{"id":24973,"date":"2013-05-21T15:11:21","date_gmt":"2013-05-21T22:11:21","guid":{"rendered":"http:\/\/blogs.mcafee.com\/?p=24973"},"modified":"2025-05-29T03:26:34","modified_gmt":"2025-05-29T10:26:34","slug":"delving-deeply-into-a-bitcoin-botnet","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/delving-deeply-into-a-bitcoin-botnet\/","title":{"rendered":"Delving Deeply Into a Bitcoin Botnet"},"content":{"rendered":"<p>Bitcoin is a virtual decentralized currency that was created in 2009 by developer Satoshi Nakamoto, who described the currency <a href=\"http:\/\/bitcoin.org\/bitcoin.pdf\">in a paper<\/a>. Recently Bitcoin has gotten lots of attention. In early 2013, the prices reached a high of US$265 per Bitcoin. The following chart shows the currency&#8217;s historical price:<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/bitcoin-price-chart.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-24974\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/bitcoin-price-chart-300x127.png\" alt=\"bitcoin price chart\" width=\"300\" height=\"127\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/05\/bitcoin-price-chart-300x127.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/05\/bitcoin-price-chart.png 941w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<p>Because Bitcoin is a virtual currency and independent of any financial institution, many vendors accept Bitcoins as payments.<\/p>\n<p>Bitcoins are generated through a process called mining. Every transaction is in the form of block that is broadcasted to all the nodes on the network. Nodes try to find a difficult proof of work that involves finding a value which when hashed with an algorithm such as SHA-256 gives output that contains a number of zero bits. Once a node finds such a hash, the user is rewarded with new Bitcoins.<\/p>\n<p>Because mining requires enormous processing power, the concept of &#8220;pooled&#8221; mining allows lots of people to work together to find a hash value. They all work together by sharing their resources. Once a hash has been generated by any user, they all split the created Bitcoins.<\/p>\n<p>The current jump in Bitcoin price suggests that cybercriminals are paying attention. With pooled mining, it is easier for botnet owners to install Bitcoin mining clients on various systems working together to generate Bitcoins for the botnet masters.<\/p>\n<p>In our recent analysis of botnets, we found a couple of samples that were communicating to various online Bitcoin mining services over the Stratum protocol:<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/stratum1.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-24989\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/stratum1-300x137.png\" alt=\"stratum\" width=\"300\" height=\"137\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/05\/stratum1-300x137.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/05\/stratum1.png 934w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<p>We also saw a couple of samples using JSON\/RPC calls:<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/stratum11.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-24991\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/stratum11-300x109.png\" alt=\"stratum1\" width=\"300\" height=\"109\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/05\/stratum11-300x109.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/05\/stratum11.png 996w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<p>And communication with a control server:<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/cnc-communication.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-24977\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/cnc-communication-300x137.png\" alt=\"cnc communication\" width=\"300\" height=\"137\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/05\/cnc-communication-300x137.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/05\/cnc-communication.png 703w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<p>It is clear that this bot is sending various information to the control server back and receiving commands from the server.<\/p>\n<p>Our analysis found that this botnet uses ufasoft Bitcoin mining software. All the required files are embedded inside the resource section of the .exe, so unlike other botnets no extra download is required.<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/embeded-in-resource.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-24978\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/embeded-in-resource-300x60.png\" alt=\"embeded in resource\" width=\"300\" height=\"60\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/05\/embeded-in-resource-300x60.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/05\/embeded-in-resource.png 815w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<p>The following screenshot shows malicious files getting unpacked in memory and running there.<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/virtual-alloc.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-24979\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/virtual-alloc-300x210.png\" alt=\"virtual alloc\" width=\"300\" height=\"210\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/05\/virtual-alloc-300x210.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/05\/virtual-alloc-1024x717.png 1024w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/05\/virtual-alloc.png 1268w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<p>The botnet also dropped a couple of required files for Bitcoin mining under a temp\/{random name} folder:<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/dropped-files.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-24980\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/dropped-files-300x118.jpg\" alt=\"dropped files\" width=\"300\" height=\"118\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/05\/dropped-files-300x118.jpg 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/05\/dropped-files.jpg 792w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<p>After that the botnet launches the file responsible for Bitcoin mining:<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/file-spawan.JPG.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-24981\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/file-spawan.JPG-300x44.png\" alt=\"file spawan.JPG\" width=\"300\" height=\"44\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/05\/file-spawan.JPG-300x44.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/05\/file-spawan.JPG.png 782w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<p>Note that the file has a fake description: \u201cMalwarebytes Anti-malware.\u201d<\/p>\n<p>This bot can be installed on a victim&#8217;s system through various methods: drive-by downloads, download via botnet, etc. Once run, this bot registers with various online pooled mining services with the attacker-supplied user name and password, so the attacker gets Bitcoins credited to his or her own account:<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/mining-authorize.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-24982\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/mining-authorize-300x91.png\" alt=\"mining authorize\" width=\"300\" height=\"91\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/05\/mining-authorize-300x91.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/05\/mining-authorize.png 934w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<p>We found one person selling an entire botnet kit on one of the underground forums for just a few dollars:<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/forums-sale-post.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-24983\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/forums-sale-post-300x106.png\" alt=\"forums sale post\" width=\"300\" height=\"106\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/05\/forums-sale-post-300x106.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/05\/forums-sale-post-1024x364.png 1024w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/05\/forums-sale-post.png 1589w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<p>We also found that the sample we got is the same as shown in the preceding forum post.<\/p>\n<p>Here are couple of screenshots showing the control panel of the bot.<\/p>\n<p>Commands:<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/bot-panel4.jpg\"><img decoding=\"async\" class=\"alignnone size-medium wp-image-24984\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/bot-panel4.jpg\" alt=\"bot panel4\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<p>Bitcoin settings:<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/bot-panel3.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-24985\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/bot-panel3-300x148.jpg\" alt=\"bot panel3\" width=\"300\" height=\"148\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/05\/bot-panel3-300x148.jpg 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/05\/bot-panel3.jpg 972w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<p>Botnet summary:<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/bot-panel1.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-24986\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/bot-panel1-300x33.jpg\" alt=\"bot panel1\" width=\"300\" height=\"33\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/05\/bot-panel1-300x33.jpg 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/05\/bot-panel1-1024x115.jpg 1024w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/05\/bot-panel1.jpg 1735w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<p>Statistics:<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/bot-panel2.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-24987\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/bot-panel2-300x52.jpg\" alt=\"bot panel2\" width=\"300\" height=\"52\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/05\/bot-panel2-300x52.jpg 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/05\/bot-panel2.jpg 979w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<h2>McAfee as a Shield<\/h2>\n<p>Bitcoin has recently gotten lots of media coverage because of the price it has attained during the last few months. We believe that this upward price trend will continue. With this bot, attackers are seeking new sources of income. They are quick to obtain the latest code as soon as it\u2019s available.<\/p>\n<p>McAfee customers are protected against this threat by IPS signature ID:0x4880b300_BOT_Bitbot_Activity_Detected.<\/p>\n<p>I would like to thank my colleague Vikas Taneja for his help with this analysis.<\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Bitcoin is a virtual decentralized currency that was created in 2009 by developer Satoshi Nakamoto, who described the currency in&#8230;<\/p>\n","protected":false},"author":612,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[442],"tags":[49,4562],"coauthors":[2095],"class_list":["post-24973","post","type-post","status-publish","format-standard","hentry","category-mcafee-labs","tag-botnet","tag-ecommerce"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v25.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Delving Deeply Into a Bitcoin Botnet | McAfee Blog<\/title>\n<meta name=\"description\" content=\"Bitcoin is a virtual decentralized currency that was created in 2009 by developer Satoshi Nakamoto, who described the currency in a paper. Recently\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Delving Deeply Into a Bitcoin Botnet | McAfee Blog\" \/>\n<meta property=\"og:description\" content=\"Bitcoin is a virtual decentralized currency that was created in 2009 by developer Satoshi Nakamoto, who described the currency in a paper. Recently\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/delving-deeply-into-a-bitcoin-botnet\/\" \/>\n<meta property=\"og:site_name\" content=\"McAfee Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:published_time\" content=\"2013-05-21T22:11:21+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-05-29T10:26:34+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/05\/bitcoin-price-chart.png\" \/>\n\t<meta property=\"og:image:width\" content=\"941\" \/>\n\t<meta property=\"og:image:height\" content=\"401\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Hardik Shah\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@hardik05\" \/>\n<meta name=\"twitter:site\" content=\"@McAfee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Hardik Shah\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/delving-deeply-into-a-bitcoin-botnet\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/delving-deeply-into-a-bitcoin-botnet\/\"},\"author\":{\"name\":\"Hardik Shah\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/99cb905e9b4051dfea96a7752dea4342\"},\"headline\":\"Delving Deeply Into a Bitcoin Botnet\",\"datePublished\":\"2013-05-21T22:11:21+00:00\",\"dateModified\":\"2025-05-29T10:26:34+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/delving-deeply-into-a-bitcoin-botnet\/\"},\"wordCount\":585,\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/delving-deeply-into-a-bitcoin-botnet\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/bitcoin-price-chart-300x127.png\",\"keywords\":[\"botnet\",\"E-Commerce\"],\"articleSection\":[\"McAfee Labs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/delving-deeply-into-a-bitcoin-botnet\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/delving-deeply-into-a-bitcoin-botnet\/\",\"name\":\"Delving Deeply Into a Bitcoin Botnet | McAfee Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/delving-deeply-into-a-bitcoin-botnet\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/delving-deeply-into-a-bitcoin-botnet\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/bitcoin-price-chart-300x127.png\",\"datePublished\":\"2013-05-21T22:11:21+00:00\",\"dateModified\":\"2025-05-29T10:26:34+00:00\",\"description\":\"Bitcoin is a virtual decentralized currency that was created in 2009 by developer Satoshi Nakamoto, who described the currency in a paper. Recently\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/delving-deeply-into-a-bitcoin-botnet\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/delving-deeply-into-a-bitcoin-botnet\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/delving-deeply-into-a-bitcoin-botnet\/#primaryimage\",\"url\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/bitcoin-price-chart-300x127.png\",\"contentUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/bitcoin-price-chart-300x127.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/delving-deeply-into-a-bitcoin-botnet\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Other Blogs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"McAfee Labs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Delving Deeply Into a Bitcoin Botnet\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"name\":\"McAfee Blog\",\"description\":\"Internet Security News\",\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\",\"name\":\"McAfee\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"width\":1286,\"height\":336,\"caption\":\"McAfee\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.youtube.com\/McAfee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/99cb905e9b4051dfea96a7752dea4342\",\"name\":\"Hardik Shah\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/b151596c8b1a8dc9b25ec3b19ccfd8c0\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/2b87a13b8b83a589e5494d7db597ad6a?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/2b87a13b8b83a589e5494d7db597ad6a?s=96&d=mm&r=g\",\"caption\":\"Hardik Shah\"},\"description\":\"Hardik Shah, a Senior Research Engineer in McAfee Labs, is an experienced security researcher and technology evangelist. He has extensive experience with exploits, malware analysis, and various IPS engines. Shah enjoys figuring out ways to protect customers from the latest threats. Prior to McAfee, he worked with the IPS research team at Symantec. You can follow him on twitter at @hardik05\",\"sameAs\":[\"https:\/\/www.linkedin.com\/in\/hardik05\/\",\"https:\/\/x.com\/hardik05\"],\"url\":\"https:\/\/www.mcafee.com\/blogs\/author\/hardik-shah\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Delving Deeply Into a Bitcoin Botnet | McAfee Blog","description":"Bitcoin is a virtual decentralized currency that was created in 2009 by developer Satoshi Nakamoto, who described the currency in a paper. Recently","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"Delving Deeply Into a Bitcoin Botnet | McAfee Blog","og_description":"Bitcoin is a virtual decentralized currency that was created in 2009 by developer Satoshi Nakamoto, who described the currency in a paper. Recently","og_url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/delving-deeply-into-a-bitcoin-botnet\/","og_site_name":"McAfee Blog","article_publisher":"https:\/\/www.facebook.com\/McAfee\/","article_published_time":"2013-05-21T22:11:21+00:00","article_modified_time":"2025-05-29T10:26:34+00:00","og_image":[{"width":941,"height":401,"url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/05\/bitcoin-price-chart.png","type":"image\/png"}],"author":"Hardik Shah","twitter_card":"summary_large_image","twitter_creator":"@hardik05","twitter_site":"@McAfee","twitter_misc":{"Written by":"Hardik Shah","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/delving-deeply-into-a-bitcoin-botnet\/#article","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/delving-deeply-into-a-bitcoin-botnet\/"},"author":{"name":"Hardik Shah","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/99cb905e9b4051dfea96a7752dea4342"},"headline":"Delving Deeply Into a Bitcoin Botnet","datePublished":"2013-05-21T22:11:21+00:00","dateModified":"2025-05-29T10:26:34+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/delving-deeply-into-a-bitcoin-botnet\/"},"wordCount":585,"publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/delving-deeply-into-a-bitcoin-botnet\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/bitcoin-price-chart-300x127.png","keywords":["botnet","E-Commerce"],"articleSection":["McAfee Labs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/delving-deeply-into-a-bitcoin-botnet\/","url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/delving-deeply-into-a-bitcoin-botnet\/","name":"Delving Deeply Into a Bitcoin Botnet | McAfee Blog","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/delving-deeply-into-a-bitcoin-botnet\/#primaryimage"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/delving-deeply-into-a-bitcoin-botnet\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/bitcoin-price-chart-300x127.png","datePublished":"2013-05-21T22:11:21+00:00","dateModified":"2025-05-29T10:26:34+00:00","description":"Bitcoin is a virtual decentralized currency that was created in 2009 by developer Satoshi Nakamoto, who described the currency in a paper. Recently","breadcrumb":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/delving-deeply-into-a-bitcoin-botnet\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/delving-deeply-into-a-bitcoin-botnet\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/delving-deeply-into-a-bitcoin-botnet\/#primaryimage","url":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/bitcoin-price-chart-300x127.png","contentUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/bitcoin-price-chart-300x127.png"},{"@type":"BreadcrumbList","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/delving-deeply-into-a-bitcoin-botnet\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.mcafee.com\/blogs\/"},{"@type":"ListItem","position":2,"name":"Other Blogs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/"},{"@type":"ListItem","position":3,"name":"McAfee Labs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/"},{"@type":"ListItem","position":4,"name":"Delving Deeply Into a Bitcoin Botnet"}]},{"@type":"WebSite","@id":"https:\/\/www.mcafee.com\/blogs\/#website","url":"https:\/\/www.mcafee.com\/blogs\/","name":"McAfee Blog","description":"Internet Security News","publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.mcafee.com\/blogs\/#organization","name":"McAfee","url":"https:\/\/www.mcafee.com\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","width":1286,"height":336,"caption":"McAfee"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.youtube.com\/McAfee"]},{"@type":"Person","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/99cb905e9b4051dfea96a7752dea4342","name":"Hardik Shah","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/b151596c8b1a8dc9b25ec3b19ccfd8c0","url":"https:\/\/secure.gravatar.com\/avatar\/2b87a13b8b83a589e5494d7db597ad6a?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/2b87a13b8b83a589e5494d7db597ad6a?s=96&d=mm&r=g","caption":"Hardik Shah"},"description":"Hardik Shah, a Senior Research Engineer in McAfee Labs, is an experienced security researcher and technology evangelist. He has extensive experience with exploits, malware analysis, and various IPS engines. Shah enjoys figuring out ways to protect customers from the latest threats. Prior to McAfee, he worked with the IPS research team at Symantec. You can follow him on twitter at @hardik05","sameAs":["https:\/\/www.linkedin.com\/in\/hardik05\/","https:\/\/x.com\/hardik05"],"url":"https:\/\/www.mcafee.com\/blogs\/author\/hardik-shah\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/24973","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/users\/612"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/comments?post=24973"}],"version-history":[{"count":2,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/24973\/revisions"}],"predecessor-version":[{"id":214711,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/24973\/revisions\/214711"}],"wp:attachment":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media?parent=24973"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/categories?post=24973"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/tags?post=24973"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/coauthors?post=24973"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}