1. Which specific VirusTotal detections were considered evidence of malware?
XMRIG source code is often marked red by virustotal, even considered dangerous malware, but I report here according to the results reported above, plus marked like this.
The sandbox Zenbox flags this file as: MALWARE EVADER
I refer to this source.
Evader malware is specifically designed to avoid detection by antivirus software and other security measures. It employs techniques such as code obfuscation, encryption, and polymorphism to hide its presence and actions from security systems, making it difficult to detect and remove.
Maybe I'm wrong, I reported as per my knowledge.
Thank you for explaining. I understand that you submitted the report in good faith based on the information
available to you. However, after checking the evidence, I do not believe that the Zenbox label alone is sufficient
to establish that Kadikama Miner contains malware.
The following SHA-256 belongs to the official Xmrig 6.26.0 Windows x64 archive:
bba8097cb37d9b458a1cb1137876b27cde6740d17fe4ccbc086ba07d87d9e147
Official XMRig release:
https://github.com/xmrig/xmrig/releases/tag/v6.26.0VirusTotal behavior report:
https://www.virustotal.com/gui/file/bba8097cb37d9b458a1cb1137876b27cde6740d17fe4ccbc086ba07d87d9e147/behaviorThis is not an unknown third-party XMRIG build: the exact hash is published in the official release’s SHA256,
which is also accompanied by a GPG signature. Nevertheless, Zenbox assigns the same MALWARE EVADER classification to
it.
The Xygeni page you quoted provides a general definition of evader malware. It does not demonstrate that Kadikama
Miner contains obfuscation, polymorphism, credential theft, persistence, an additional payload or any other specific
malicious functionality.
This comparison does not prove by itself that the Kadikama binary is safe. It does, however, demonstrate that the
Zenbox label is not unique to Kadikama Miner and cannot by itself distinguish an official cryptocurrency miner from
a miner containing additional malicious code.
I therefore invite you to verify it directly:
1) Review the public Kadikama Miner source code and compare it with upstream XMRIG
2) Compile the miner yourself from the published source
3) Submit your locally compiled binary to Virustotal
4)Identify any specific malicious behavior or added source-code section unique to the Kadikama fork
Kadikama Miner source:
https://github.com/kadikamateam/kadikama-minerA locally compiled file may have a different hash because of the compiler and build environment, but its source
changes and actual behavior can still be independently inspected.
If you find any malicious addition, please identify the relevant file, source-code lines and behavior so that it can
be investigated. If no such addition is found, I respectfully ask you to update your report and inform the moderator
that the original conclusion was based on a non-specific automated sandbox classification.
If distributing compiled mining binaries is the main concern, I am also willing to remove the binary links and
provide only the public source code and compilation instructions.
