A forum for reverse engineering, OS internals and malware analysis 

Riskware/Miner

Forum for analysis and discussion about malware.

Re: Malware collection

 #31006  by Xylitol
 Sat Nov 18, 2017 1:18 pm
JS/Miner, can be unwanted but not really sure about categorizing it as malware, just disable javascript on your browser, it's the only recommendation i can do.
if you can't and need plugins:
Chrome: https://chrome.google.com/webstore/deta ... hdbolnfimo
Firefox: https://addons.mozilla.org/en-US/firefo ... coinblock/

coinhive running via node-js, show slightly better performance than running on browser (about +5 h/s) but overall solo-mining via javascript not worth it.
Image

Re: Malware collection

 #31255  by markusg
 Sun Feb 11, 2018 5:23 pm
VirusTotal
SHA256:
5c13ceefbf24c9d248a91273066247350992ff2d86dd7c1fb5375ae71c83f6ab
Dateiname:
Youtube_byclick_Setup.exe
Erkennungsrate:
21 / 66
https://www.virustotal.com/de/file/5c13 ... /analysis/
my connection is bit slow for the next 1 week and the upload was canceled but if somebody want he can attach the file
a miner i think
https://www.dropbox.com/s/7rgorb5yxamxs ... up.7z?dl=1

Re: Malware collection

 #31259  by Antelox
 Sun Feb 11, 2018 8:00 pm
markusg wrote:VirusTotal
SHA256:
5c13ceefbf24c9d248a91273066247350992ff2d86dd7c1fb5375ae71c83f6ab
Dateiname:
Youtube_byclick_Setup.exe
Erkennungsrate:
21 / 66
https://www.virustotal.com/de/file/5c13 ... /analysis/
my connection is bit slow for the next 1 week and the upload was canceled but if somebody want he can attach the file
a miner i think
https://www.dropbox.com/s/7rgorb5yxamxs ... up.7z?dl=1
Yes, it drops a miner.

BR,

Antelox

Re: Malware collection

 #31310  by tomatto007
 Sat Mar 03, 2018 10:37 am
markusg wrote:Download & Extract Here.exe
SHA-256
f54a78aa6d90eaa44a0cd757f90e649219207150f2c89ae0431bae150a1d6268
https://www.virustotal.com/#/file/f54a7 ... 68/details
miner?
FILES ADDED:
%COMMON APPDATA%\SRSLABS\CMD.EXE
%COMMON APPDATA%\SRSLABS\CONFIG.JSON
%COMMON APPDATA%\SRSLABS\CONHOST.EXE
%COMMON APPDATA%\SRSLABS\WSCRIPTTARGET.EXE
%STARTUP%\MICROHOSTLAB.LNK (start conhost.exe)
%STARTUP%\SOFTCONTROL.LNK (start cmd.exe)
 Return to “Malware”