https://remoteindian.com/ logo
Join Slack
Powered by
I checked network requests on my system and some a...
# tribe
f
I checked network requests on my system and some app has recenty started mining crypto in the background. I don't have any shady apps installed on my system. Laptop hasn't been going to sleep since 2 days and my CPU is choked up. I am surprised my Antivirus didn't catch the app on its own. How can I track and remove the app?
😳 2
😐 2
m
Probably some browser extension
Or maybe another device in the network not owned by you :) check for IP and see what device corresponds to the ip
f
Checked the IP. It's my laptop. No new or shady browser extensions too. 😭
q
Which app did you use to check the network requests? And which OS?
f
Not app. I have a network wide PiHole - https://pi-hole.net/
OS is Windows 10
m
is it running all the time? What AV are you using? Can you check iwth MalwareBytes Anti Malware?
you should look at the top CPU consuming processes from resource monitor https://www.ghacks.net/2017/12/28/a-detailed-windows-resource-monitor-guide/
that will give you the app name which is eating up
a
1. Block the domain in your hosts file 2. Check for processes taking up significant usage in resources monitor as pointed out above 3. Find and install a network monitor app that would point you to the process initiating the request. Not sure if wireshark does this
b
Blacklist them on pihole, you can find some curated gist online
f
Yeah, I've added an entire crypto mining blacklist to pihole. But the problem is that it'll only block network requests. The app is still running in background eating cpu cycles.
Installed malwarebytes. Let's see if it finds anything
@flat-morning-91037 I suspect the miner app came bundled with the BOTW emulator package. You might to scan your system too if you installed it.
f
😱 I did run it through my scanner, but probably the newer version Cemu (Aug '21) seems to be a culprit, also, how did it end up getting installed in your system? 🤔 The BoTW emulator is entirely portable and shouldn't require installation besides just zip uncompress. I do have PiHole configured on my home network and no suspicious activity there too. It is worth noting that BoTW PC version I'm running was download over a year ago.
On a side note, Nintendo making sure you play their games only on Switch. 😂
🤣 1
f
My package was a full-on windows installer. Not a portable zip 😭
b
Doesn't it require an active connection to the pool to keep mining, I haven't mined any alt coins in a decade so I could be wrong.
d
Boot in safe mode, enable apps one by one to see when mining starts up again
l
@faint-energy-11966 What was the package name? I also tried one package. There is certainly no problem with my system.
f
Will DM you with the link. I am only speculating at the moment. I checked log history and the requests only started after I installed the package. So I thought it might have installed something shady.
m
f
I don't have Norton. Bitdefender and Malwarebytes
Hey guys, Bumping up this thread as I still need help with the crypto mining malware. I ran deep scans using Bitdefender and MalwareBytes and both of them didn't find anything. Is there any way to check which app/service installed on my system is pinging the mining domain?
f
You can check in WireShark to see what’s hitting which URLs
m
b
I know you are using different vendors, but can't say what happens these days
f
It was bundled in the Emulator package. As mentioned in the reddit thread that Mithun linked 😭
m
lol
f
Does uninstalling Cemu removes the miner too? As typically malware don't add registery entries (thus don't show up on Add or Remove Programs list of Control Panel).
f
Uninstalled everything. Even deleted directories for Cemu and Yuzu in %APPDATA% As per the reddit thread, it infects only 1 in 10000s of people to evade detection. I was the unlucky one 🤐
😆 2
f
Ah, then WireShark might help if you know which URLs it is hitting for mining.
l
@faint-energy-11966 I got the installer from the link you sent me earlier. I installed it in isolated VM while watching it's activity under Process Explorer tool. I also tried to extract strings from the binary files to search for "nicehash" domain mentioned in the picture. I tried wireshark http filter with the domain . I tried scanning the installer with Kaspersky. None of these yield anything for me. Setup went successfully without any problem and I'm not seeing any cpu spikes in the VM.
f
@lemon-knife-94497 Read the reddit thread linked by Mithun. It only affects 1 in several thousands of people. Supposedly done on purpose to evade detection. The guy describes exactly what happened to me. He downloaded a BoTW package by the same "publisher"
Some good news "hopefully". It seems after deleting the skeleton folders for cemu and yuzu and rebooting the system, the crypto miner is gone. Don't see any requests on network logs and laptop is also going to sleep now. I suppose a reboot was needed after deleting the folders since the miner was still in memory. Thanks everyone for helping 🙂
c
Sorry about grave digging. I used to use hijackthis when I was helping people with getting rid of malware. It has good logging and shows detailed list of programs and processes.
3 Views
Open in Slack
PreviousNext
Powered by