ufasoft_coin_0.33.exe

The application ufasoft_coin_0.33.exe has been detected as a potentially unwanted program by 14 anti-malware scanners. This is a setup program which is used to install the application. This is a malicious Bitcoin miner. Bitcoin-mining malware is designed to force computers to generate Bitcoins for cybercriminals' use and consumes computing power. The file has been seen being downloaded from ufasoft.com and multiple other hosts.
MD5:
2f9ec1edc31bb39a31389bf80dd67db9

SHA-1:
ad2d97e8f9ef1dc2cec05a62c638567e9c5b9686

SHA-256:
9f4acd05a1a8415a0ba86293dee5a389a4e70cf920841367e0289b55cb2b5622

Scanner detections:
14 / 68

Status:
Potentially unwanted

Explanation:
The program will mine for BitCoins using the computer's GPU in the background and may be installed and run without the user's knowledge.

Analysis date:
5/24/2018 10:59:33 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Riskware.BitCoinMiner
7.1.1

AhnLab V3 Security
Trojan/Win32.BitMiner
14.04.24

Baidu Antivirus
Hacktool.Win32.BitCoinMiner
4.0.3.14424

Dr.Web
Tool.BtcMine.254
9.0.1.0114

ESET NOD32
Win32/BitCoinMiner.AV (variant)
8.9707

Fortinet FortiGate
Riskware/Win64_BitCoinMiner
4/24/2014

K7 AntiVirus
Trojan
13.176.11847

K7 Gateway Antivirus
Trojan
13.176.11847

Kaspersky
not-a-virus:RiskTool.Win64.BitCoinMiner
14.0.0.3968

Malwarebytes
PUP.BitcoinMiner
v2014.04.24.11

McAfee
Artemis!2F9EC1EDC31B
5600.7151

McAfee Web Gateway
Artemis!2F9EC1EDC31B
7.7151

Sophos
Bitcoin Miner
4.98

Trend Micro House Call
TROJ_GEN.R047H07DG14
7.2.114

File size:
3.2 MB (3,349,670 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\ufasoft_coin_0.33.exe

File PE Metadata
Compilation timestamp:
10/1/2013 2:24:53 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
98304:+PE1BCZZVfqyvf5rlCwzaxJ42oXEtdNFquxGZ:H4iCnCXxTXtdNFquxGZ

Entry address:
0x4C36

Entry point:
55, 8B, EC, 83, EC, 44, 68, 0C, 60, 40, 00, 68, 00, 60, 40, 00, E8, 37, 00, 00, 00, 59, 59, 8D, 45, BC, 50, FF, 15, 88, 50, 40, 00, F6, 45, E8, 01, 74, 06, 0F, B7, 45, EC, EB, 03, 6A, 0A, 58, 50, FF, 15, 84, 50, 40, 00, 50, 6A, 00, 6A, 00, FF, 15, 68, 50, 40, 00, 50, E8, 89, F3, FF, FF, 8B, E5, 5D, C3, 8B, 44, 24, 08, 53, 56, 8B, 74, 24, 0C, 33, DB, 2B, C6, 83, C0, 03, C1, E8, 02, 39, 74, 24, 10, 57, 1B, FF, F7, D7, 23, F8, 76, 15, 8B, 06, 85, C0, 74, 07, 83, F8, FF, 74, 02, FF, D0, 83, C6, 04, 43, 3B, DF...
 
[+]

Entropy:
7.9995

Developed / compiled with:
Microsoft Visual C++

Code size:
16 KB (16,384 bytes)

The file ufasoft_coin_0.33.exe has been seen being distributed by the following 2 URLs.

Remove ufasoft_coin_0.33.exe - Powered by Reason Core Security