:Variant.Graftor.187607

1.0.20.705

Emsisoft Anti-Malware

Gen:Variant.Graftor.187607

10.0.0.5366

ESET NOD32

Win32/BitCoinMiner.BY potentially unsafe application

7.0.302.0

F-Secure

Gen:Variant.Graftor.187607

5.14.151

G Data

Gen:Variant.Graftor.187607

15.5.25

K7 AntiVirus

Unwanted-Program

13.204.15985

MicroWorld eScan

Gen:Variant.Graftor.187607

16.0.0.423

Panda Antivirus

Trj/Genetic.gen

15.05.21.09

Reason Heuristics

Threat.Win.Reputation.IMP

15.5.22.10

Trend Micro House Call

TROJ_GEN.R0C1H09EL15

7.2.141

VIPRE Antivirus

Threat.4150696

40432

File size:

2.3 MB (2,410,272 bytes)

Product version:

1.1

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\Windows\System32\cpuminer-x86.exe

Digital Signature

Signed by:

SEIL SOFT, TOV

Authority:

COMODO CA Limited

Valid from:

5/6/2015 5:00:00 PM

Valid to:

5/6/2016 4:59:59 PM

Subject:

CN="SEIL SOFT, TOV", O="SEIL SOFT, TOV", STREET="Bud. 11 kv. 106, vul.Malynovskogo", L=Kiev, S=Kiev, PostalCode=04212, C=UA

Issuer:

CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

0095763363F9FC73188565050F489D9878

File PE Metadata

Compilation timestamp:

5/11/2015 7:57:01 AM

OS version:

6.0

OS bitness:

Win32

Subsystem:

Windows Console

Linker version:

12.0

CTPH (ssdeep):

49152:ZVbTg9Yz2sC7kaLvYLDjI/X55GBz5YGZrGMhATfuBRPVmH4E5:DT32sC77TYLDjMp5f4Lm5

Entry address:

0x17DCC1

Entry point:

E8, 7B, 02, 00, 00, E9, 91, FE, FF, FF, CC, CC, CC, CC, CC, 57, 56, 53, 33, FF, 8B, 44, 24, 14, 0B, C0, 7D, 14, 47, 8B, 54, 24, 10, F7, D8, F7, DA, 83, D8, 00, 89, 44, 24, 14, 89, 54, 24, 10, 8B, 44, 24, 1C, 0B, C0, 7D, 14, 47, 8B, 54, 24, 18, F7, D8, F7, DA, 83, D8, 00, 89, 44, 24, 1C, 89, 54, 24, 18, 0B, C0, 75, 18, 8B, 4C, 24, 18, 8B, 44, 24, 14, 33, D2, F7, F1, 8B, D8, 8B, 44, 24, 10, F7, F1, 8B, D3, EB, 41, 8B, D8, 8B, 4C, 24, 18, 8B, 54, 24, 14, 8B, 44, 24, 10, D1, EB, D1, D9, D1, EA, D1, D8, 0B, DB... 
[+]

Entropy:

6.9827

Code size:

1.5 MB (1,562,112 bytes)

Startup File (All Users Run)

Registry location:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

cpuminer

Command:

C:\Windows\System32\cpuminer-x86.exe

The executing file has been seen to make the following network communication in live environments.

TCP:

Connects to livingston.shortysmalls.biz (66.117.6.3:3202)

Remove cpuminer-x86.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.