Cloud Mining A Scam? $5,000 & $40,000 Invested In 2017 | Genesis Mining Review Coingecko Xmr

Cloud Mining A Scam? $5,000 & $40,000 Invested In 2017 | Genesis Mining Review

Exploit Published for Unpatched Flaw in Windows Task Scheduler

Novel Attack Technique Uses Smart Light Bulbs to Steal Data

Windows 10 KB4100347 Intel CPU Update Causing Boot Issues & Pushed to AMD Users

Andromeda Botnet Operator Released With a Slap on the Wrist

Exploit Published for Unpatched Flaw in Windows Task Scheduler

Booz Allen Hamilton Researchers Detail New RtPOS Point-of-Sale Malware

Novel Attack Technique Uses Smart Light Bulbs to Steal Data

OCR Software Dev Exposes 200, Coingecko Xmr

Remove Security Tool and SecurityTool (Uninstall Guide)

How to remove Antivirus 2009 (Uninstall Instructions)

How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo

How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller

CryptorBit and HowDecrypt Information Guide and FAQ

CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ

How to Use Cortana As Your Virtual Assistant in Windows

How to remove a Trojan, Virus, Worm, or other Malware

Most Connected Seagate Central devices infected by Monero Mining Trojan

Most Connected Seagate Central devices infected by Monero Mining Trojan

about a Trojan that installs a cryptocurrency mining program called NsCpuCNMiner32.exe on an infected computer and then spreads itself to other computers and FTP sites. This mining program will mine the digital coin called

, which has become popular among criminal underground sites due to it being less traceable than bitcoin. 

Of particular note, this Trojan has also spread to almost all Internet connected Seagate Central network attached storage devices. This is because the Seagate Central devices by default have a world writable Public folder that if connected to the Internet allows anyone to store files on it.  When the Trojan is executed it will scan the Internet for FTP sites and attempt to login using common user names and passwords.

As the Seagate Central FTP site allows users to access the Public folder using the anonymous username, the infection is able to upload copies of itself as Photo.scr and Info.zip to the Public folder. The Photo.scr will have an icon that makes it appear as a folder in the hopes that people will double-click on it thinking it is a folder and infect themselves.

As part of its self-propogation techniques, the Trojan will also check to see if certain file exist on the compromised FTP sites. If there are, it will modify the following file types so that they include an iframe that points at the Photo.scr executable.

.php,.PHP,.htm,.HTM,.xml,.XML,.dhtm,.DHTM,.phtm,.xht,.htx,.mht,.bml,.asp, .shtm

Then when someone visits the web site, the page will automatically prompt for the download of the Photo.scr executable to spread it further.

The NsCpuCNMiner32 Miner generates a lot of money for the Trojan Devs

Though Sophos' report only indicates that there are 3,150 unique IP addresses associated with this Trojan, it does not mean that malware developers are not making money. According to the report, this software has mined 58,577 XMR, or Monero coins, which at the

of $10.99 per XMR equals approximately $640,000 USD.  Furthermore, Sophos states that their current mining power could potentially allow them to create an additional 327.7 more coins, valued at $3,600, a day,

Monero 30 Day Price Chart - Source: https://www.coingecko.com

As can be seen by the price chart above, Monero has seen significant growth over the past month. Whether this is due to its acceptance by the criminal underground is unknown, but if criminals decide to switch to Monero for ransomware payments it could push the price even higher.

Mining Trojans can cause actual damage to a Computer Coingecko Xmr

When this Trojan mines Monero coins, it will use the victim's CPU processing power. It does this by extracting the NsCpuCNMiner32.exe to the victim's %Temp% folder and then executing it with the following command:

%Temp%\NsCpuCNMiner32.exe  -dbg -1 -o stratum+tcp://mine.moneropool.com:3333 -t 1 -u 44puJ9e27jyKc1et48J7SZLQ4pDcos96c6u84vcwHgCCce1TYqXxzpyR3gY793D9mKGEY7WjtC6TKA7eDbtvfrgGHoDNBGx -p x

Once started, the miner will use as much of the computer's CPU power at all times!

Not only does this cause the computer to become almost unusable, but could also cause damage to the processor due to the heat generated and its constant use.  Therefore, it is important that victims remove this Trojan as soon as possible.

Coinhive Raking In Over $250,000 per Month From In-Browser Cryptomining

First-Ever Person Sentenced for Malicious Use of Coinhive Library

Atlas Quantum Cryptocurrency Investment Platform Suffers Data Breach

Lazarus Group Deploys Its First Mac Malware in Cryptocurrency Exchange Hack

Built-in Ethereum Payments Coming to Opera Browser for PC

Lawrence Abrams is the creator and owner of BleepingComputer.com. Lawrence's area of expertise includes malware removal and computer forensics. Lawrence Abrams is a co-author of the Winternals Defragmentation, Recovery, and Administration Field Guide and the technical editor for Rootkits for Dummies.

Windows 10 KB4100347 Intel CPU Update Causing Boot Issues & Pushed to AMD Users

Ubuntu and CentOS Are Undoing a GNOME Security Feature Coingecko Xmr