The Miner Botnet: Bitcoin Mining Goes Peer-To-Peer

Identifying a botnet is not an easy task sometimes, especially when one gets lost in different components like droppers, infectors and other bad stuff. Some two weeks ago, Jose Nazario from Arbor Networks pointed me to a new varmint that appears to be another peer-to-peer bot. When executed, the program installs tons of stuff that holds a number of goodies, for example

• an executable hidden in an Alternate Data Stream,
• three Bitcoin miners: the Ufasoft miner, the RCP miner and the Phoenix miner,
• a file with geo-location information for IP address ranges.

However, we leave these aside for now and focus on the botnet's architecture instead, which is really just a channel for pushing software to infected machines. Scrabbling about in the installed programs finally brought up the actual bot, which we detect as Trojan.Win32.Miner.h. The binary has some layers of obfuscation to make analysis harder but eventually writes a UPX packed executable into a memory section from where to original binary can be restored.

nod32 keyleri güncel güncel nod32 keyleri nod32 guncel keyler nod32 guncel key