ELF64_COINMINER.B

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be downloaded by other malware/grayware from remote sites.

It connects to certain websites to send and receive information.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be downloaded by the following malware/grayware from remote sites:

• ELF64_ETERNALMINER.A

Other Details

This Trojan connects to the following website to send and receive information:

• xmr.{BLOCKED}-pool.fr:3333

It does the following:

• It accepts the following parameters:
  • -K, --keep-gantle Reverse some processors for host' processing
  • -o, --url=URL == URL of mining server
  • -O, --userpass=U:P == username:password pair for mining server
  • -u, --user=USERNAME == username for mining server
  • -p, --pass=PASSWORD == password for mining server
    --cert=FILE == certificate for mining server using SSL
  • -x, --proxy=[PROTOCOL://]HOST[:PORT] == connect through a proxy
  • -t, --threads=N == number of miner threads (default: number of processors)
  • -r, --retries=N == number of times to retry if a network call fails (default: retry indefinitely)
  • -R, --retry-pause=N == time to pause between retries, in seconds (default: 30)
  • -T, --timeout=N timeout for long polling, in seconds (default: none)
  • -s, --scantime=N == upper bound on time spent scanning current work when long polling is unavailable, in seconds (default: 5)
    --no-longpoll == disable X-Long-Polling support
    --no-stratum == disable X-Stratum support
    --no-redirect == ignore requests to change the URL of the mining server
  • -q, --quiet == disable per-thread hashmeter output
  • -D, --debug == enable debug output
  • -P, --protocol-dump == verbose dump of protocol-level activities
  • -S, --syslog == use system log for output messages
  • -B, --background == run the miner in the background
    --benchmark == run in offline benchmark mode
  • -c, --config=FILE == load a JSON-format configuration file
  • -V, --version == display version information and exit
  • -h, --help == display this help text and exit
• It uses a hardcoded credentials for the mining server.
• This hacking tool is a coin miner used to generate bitcoins.
• The mining process eats up a system's computing power. As such, infected systems sustain increased wear and tear from processing coin blocks and the infected systems will work abnormally slow.