New bitcoin trojan installs miner, joins pool

[finack]

Gold rush
Aleks - Kaspersky Lab Expert
Posted June 28, 13:20  GMT

The recent online hysteria over the BitCoin virtual money system has attracted the attention not only of those who dream of making money out of thin air but also of cybercriminals who, as usual, want to steal anything they can get their hands on.

A few days ago our colleagues at F-Secure wrote that they had detected a primitive Trojan that steals e-wallets from the computers of BitCoin users.

However, some cybercriminals seem to think that it’s more profitable to steal computer resources rather than e-wallets.

Today our analysts detected a new threat spreading in the Russian sector of the Internet – Trojan.NSIS.Miner.a. This Trojan has two components – the legitimate bcm.exe file BitCoin Miner (not-a-virus:RiskTool.Win32.BitCoinMiner.a), and a malicious module that installs bcm without the user’s knowledge and adds it to the autorun registry. The infected computer then starts to generate bit-coins for the Trojan’s author.

[continues on to show screenshots of the deepbit mining account and others]

http://www.securelist.com/en/blog/208188132/Gold_rush

[1714804663]

1714804663

[1714804663]

1714804663

[1714804663]

1714804663

[1714804663]

1714804663

[Jack of Diamonds]

That's a pretty pathetic botnet. As you can see from the mhash/s he likely harvested a ton of old CPU's.

[DamienBlack]

Yeah, even if this infected 10,000 computers, I would only expect a handful of them to have a decent graphics card. I you imagine that you could expect an average of 5 mh/s or so from each computer, and each computer would probably only be up and running about 30% of the time.

In the end you'd get 10,000 * 5 * .3 = 15,000 mh/s. That is about 10 BTC/day at the current difficulty, or $170. I'm sure you could earn more doing something mundane like delivering ads.