Home Possibly Unwanted Program CpuMiner

CpuMiner

Posted: April 10, 2015

Threat Metric

Ranking: 10,442
Threat Level: 1/10
Infected PCs: 47,282
First Seen: April 10, 2015
Last Seen: March 1, 2025
OS(es) Affected: Windows


CpuMiner is a Potentially Unwanted Program (PUP) that may enter silently and take advantage of the user's machine for the benefits of its developers. This questionable application is a BitCoin miner. CpuMiner uses the CPU and the video card of the computer to maintain the infrastructure of this cryptocurrency. As a universal rule, the owner of the device should receive certain commissions for keeping the network alive. However, this PUP is not created to share the profits with you. All revenue will go towards its developers, so they are virtually taking advantage of your machine. The security researchers have confirmed that CpuMiner may travel via the well-known bundling method. CpuMiner may be deployed to your system by third-party freeware. If you conduct the setup procedure via the 'Quick' menu, you may receive no clues whatsoever that CpuMiner is about to enter. Fortunately, if you rely on the 'Advanced' menu, you may be able to uncheck its box manually. The description that you may notice is pretty brief – it says CpuMiner is a BitCoin miner. However, some users may not expect CpuMiner to have such an unfavorable impact on their machines, so they may still agree to load it. This suspicious application may use a significant part of the available resources. The experts have determined that CpuMiner may seize for its processes over 30% of your CPU's capabilities and graphic's card power. This means that you may be unable to use that portion of their potential for other purposes. Your applications may start running sluggishly if they launch at all. The possible higher resource consumption means a higher electricity consumption as well, which may mean a higher bill. It is important to note that CpuMiner functions whenever your PC is switched on. Your hardware will have no time to 'rest' and cool itself, so the PC may start generating a lot of heat. This issue may damage some components. If your machine starts working sluggishly, you should run a full system scan with a powerful security utility to delete CpuMiner immediately.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%SYSTEMDRIVE%\Users\<username>\AppData\Local\Temp\RarSFX0\keygen-pr.exe File name: keygen-pr.exe
Size: 1.82 MB (1827316 bytes)
MD5: 3a82e425e5086fd8072c5b1862b8906f
Detection count: 386
File type: Executable File
Mime Type: unknown/exe
Path: %SYSTEMDRIVE%\Users\<username>\AppData\Local\Temp\RarSFX0\keygen-pr.exe
Group: Malware file
Last Updated: April 15, 2024
D:\download\Rebelbetting.3.5.1010.2904.keygen.exe\Rebelbetting.3.5.1010.2904.keygen\keygen-p.exe File name: keygen-p.exe
Size: 1.74 MB (1747908 bytes)
MD5: 57107b565d0c3c6ca2fafc394de8d78c
Detection count: 138
File type: Executable File
Mime Type: unknown/exe
Path: D:\download\Rebelbetting.3.5.1010.2904.keygen.exe\Rebelbetting.3.5.1010.2904.keygen\keygen-p.exe
Group: Malware file
Last Updated: February 1, 2023
%WINDIR%\system32\cpuminer-gw64.exe File name: cpuminer-gw64.exe
Size: 4.24 MB (4240616 bytes)
MD5: 50e7271bca167d94a4bb76db523a2302
Detection count: 129
File type: Executable File
Mime Type: unknown/exe
Path: %WINDIR%\system32
Group: Malware file
Last Updated: May 10, 2016
%TEMP%\RarSFX2\key.exe File name: key.exe
Size: 59.9 KB (59904 bytes)
MD5: 941a87b716aa7358ba05fb9375ab0630
Detection count: 9
File type: Executable File
Mime Type: unknown/exe
Path: %TEMP%\RarSFX2
Group: Malware file
Last Updated: April 10, 2020
C:\TMP\mdi064.dll File name: mdi064.dll
Size: 3.99 MB (3998720 bytes)
MD5: 911d846de9a854d93028f9d9e8db479a
Detection count: 5
File type: Dynamic link library
Mime Type: unknown/dll
Path: C:\TMP
Group: Malware file
Last Updated: February 25, 2016

More files

Registry Modifications

The following newly produced Registry Values are:

Regexp file mask%TEMP%\cpuminer\cpm.exe%TEMP%\cpuminer\cpuminer-conf.json%TEMP%\mdi064.dll%WINDIR%\System32\cpuminer-conf.jsonHKEY..\..\..\..{RegistryKeys}SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpuminerHKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}cpuminergpuminer

Additional Information

The following directories were created:
%APPDATA%\vnlgp%appdata%\cpuminer
Loading...