Bitcoin mining with a virus or botnet on bitclockers

[CD-RW]

http://www.threatexpert.com/report.aspx?md5=69d0699d6b660db571a63b4b3eac4b7f

This is a virus/botnet. It uses IRC to get and send commands. Sure. But check out the 'bitcoin' command:

Code:

PRIVMSG #insomnia :[BITCOIN]: Downloading ufasoft bitcoin miner...
PRIVMSG #insomnia :[BITCOIN]: Mining started [user='nigger' url='http://pool.bitclockers.com:8332' proc='dnmsal' id='1288']

So it downloads 'http://ufasoft.com/files/open/bitcoin-miner.exe' and uses it to get bitcoins for the botherder.


I hope any bitclockers admins read this and will take appropriate steps.

[1714772228]

1714772228

[1714772228]

1714772228

[1714772228]

1714772228

[1714772228]

1714772228

[xcooling]

Ouch, wouldn't mind looking at the source code for it though.

Could be a nice base to make a remote self updating miner for my multiple machines

[deslok]

BTCguild had "thousands" of cpu miners connect to it after they were removed from the pool(that many cpu's makes a mess of things) they were ddosed for several days i wonder if this is an updated version of that botnet.
on another note how did you get that infromation do you have a computer that was infected with it a sample may be useful in preventing botnets from being a thorn in the side of bitcion in general.

[bal3wolf]

If you have the bot you need to either give it to someone or do it yourself and find the dns they use and report it then that will pretty much kill them with no way to control them any longer.

[V2-V3]

CD-RW ,Thank you for the heads up

This was taken care of by Backburn over at BitClockers not too long ago.

[Boing7898]

I PMed it to Backburner not long time ago but it seems he ignored my pm..

[CD-RW]

on another note how did you get that infromation do you have a computer that was infected with it a sample may be useful in preventing botnets from being a thorn in the side of bitcion in general.

I searched Threatexpert for 'BitCoin' somewhere in the virus, and got a few hits!