Report - github.com/Lolliedieb/lolMiner-releases/releases/download/1.94a/lolMiner_v1.94a

Report Overview

Visited public
2025-02-01 04:04:11
Tags
Submit Tags
URL
github.com/Lolliedieb/lolMiner-releases/releases/download/1.94a/lolMiner_v1.94a_Win64.zip
Finishing URL
about:privatebrowsing
IP / ASN
140.82.121.4
#36459 GITHUB
Title
about:privatebrowsing

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
objects.githubusercontent.com	134060	2014-02-06	2021-11-01	2025-01-29	980 B	12 MB	185.199.109.133
github.com	1423	2007-10-09	2016-07-13	2025-01-29	555 B	4.4 kB	140.82.121.4

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
objects.githubusercontent.com/github-production-release-asset-2e65be/155006859/a1160e24-7346-4219-b015-8c73cb90f5b1?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250201%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250201T040339Z&X-Amz-Expires=300&X-Amz-Signature=9d369c07f675bcdd8ae42d87f29c65b9d96b3d39716b9ba77cbc980dac2fe4d0&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3DlolMiner_v1.94a_Win64.zip&response-content-type=application%2Foctet-stream
IP
185.199.109.133
ASN
#54113 FASTLY

File type
Zip archive data, at least v1.0 to extract, compression method=store
Size
12 MB (11800540 bytes)
Hash
c96287a3fc28747ee7ecd0b82a8635b5
7e81097a8f788479d0b6695f963cdeae4c42ecd7
ceba39ae10a6f3779d1cf950117a96e83431c4492ea36bb5586f7f07ee31561f

Archive (46)

Filename

Md5

File type

mine_grin_32.bat

2af46759eb206d32b82ff3ed223a614a

DOS batch file, ASCII text

readme.txt

d73a2f0b1fe720ca978b31c558be6281

ASCII text, with CRLF line terminators

dual_mine_rth_aleph.bat

700a0d9e9e5b954e9563d046dd42535f

DOS batch file, ASCII text

dual_mine_ethw_aleph_lhr_admin.bat

fa115e99fcd18bdea058b92699fcdc3a

HTML document, ASCII text

mine_ironfish.bat

af579d0b98bb120effbb51d59534a102

DOS batch file, ASCII text

dual_mine_etc_aleph_herominer.bat

6b75e3692152f1abb7ce66660bec5dc2

DOS batch file, ASCII text

examples_windows_with_compute_mode.zip

8420fb7fd818aacba189830a66e3aa61

Zip archive data, at least v2.0 to extract, compression method=store

mine_nexa.bat

2b76b11a61fbc2c7543eceff3dfa7a4f

DOS batch file, ASCII text

mine_aleph.bat

02630d1aa3693a06a14e5217a08cf591

DOS batch file, ASCII text

dual_mine_rth_rxd.bat

928f3e5b66379b19ba640f6d4acb0695

DOS batch file, ASCII text

emergency.bat

cd27c7594b633e6406ee05dea1a66f3d

ASCII text, with CRLF line terminators

dual_mine_rth_kls.bat

ca5457d0cba7c903ee97716290d6e86a

DOS batch file, ASCII text

mine_radiant.bat

4b8dc32769623537ec1266e1db49681b

DOS batch file, ASCII text

dual_mine_etc_aleph_woolypooly.bat

d1ce86bd6f32a99c3a8903ab65f082e3

DOS batch file, ASCII text

mine_ubq.bat

3b9831e4ea3600d0c6c0562124c2d387

DOS batch file, ASCII text, with CRLF line terminators

mine_karlsen.bat

eb06285282db7853df640b4752c8e4a7

DOS batch file, ASCII text

mine_flux.bat

dd96099799fcfb1572812f8c0b33f458

DOS batch file, ASCII text, with CRLF line terminators

mine_ergo.bat

77d0da59893e3bc9d072f01b19dce8a5

DOS batch file, ASCII text, with CRLF line terminators

lolMiner.cfg

0384e431a88420956339084fa4e6211b

ASCII text

dual_mine_etc_aleph_lhr_admin.bat

a06dbf81a558578e979bab8e4355cebf

HTML document, ASCII text

mine_eth_lhr_admin.bat

ef58b3cddc53e5297e84496bf06937a4

HTML document, ASCII text, with CRLF line terminators

mine_eth.bat

af6d0db3589e54ae8898295a440ea007

DOS batch file, ASCII text, with CRLF line terminators

dual_mine_ethw_aleph_herominer.bat

c1ad9f6190f0e42d6ba619300520e453

DOS batch file, ASCII text

mine_ethw.bat

953872c61aede10c79518d1f63bbdd8a

DOS batch file, ASCII text, with CRLF line terminators

mine_flux_admin.bat

94d070f53ae12f8c37d632d153e716ce

HTML document, ASCII text

mine_beam.bat

107ef71d3f2c17089dfd80a0c8e0dac9

DOS batch file, ASCII text, with CRLF line terminators

license.txt

de38c0740e1802e937e8dbe923114b02

ASCII text, with CRLF line terminators

mine_bittube.bat

01179d4525aa21ead7cf505ea5aea0b3

DOS batch file, ASCII text, with CRLF line terminators

dual_mine_ethw_aleph_woolypooly.bat

b9a8010dc5a14d9d6b662a46a354c89b

DOS batch file, ASCII text

mine_rth.bat

b487644e61345d15ef5073efee86be02

DOS batch file, ASCII text

mine_cortex.bat

b5efc2e02b481b62fef7a1acb1ecf7d9

DOS batch file, ASCII text, with CRLF line terminators

mine_nexa_with_oc.bat

ebbae30972afc597a6c969125be86215

HTML document, ASCII text

msvcp140.dll

0929e46b1020b372956f204f85e48ed6

PE32+ executable (DLL) (console) x86-64, for MS Windows, 6 sections

lolMiner.exe

9c6ca1ba294e0287e9d35cb1dd81a2af

PE32+ executable (console) x86-64, for MS Windows, 3 sections

mine_gram.bat

6f21a85031161a71cc275b0082b513f6

DOS batch file, ASCII text

triple_mine_zil_etc_aleph.bat

335d051b1e354252ef672a41e0c56b06

DOS batch file, ASCII text, with CRLF line terminators

mine_ae.bat

f1f7f875d256d9c63e884a9adbf241eb

DOS batch file, ASCII text, with CRLF line terminators

mine_btg.bat

310abbf90405dc85b88a2d0cf44728ba

DOS batch file, ASCII text, with CRLF line terminators

mine_ironfish_gram.bat

85980f2b25cb9293a01c4f359d7306ee

DOS batch file, ASCII text

mine_pyrin.bat

b4c8188cf0887bdd362ad0702bb0d6a5

DOS batch file, ASCII text

triple_mine_zil_ethw_aleph.bat

f37add8ab4c6d6b7f5d62f829b26efbd

DOS batch file, ASCII text, with CRLF line terminators

mine_conflux.bat

0d71d9706db9136e3b7d025c8da98ac9

DOS batch file, ASCII text

lolMinerGUI.exe

f5ad30ee8537a12c4c41d138ea9bfebe

PE32+ executable (GUI) x86-64, for MS Windows, 7 sections

mine_etc.bat

9534cdffe959545e142af1934dfb81e4

DOS batch file, ASCII text, with CRLF line terminators

mine_ethw_lhr_admin.bat

615ef1180a83752d04873c872895cc38

HTML document, ASCII text, with CRLF line terminators

mine_zcl.bat

f4c601c5ec7be3d43b1a959a2a09790a

DOS batch file, ASCII text, with CRLF line terminators

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	files - file ~tmp01925d3f.exe
VirusTotal	malicious	VirusTotal - Scan result 39/65
ClamAV	malicious	Win.Coinminer.lolMiner-10007385-0

JavaScript (0)

HTTP Transactions (2)

URL IP Response Size

GET github.com/Lolliedieb/lolMiner-releases/releases/download/1.94a/lolMiner_v1.94a_Win64.zip

140.82.121.4

302 Found

0 B

URL User Request GET HTTP/2
github.com/Lolliedieb/lolMiner-releases/releases/download/1.94a/lolMiner_v1.94a_Win64.zip
IP
140.82.121.4:443
ASN
#36459 GITHUB

Certificate
IssuerSectigo Limited
Subjectgithub.com
FingerprintE7:03:5B:CC:1C:18:77:1F:79:2F:90:86:6B:6C:1D:F8:DF:AA:BD:C0
ValidityThu, 07 Mar 2024 00:00:00 GMT - Fri, 07 Mar 2025 23:59:59 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /Lolliedieb/lolMiner-releases/releases/download/1.94a/lolMiner_v1.94a_Win64.zip HTTP/1.1
Host: github.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
server: GitHub.com
date: Sat, 01 Feb 2025 04:03:39 GMT
content-type: text/html; charset=utf-8
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
location: https://objects.githubusercontent.com/github-production-release-asset-2e65be/155006859/a1160e24-7346-4219-b015-8c73cb90f5b1?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250201%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250201T040339Z&X-Amz-Expires=300&X-Amz-Signature=9d369c07f675bcdd8ae42d87f29c65b9d96b3d39716b9ba77cbc980dac2fe4d0&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3DlolMiner_v1.94a_Win64.zip&response-content-type=application%2Foctet-stream
cache-control: no-cache
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/
content-length: 0
x-github-request-id: 819E:20B2EB:2900C36:2A8C258:679D9D1B
X-Firefox-Spdy: h2

GET objects.githubusercontent.com/github-production-release-asset-2e65be/155006859/a1160e24-7346-4219-b015-8c73cb90f5b1?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250201%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250201T040339Z&X-Amz-Expires=300&X-Amz-Signature=9d369c07f675bcdd8ae42d87f29c65b9d96b3d39716b9ba77cbc980dac2fe4d0&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3DlolMiner_v1.94a_Win64.zip&response-content-type=application%2Foctet-stream

185.199.109.133

200 OK

12 MB

URL User Request GET HTTP/2
objects.githubusercontent.com/github-production-release-asset-2e65be/155006859/a1160e24-7346-4219-b015-8c73cb90f5b1?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250201%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250201T040339Z&X-Amz-Expires=300&X-Amz-Signature=9d369c07f675bcdd8ae42d87f29c65b9d96b3d39716b9ba77cbc980dac2fe4d0&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3DlolMiner_v1.94a_Win64.zip&response-content-type=application%2Foctet-stream
IP
185.199.109.133:443
ASN
#54113 FASTLY

Certificate
IssuerDigiCert Inc
Subject*.github.io
Fingerprint97:D8:C5:70:0F:12:24:6C:88:BC:FA:06:7E:8C:A7:4D:A8:62:67:28
ValidityFri, 15 Mar 2024 00:00:00 GMT - Fri, 14 Mar 2025 23:59:59 GMT

File type
Zip archive data, at least v1.0 to extract, compression method=store
Size
12 MB (11800540 bytes)
Hash
c96287a3fc28747ee7ecd0b82a8635b5
7e81097a8f788479d0b6695f963cdeae4c42ecd7
ceba39ae10a6f3779d1cf950117a96e83431c4492ea36bb5586f7f07ee31561f

Detections

Analyzer	Verdict	Alert
VirusTotal	malicious	VirusTotal - Scan result 39/65
ClamAV	malicious	Win.Coinminer.lolMiner-10007385-0

HTTP Headers

GET /github-production-release-asset-2e65be/155006859/a1160e24-7346-4219-b015-8c73cb90f5b1?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250201%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250201T040339Z&X-Amz-Expires=300&X-Amz-Signature=9d369c07f675bcdd8ae42d87f29c65b9d96b3d39716b9ba77cbc980dac2fe4d0&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3DlolMiner_v1.94a_Win64.zip&response-content-type=application%2Foctet-stream HTTP/1.1
Host: objects.githubusercontent.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: application/octet-stream
last-modified: Wed, 29 Jan 2025 11:02:00 GMT
etag: "0x8DD40545B2A42CD"
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: 6ba8a66e-301e-0053-5b3f-72c261000000
x-ms-version: 2025-01-05
x-ms-creation-time: Wed, 29 Jan 2025 11:02:00 GMT
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
content-disposition: attachment; filename=lolMiner_v1.94a_Win64.zip
x-ms-server-encrypted: true
via: 1.1 varnish, 1.1 varnish
fastly-restarts: 1
accept-ranges: bytes
age: 3397
date: Sat, 01 Feb 2025 04:03:40 GMT
x-served-by: cache-iad-kjyo7100044-IAD, cache-hel1410028-HEL
x-cache: HIT, HIT
x-cache-hits: 445, 0
x-timer: S1738382620.000207,VS0,VE99
content-length: 11800540
X-Firefox-Spdy: h2

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (46)

Detections

JavaScript (0)

HTTP Transactions (2)

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers