Best Overall: AMD Threadripper 3990X
Cores/threads : 64C/128T | Base frequency : 2.9 GHz | Boost frequency : 4.3 GHz | TDP : 280 W | Average hashrate : 54 kH/s.
Pros:
- Huge performance.
- Has 64 cores and 128 threads.
- Supports PCIe 4.0 interface.
- Supports ECC memory and AMD Smart Access.
May not like:
- Very expensive.
- Requires tuning to achieve maximum mining performance.
Prices for Yandex.Market
AMD Threadripper 3990X
When it comes to Monero mining, the AMD Threadripper 3990X is a real gem. Unfortunately, it is very expensive, but it also pays for itself if done correctly. With 64 cores and 128 threads, the Threadripper 3990X can deliver hashrates ranging from 43 to 64 kH/s using the XMRig 6.3.5 algorithm (as listed on monerobenchmarks.info).
To get the maximum hashrate out of this processor, you'll need to invest in high-quality, low-latency DDR4 memory modules that run at at least 3200 MHz. This processor can generate up to $140 per month or up to $1,650 per year (as of March 2022). The Threadripper 3990X is very popular among workstation professionals. If you get tired of mining, you can always sell this processor at a good price.
What is Monero
The Monero (XMR) cryptocurrency was created on the basis of the ByteCoin token blockchain, developed in 2014. ByteCoin is the first cryptocurrency to use the CryptoNote protocol. This protocol includes mechanisms that make the blockchain completely anonymous.
Until now, most Monero developers have not revealed their names. Famous developers include Ricardo “Fluffypony” Spagni and Francisco Cabanas.
CryptoNote provides complete anonymity to users thanks to technologies:
- ring signature, which allows you to find out the number of coins sent and received, but hides the addresses;
- ring transactions in which the time of the transaction, the participants involved, and the amount of payment are hidden and known only to the participants of this transaction.
Monero owners can create a special “one-time” wallet for making payments to further protect themselves. Such addresses allow you to hide the connection between the wallets of transaction participants. This technology is called address stealth.
Second place: AMD Threadripper 3960X
Cores/threads : 24C/48T | Base frequency : 3.8 GHz | Boost frequency : 4.5 GHz | TDP: 280 W | Average hashrate : 25 kH/s.
Pros:
- Excellent value for money and quality.
- Works well at low voltage.
- Very good results in games.
- Supports ECC memory.
May not like:
- It's difficult to overclock.
Prices for Yandex.Market
AMD Threadripper 3960X
If the Threadripper 3990X is too expensive and you want something more affordable for mining Monero, the Threadripper 3960X is the perfect choice. This sub-$1,500 workstation processor has 24 cores and 48 threads and can offer much better price/performance compared to its more powerful brother, the Threadripper 3970X. The 3960X can provide a hashrate of 20 to 27 kH/s on the XMRig 6.6.2 algorithm, which can give a good monthly income.
The great thing about this processor is that it works well at low voltage, but it requires several super-fast DDR4 modules to mine effectively. Overall, the Threadripper 3960X will be a much better replacement for the Threadripper 3990X than the 3970X. It can offer very good mining performance for a reasonable price.
Regulators against Monero
The creators of Monero have developed a dynamic block system that allows you to quickly confirm transactions and keep network fees low. The system works in such a way as not to create queues of transactions. If unconfirmed transactions begin to accumulate, the block size may increase, but not more than twice the initial size.
The total supply of Monero tokens is limited (18.4 million digital coins). But the developers have provided a mechanism that will replenish lost tokens and keep their number in circulation at approximately the same level. From May 2022, the blockchain will add 0.6 XMR every two minutes.
Typically, the seed phrase, which is used to restore access to a cryptocurrency wallet, is generated from a set of random English words. Monero has the ability to generate a seed phrase in different languages to confuse attackers when trying to gain access to your wallet.
Due to the high anonymity of the coin, financial regulators in different countries impose bans on its circulation. Because of this, crypto exchanges in Japan and South Korea, in particular UpBit, Coincheck and OKEx, had to refuse to list Monero. This comes after the intergovernmental organization against money laundering (FATF) ordered all cryptocurrency exchange services to comply with CFT (Counter Financing of Terrorism) and AML (Anti-Money Laundering) procedures. Due to the nature of Monero's architecture, these requirements cannot be met.
Best High-Performance CPU for Mining: AMD Ryzen 9 3950X
Cores/threads : 16C/32T | Base frequency : 3.5 GHz | Boost frequency : 4.7 GHz | TDP : 105 W | Average hashrate : 17.5 kH/s
Pros:
- Outstanding performance for a mainstream processor.
- Supports PCIe 4.0 interface.
- Compatible with AM4 motherboards.
- Very affordable price.
May not like:
- An improved cooler is required.
- Limited overclocking potential.
Prices for Yandex.Market
AMD Ryzen 9 3950X
The weird thing about AMD processors is that the cheaper they are, the better they perform. At least this can be said about Monero mining. The only reason why the AMD Ryzen 9 3950X is not ranked 2nd on this list of the best CPUs for Monero mining is because it brings in less monthly income (around $35) compared to the Threadripper 3960X.
Best Mid-Range Mining CPU: AMD Ryzen 9 3900X
Cores/threads : 12C/24T | Base frequency : 3.8 GHz | Frequency who breeds : 4.6 GHz | TDP : 105 W | Average hashrate : 13.5 kH/s
Pros:
- Excellent value for money and quality.
- Very versatile processor.
- Supports PCIe 4.0 interface.
- Affordable price.
May not like:
- The supplied radiator does not provide effective cooling.
- Overclocking is required to provide better hashrate.
Prices for Yandex.Market
AMD Ryzen 9 3900X
The AMD Ryzen 9 3900X is called an excellent processor in many reviews and user reviews. As for mining Monero, it also performs well here. Priced at about $500, the Ryzen 9 3900X can offer 12 cores, 24 threads and a mining hashrate of 11-16 kH/s using the XMRig algorithm. This type of work can bring in a decent monthly income.
Couple that processor with some high-end graphics cards that can also mine Monero, and you've got yourself a serious cryptocurrency mining machine. However, to achieve a hashrate of 16 kH/s on this processor, you will have to overclock it to 4.2 GHz, and also buy several high-quality RAM modules that can achieve CAS 14 latency and a clock speed of at least 3733 MHz. If you know how to use this processor, the Ryzen 9 3900X is a good buy.
Best Budget CPU for Mining: AMD Ryzen 7 3700X
Cores/threads : 8C/16T | Base frequency : 3.6 GHz | Boost frequency : 4.4 GHz | TDP : 65 W | Average hashrate : 9 kH/s
Pros:
- Affordable price.
- Excellent gaming performance.
- Very good overclocking margin.
- Low power consumption.
May not like:
- Single thread performance could be better.
- Modest mining hashrate.
Prices for Yandex.Market
AMD Ryzen 7 3700X
The AMD Ryzen 7 3700X is the ideal processor to start your career as a Monero miner. This processor costs about $350 and has 8 cores, 16 threads and full PCIe 4.0 support. The Ryzen 7 3700X can provide a hashrate of 7 to 10 kH/s on the XMRig 6.4.0 algorithm, which is pretty good performance considering its price.
The great thing about this processor is that it has a very low TDP of 65W and also has very good overclocking. Such a processor makes it easy to test various algorithms and mining configurations. The Ryzen 7 3700X does not require expensive motherboards, which is another reason to choose it. Overall, the Ryzen 7 3700X can generate a modest but stable monthly income.
XMR STAK CPU setup in Linux
Back to articles
What is the easiest way to start mining on a central processor. Using openSUSE Linux it is easy to install the XMR STAK CPU mining program and start the mining process with a good hashrate. How to mine an ETN coin and how to create a wallet for it, read in this material. How to mine on RX 550 read.
The first thing you need to do is install the XMR STAK CPU miner. This can be done in one click: 1 Click Install. Using openSUSE Linux, you can search for packages and install in one click at software.opensuse.org/package/
Get 500 rubles for opening a debit card, or 2000 rubles. for opening a credit card at Otkritie Bank. To do this, simply follow the link. The link leads to the Otkritie Bank website!
or
open a business account at Otkritie Bank and receive 3 months of free service. Follow this link. The link leads to the Otkritie Bank website!
Service for remote configuration of a miner on a processor. More details
You need to type XMR STAK CPU into the package search bar, select your version of the openSUSE Linux distribution and install XMR STAK CPU in “one click” or in another way convenient for you.
The author of the program entered only 1% of the miner’s work time in favor of the author - donation level is set to 1.0%
Go to the /etc/xmr-stak-cpu/ directory and copy the config.txt file to the /usr/bin/ directory. Next, you need to edit the config.txt configuration file in /usr/bin/. It is convenient to use the mc program for this. You can install it like this
sudo zipper in mc
Issue the command xmr-stak-cpu while in the /usr/bin/ directory
A recommendation will be given as to which lines need to be added to the config.txt configuration file.
"cpu_threads_conf" :[ { "low_power_mode" : false, "no_prefetch" : true, "affine_to_cpu" : 0 }, { "low_power_mode" : false, "no_prefetch" : true, "affine_to_cpu" : 1 },],
The given lines are relevant for our processor, yours may be different. Copy them and paste them into the configuration file /usr/bin/config.txt
Don't forget to enter the address of your pool, worker and password. this is done in the same file in the lines
"pool_address" : "xmr.pool.minergate.com:45560","wallet_address" : " [email protected] ","pool_password" : "x",
If you now start the miner from the /usr/bin/ directory with the command
xmr-stak-cpu
then it is possible that the miner will report MEMORY ALLOC FAILED: mmap failed
What should I do if the mmap! message pops up? In order to get rid of the MEMORY ALLOC FAILED: mmap failed error, read on and do the same on your system.
In this case, you need to make a few changes. Add the line vm.nr_hugepages=128 to the end of the /etc/sysctl.conf file. Then edit /etc/security/limits.conf
add lines
stibsoft soft memlock 262144stibsoft hard memlock 262144
Instead of stibsoft, enter your user under which you are going to run the XMR STAK CPU miner. Restart your computer. Try running the miner. Now on startup everything is fine
You can view your hashrate by pressing the h button. XMR STAK CPU works stably, and is somewhat more productive than in Windows. Read the results of running the XMR STAK CPU miner on Windows in this material. How to configure cpuminer, take a look at this page. Mine Dinastycoin using this link.
Corsair HX1000 farm power supply
Don't forget to use a reliable power supply. About a suitable power supply. A correctly selected power supply will ensure uninterrupted operation of the farm. Read in this article about the HX1000 power supplies manufactured by Corsair. The completeness of the power supply, pins, cables, etc. is considered in detail.
Mining Monero on CPU
Mine Monero in 2022. New Random X algorithm. How many hashes does Ryzen produce on CryptoNight v7 and CryptoNight R. Setting up miners, frequencies and voltage of the central processor. Description in this material.
Radeon RX 550 mining on Cryptonight v7
We mine on AMD Radeon RX550 video cards, Cryptonight v7 algorithm.
What to mine on 2 GB RX550 video cards. The setup of the xmrig miner is described, how many hashes this card produces. How to reflash a video card and increase its hashrate. Payback period and whether production with this equipment makes sense. linux windows cpu
Best Budget HEDT Processor for Mining: AMD Threadripper 1950X
Cores/threads : 16C/32T | Base frequency : 3.4 GHz | Boost frequency : 4.0 GHz | TDP : 180 W | Average hashrate : 12 kH/s.
Pros:
- Excellent mining performance.
- Contains 16 cores and 32 threads.
- Outperforms Intel Core X-series processors at the same price.
- Strong multi-threaded performance.
May not like:
- Large physical dimensions.
- Requires workstation motherboard.
Prices for Yandex.Market
AMD Threadripper 1950X
The AMD Threadripper 1950X is currently the best workstation/HEDT processor for Monero mining. It's quite cheap, especially if you buy it on eBay. The Threadripper 1950X has been around for four years, but it's still a great processor. With 16 cores and 32 threads, the 1950X can deliver 9-13 kH/s hashrate on XMRig, which translates into real-world performance on par with the AMD Ryzen 9 3900X for a much lower price.
If you buy this chip for $350, it can recoup 78% of your investment within a year. This may not seem like a very profitable endeavor, but if you pair it with several high-end mining graphics cards, you can expect to make much more profit than mining Monero with just a graphics card.
Another advantage is that most X399 chipset motherboards with Threadripper 1950X support are not very expensive these days. They are equipped with multiple PCIe x16 slots, which is ideal for creating a powerful mining rig.
Money siphoning machine: Monero miner
While the world waits to see where famous cyber groups like Lazarus or Telebots, armed with analogues of WannaCry or Petya, will strike again, operators of less resonant campaigns are making money quietly. One such operation has been ongoing since at least May 2017. Attackers infect Windows web servers with a malicious Monero (XMR) cryptocurrency miner. The attackers behind this campaign modified a legitimate miner based on open source code and used the vulnerability in Microsoft IIS 6.0 CVE-2017-7269 to secretly install malware on unpatched servers. In three months, the scammers created a botnet of several hundred infected servers and earned more than 63 thousand dollars from Monero.
ESET users are protected from any attempts to exploit the CVE-2017-7269 vulnerability, even if their machines are not yet patched, as was the case with the EternalBlue exploit used in the WannaCry distribution.
Monero or Bitcoin?
Despite the rising price of Bitcoin, Monero has several advantages that make this cryptocurrency very attractive for mining using malware.
This is the inability to track transactions and prove the use of the CryptoNight algorithm, which uses computer and server CPUs and GPUs (unlike Bitcoin, which requires specialized equipment to mine). Over the past month, Monero rose from $40 to $150 and then dropped to $100.
Figure 1. Candlestick chart of the XMR/USD rate in August 2022
Cryptominer
First discovered in-the-wild on May 26, 2022, the mining malware is a modification of the legitimate Monero miner based on the open source xmrig code (version 0.8.2, introduced on May 26, 2017).
The authors of the malicious miner did not change the original code base, they only added hard-coded command line arguments with their wallet address and mining pool URL, as well as several arguments for destroying previously running instances of the malware to avoid competition. Such modification takes no more than a couple of minutes - it is not surprising that we discovered the malware on the day the basic version of xmrig was released.
You can see the attackers' modified miner and its comparison with the available source code in the figure below.
Figure 2. Comparison of the code of the original and modified versions of the miner
Scanning and operation
Delivery of the miner to the victims' computers is the most difficult part of the operation, but even here the attackers used the simplest approach.
We have identified two IP addresses from which brute force scanning is carried out for the CVE-2017-7269 vulnerability. Both addresses point to servers in the Amazon Web Services cloud. The vulnerability used by the attackers was discovered in March 2017 by researchers Zhiniang Peng and Chen Wu. This is a vulnerability in the WebDAV service, which is part of Microsoft IIS version 6.0 on Windows Server 2003 R2. A buffer overflow vulnerability in the ScStoragePathFromUrl function is triggered when a vulnerable server processes a malicious HTTP request. In particular, a specially crafted PROPFIND request results in a buffer overflow. A detailed analysis of the mechanism is described by Javier M. Mellide and is available here. The vulnerability is exploitable because it resides in a web server service, which in most cases should be accessible from the Internet and easy to exploit.
The shellcode is the expected download and execution action (downloading dasHost.exe
from hxxt://postgre[.]tk/ to the %TEMP%) folder:
Figure 3. Shellcode delivered by the exploit
According to our data, the first in-the-wild exploit of this vulnerability occurred just two days after its description was published on March 26, 2022. Since then, the vulnerability has been actively exploited.
The new malicious miner was first noticed on May 26, 2022. From this point on, it spreads in waves, which means that attackers continue to search for vulnerable machines.
Figure 4. Graph of infection waves
The scan is always performed from a single IP address, most likely from a machine hosted on an Amazon cloud server rented by the attackers.
Statistics
Mining pool statistics have been made publicly available, so we can see the aggregate hashrate of all victims who contributed computing power for mining.
The constant value reached 100 kilohashes per second (kH/s) with peaks of up to 160 kH/s at the end of August 2022, which we associate with campaigns launched on August 23 and 30. Overall, infected machines were mining around 5.5 XMR per day by the end of August. Earnings within three months amounted to 420 XMR. At a rate of $150 per 1 XMR, the income of miner operators was $825 per day and more than $63,000 in total.
The attackers became more active at the end of August, but since the beginning of September we have not seen any new infections. Moreover, since the miner does not provide a persistence mechanism, attackers begin to lose compromised machines, and the overall hashrate has dropped to 60 kH/s. This is not the first break in the activities of the cyber group; most likely, a new campaign will start in the near future.
We do not know the exact number of victims, but we can roughly estimate it based on the total hashrate. According to CPU indicators, the hashrate of a high-performance Intel i7 processor reaches 0.3–0.4 kH/s. This campaign uses systems running Windows Server 2003, which are likely running on older hardware with relatively weak processors. Therefore, the average victim hashrate will be much lower, and the total number of infected machines will be higher; we can talk about hundreds of victims.
Figure 6. Attacker wallet statistics provided by the mining pool
Conclusion
This campaign is based on a legitimate open source miner and a number of machines with outdated, unupdated operating systems.
To make a profit, the operators of the malicious miner only had to slightly modify the code; operating costs are minimal. ESET detects malicious miner binary as Win32/CoinMiner.AMW
, attempts to exploit vulnerabilities at the network level like
webDAV/ExplodingCan
. This is a real example of a package that will be blocked:
Figure 5. Special HTTP request with shellcode
Microsoft ended support for Windows Server 2003 in July 2015 and did not release patches for the CVE-2017-7269 vulnerability until June 2017, when critical vulnerabilities for legacy operating systems attracted the attention of virus writers. To avoid large-scale destructive attacks like the WannaCry epidemic, the corporation decided to close these vulnerabilities. However, maintaining Windows Server 2003 is quite difficult, since automatic updates do not always work well (this is confirmed, for example, by Clint Bossen's post). Consequently, most systems are still vulnerable. We strongly recommend that Windows Server 2003 users install KB3197835 and other security updates as soon as possible (if automatic updates do not work, download the patch manually!).
Indicators of compromise
Download sites:
hxxp://postgre.tk hxxp://ntpserver.tk
Attack source IP addresses:
54.197.4.10 52.207.232.106 18.220.190.151
Hashes:
0902181D1B943 3B5616763646A089B1BDF428262 0AB00045D0D403F2D8F8865120C1089C09BA4FEE 11D7694987A32A91FB766BA221F9A2DE3C06D173 9FCB3943660203E99C348F 17A8801BA077F7CB40 52413AE19BBCDB9339D38A6F305E040FE83DEE1B
Best Intel HEDT Processor for Mining: Intel Xeon E5-2699 v3
Cores/threads : 18C/36T | Base frequency : 2.3 GHz | Boost frequency : 3.6 GHz | TDP : 145 W | Average hashrate : 8 kH/s
Pros:
- Low price.
- Contains 18 cores and 36 threads.
- Can be used for mining.
May not like:
- Requires a special type of motherboard.
- Low hashrate.
Prices for Yandex.Market
Intel Xeon E5-2699 v3
Intel processors are not very good at mining cryptocurrencies like Monero. This is primarily due to the fact that they have very low multi-threaded performance compared to AMD Ryzen and Threadripper processors. However, if you don't like AMD and prefer Intel, then the Xeon E5-2699 v3 processor should be fine.
Although it's almost 7 years old, this 18-core, 36-thread processor is the best Intel has to offer for cryptocurrency mining. The E5-2699 v3 can provide a hashrate of 8 kH/s on the XMRig algorithm, which is enough to earn $15 per month or about $180 per year. That's pretty weak performance, but since used Xeon processors are now cheaper than a pair of worn-out boots, this processor could be a worthwhile investment for some miners.
Best Intel Core Processor for Mining: Intel Core i9-10900K
Cores/threads : 10C/20T | Base frequency : 3.7 GHz | Boost frequency : 5.3 GHz | TDP : 125 W | Average hashrate : 6.85 kH/s
Pros:
- Good single thread performance.
- Outstanding gaming performance.
- Great for content creation.
- Can be used for mining.
