Home / malware

PDF

PUA:Win32/CoinMiner

First posted on 05 July 2016.
Source: Microsoft

Aliases :

There are no other names known for PUA:Win32/CoinMiner.

Explanation :

Installation

This application can be downloaded from websites that offer third-party software downloads. For example, we have seen it downloaded from:

• websvc.tubehelper.net
• ru-dogecoin.ru

We have seen this application use the following file names:

• setup.exe
• TubeHelperSetup_2.exe
• cpuminer_x64_SSE2.exe
• cpuminer_x64_AVX2.exe
• cpuminer_x64_AVX.exe
• EpicScale.exe
• setup-converterlite-1.6.4-refam.exe
• setup.2.0.7.exe
• libcurl-4.dll

It can be digitally signed by the following vendors:

• JProof LLC
• Epic Scale, Inc.
• White Sea Media
• Synaps Proekt, TOV
• M/s Children Code

We have seen this application using product names such as:

• EpicScale
• SG Miner
• Setup Factory Runtime

This application communicates with domains such as:

• dc1.rightsnetwork.net
• acinfo.exosettings.com
• dc1.tubehelper.net
• update.rightsnetwork.net
• info.rightsnetwork.net

For example:

• dc1.rightsnetwork.net/rightsplugin/dc/dc.php?
• acinfo.exosettings.com/acc.php?
• dc1.tubehelper.net/dc/dc.php?

Payload

Installs other programs

We have seen this application install other software on your PC. Some of these applications might be bundled during the installation process and not intended to be installed. We have seen it installing programs such as:

• 35MM
• Sniper Elite 3
• The Saboteur version 1.03
• 写作猫 1.3.1
• 武神赵子龙

This description was published using automated analysis.

Last update 05 July 2016

 

TOP