HKTL_BITCOMINE

This hacking tool arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be dropped by other malware.

Arrival Details

This hacking tool arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be dropped by the following malware:

• TROJ_BITCOMINE.A

NOTES:

This hacking tool is a Bitcoin miner used to generate bitcoins.

It may be bundled with a malware to send to other machines and use the affected machine to mine for Bitcoins.

The affected machine uses high CPU power, which also requires more electricity. This may result in higher electricity bills.

This hacking tool can be run using the following format:

• {hacking tool file name} {-options}

Options:

-a scrypt|sha256|solid|seconds; - hashing algorithm (scrypt, sha256 or solid), or time between
getwork requests 1..60, default 15
-A user-agent - Set custom User-agent string in HTTP header, default: Ufasoft bitcoin miner
-g yes|no - set 'no' to disable GPU, default 'yes'
-h - help
-i index|name - select device from Device List, can be used multiple times, default - all devices
-I intensity - Intensity of GPU usage [-10..10], default 0
-l yes|no - set 'no' to disable Long-Polling, default 'yes'
-o url - in form http://username:password@server.tld:port/path, stratum+tcp://server.tld:port, by default http://127.0.0.1:8332
-t threads - Number of threads for CPU mining, 0..256, by default is number of CPUs (Cores), 0 - disable CPU mining
-T temperature - max temperature in Celsius degrees, default: 83
-v - Verbose output
-x type=host:port - Use HTTP or SOCKS proxy. Examples: -x http=127.0.0.1:3128, -x socks=127.0.0.1:1080