| 在线病毒检测器 | v.1.0.184.174 |
| 数据库版本: | 2024-08-14 04:00:38 |
CoinMiner是一种利用受害者的计算机资源（主要是CPU和RAM）进行加密货币挖掘（例如Monero或Zcash）的恶意软件。此恶意软件通过将开源挖掘工具集成到系统的启动例程中来建立持久性，而不需要用户的同意。高级的加密货币挖掘程序通常采用定时器配置或CPU使用限制等技术，以悄悄运行并避免检测。
| File | ThunderAimV2.04 - version-6fdcfe060c6440cd.exe |
| 已检查 | 2024-08-14 01:52:52 |
| MD5 | 56d757516c7563d515a8e5ff827a11bd |
| SHA1 | 2b73ff7ea3488e3009e21bd70a9df0b8de28a2fa |
| SHA256 | 43a1fce91f24121560b982cf6d9a069f6135194c001bec3e5e5744bf773693c7 |
| SHA512 | 444ebfb4f416ef4fe88b49633eedf7bf2e3a58b755cdd7e36697816e126b43c85657916c46603ee323c4cc7df7df12e7c300b03fef6834dcdd0ea5091d6625a7 |
| Imphash | 80af600ced07099fa0a7ac7c7ce0400d |
| File Size | 1342464 bytes |
Gridinsoft能够识别并消除Trojan.Win64.CoinMiner.sa，无需进一步的用户干预。
| Image Base: | 0x140000000 |
| Entry Point: | 0x14007364c |
| Compilation: | 2024-08-07 20:27:22 |
| Checksum: | 0x00000000 (Actual: 0x00152cd0) |
| OS Version: | 6.0 |
| PDB Path: | C:\Users\rabin\Desktop\ThunderAimv2\ThunderAimV2\Build\chaos.pdb |
| PEiD: | PE32+ executable (console) x86-64, for MS Windows |
| Sign: | The PE file does not contain a certificate table. |
| Sections: | 6 |
| Imports: | WINMM, KERNEL32, USER32, GDI32, ADVAPI32, SHELL32, MSVCP140, ntdll, dbghelp, d3d11, IMM32, D3DCOMPILER_43, dwmapi, d3dx11_43, VCRUNTIME140_1, VCRUNTIME140, api-ms-win-crt-stdio-l1-1-0, api-ms-win-crt-heap-l1-1-0, api-ms-win-crt-runtime-l1-1-0, api-ms-win-crt-string-l1-1-0, api-ms-win-crt-environment-l1-1-0, api-ms-win-crt-utility-l1-1-0, api-ms-win-crt-time-l1-1-0, api-ms-win-crt-filesystem-l1-1-0, api-ms-win-crt-convert-l1-1-0, api-ms-win-crt-math-l1-1-0, api-ms-win-crt-locale-l1-1-0, |
| Exports: | 1 |
| Resources: | 1 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | MD5 | 熵 |
|---|---|---|---|---|---|
| .text | 0x00001000 | 0x0007735f | 0x00077400 | 8f33e6d4e32603227ce04dd6cb238100 | 6.51 |
| .rdata | 0x00079000 | 0x0001e2dc | 0x0001e400 | 30654723c639ad6464a97214682d9ce3 | 6.02 |
| .data | 0x00098000 | 0x000b0340 | 0x000ae400 | 9ca36fff2e975fdc9a7f0effa5c111e4 | 6.63 |
| .pdata | 0x00149000 | 0x00003228 | 0x00003400 | 0e6c14fcfc3306e76bb14f76b3b83a5f | 5.63 |
| .rsrc | 0x0014d000 | 0x000001e8 | 0x00000200 | 6fc1061792bb3e9cfa8e2e8cc4fab356 | 4.77 |
| .reloc | 0x0014e000 | 0x000005a8 | 0x00000600 | 2fe578222c365d9a969019cc409bcf2c | 5.14 |
