Bitcoin mining with a virus or botnet on bitclockers

CD-RW

jr. member

Activity: 56

Merit: 22

Quote from: deslok on July 20, 2011, 06:55:58 PM

on another note how did you get that infromation do you have a computer that was infected with it a sample may be useful in preventing botnets from being a thorn in the side of bitcion in general.

I searched Threatexpert for 'BitCoin' somewhere in the virus, and got a few hits!

Boing7898

sr. member

Activity: 686

Merit: 259

I PMed it to Backburner not long time ago but it seems he ignored my pm..

V2-V3

full member

Activity: 227

Merit: 100

CD-RW ,Thank you for the heads up

This was taken care of by Backburn over at BitClockers not too long ago.

bal3wolf

sr. member

Activity: 476

Merit: 250

Power to the people!

If you have the bot you need to either give it to someone or do it yourself and find the dns they use and report it then that will pretty much kill them with no way to control them any longer.

deslok

sr. member

Activity: 462

Merit: 250

It's all about the game, and how you play it

BTCguild had "thousands" of cpu miners connect to it after they were removed from the pool(that many cpu's makes a mess of things) they were ddosed for several days i wonder if this is an updated version of that botnet.
on another note how did you get that infromation do you have a computer that was infected with it a sample may be useful in preventing botnets from being a thorn in the side of bitcion in general.

xcooling

member

Activity: 145

Merit: 10

Ouch, wouldn't mind looking at the source code for it though.

Could be a nice base to make a remote self updating miner for my multiple machines

CD-RW

jr. member

Activity: 56

Merit: 22

http://www.threatexpert.com/report.aspx?md5=69d0699d6b660db571a63b4b3eac4b7f

This is a virus/botnet. It uses IRC to get and send commands. Sure. But check out the 'bitcoin' command:

Code:

PRIVMSG #insomnia :[BITCOIN]: Downloading ufasoft bitcoin miner...
PRIVMSG #insomnia :[BITCOIN]: Mining started [user='nigger' url='http://pool.bitclockers.com:8332' proc='dnmsal' id='1288']

So it downloads 'http://ufasoft.com/files/open/bitcoin-miner.exe' and uses it to get bitcoins for the botherder.

I hope any bitclockers admins read this and will take appropriate steps.

Topic: Bitcoin mining with a virus or botnet on bitclockers (Read 6116 times)