During the past several months, in-browser mining has continued to affect a large number of websites, predominantly relying on Coinhive’s infamous API. We documented several campaigns on this blog, in particular Drupalgeddon, where attackers are taking advantage of vulnerabilities in popular Content Management Systems (CMS) to compromise websites and push payloads both client- and server-side.
In the past weeks, our crawlers have catalogued several hundred sites using a variety of CMS all injected with the same obfuscated code that uses Coinhive’s shortlink to perform silent drive-by mining. By pivoting on this indicator of compromise, we were able to identify a larger infrastructure receiving traffic from several thousand hacked sites acting as doorways to redirect traffic to a central server involved in the distribution of both web and standard malware coin miners.
Figure 1: Mining operation fueled by compromised sites
Obfuscated miner injection
As part of our regular crawls, we look for known redirects to sites of interest and lately, most have been related to Coinhive domains. We detected hundreds of new domains, all legitimate websites that were injected with a blurb of hexadecimal code. Once decoded, it shows as an invisible iframe (1×1 pixel) to cnhv[.]co/3h2b2. We believe it is part of the same campaign that was exposed by the folks over at Sucuri at the end of May.
Figure 2: A WordPress site injected with an obfuscated iframe loading Coinhive’s API
The cnhv[.]co domain name is used for what Coinhive calls shortlinks, essentially a way of monetizing on hyperlinks by making visitors’ browsers solve a certain number of hashes before they reach their destination site. When clicking on such a link, you will see a progress bar and within a few seconds, you will be redirected. Crooks are abusing this feature by loading those shortlinks as hidden iframes with an unreasonably high hash count.
Figure 3: Shortlink is taxing our CPU at 100%
In Figure 3 where we made the iframe visible by by changing its dimensions, to show that rather than wait for a few seconds before being redirected, users will unknowingly be mining for as long as they stay on the page. Indeed, while Coinhive’s default setting is set to 1024 hashes, this one requires 3,712,000 before loading the destination URL.
Backdoor initiated redirection
Querying urlscan.io, we were able to find the same Coinhive key active as early as May 7 via a different redirection mechanism. There is a specific URI pattern indicating that hacked sites are being leveraged to perform a redirect to a server at 5.45.79[.]15. This in turn creates a redirection via another crafted URI where one of the parameters is the referrer site, ultimately leading to the Coinhive shortlink that will start the web miner.
Figure 4: The same shortlink was found loaded from a compromised website via an intermediary server
Several sites have been injected with both the hidden cnvh[.]co iframe method, as well as via backdoors:
Figure 5: A hacked site injected with Coinhive’s shortlink and multiple compromised URLs
The URI pattern used for the redirections can be identified by the following regular expression:
Figure 6: A regular expression showing a match between compromised sites
Blackhat SEO and doorways
Looking at those URIs again, we can note the presence of certain keywords that appear to be Search Engine Optimization (SEO) related, for instance:
cctvvietnam[.]com/1hqg/wzdea.php?lrscye=mongodb-count-fields pixelbedlam.co[.]uk/9ul8/6nfme.php?lrscye=relativity-software-cost valam[.]in/f8wb/z8d6w.php?lrscye=tutoring-in-egypt stemat[.]pl/klwy/dzwfy.php?lrscye=vin-decoder-mercedes whylab[.]nl/podd/1hwnz.php?lrscye=gpon-home-gateway-exploit soho-dom[.]ru/el5p/ywuul.php?lrscye=bts-album-download-zip
We confirmed that indeed some Google or Bing searches showed us results that included the list of compromised sites that are acting as “doorways,” usually to a traffic distribution system or redirector (5.45.79[.]15). In this case, the doorways are used to trick people into downloading malicious coin miners instead of the file they were looking for.
Figure 7: Despite appearances, this file is not 100 percent clean
Note how the server at 5.45.79[.]15 is performing the redirection to another hacked sited (motoir[.]com), where the keywords passed from the URI are dynamically used to create what looks like a unique download page and file.
Figure 8: Web traffic showing the redirection sequence
Malicious coin miners
Upon execution, this executable will unpack the following three binaries:
- winsystem.exe: the XMRig miner
- clock.exe: .bat file wrapped into an EXE contains commands
- netflash.exe: a very simple downloader, written in .NET.
The batch script adds persistence by setting a registry entry, kills certain processes (possible miners already running), and starts mining by launching:
winsystem.exe -B -a cryptonight -o 37.1.197[.]121:80 -p x -u %COMPUTERNAME% +500 --max-cpu-usage=30 --donate-level=1 -k
Figure 9: Batch script revealing the mining code
The fake download binaries are based on the same code from a miner, unsurprisingly, hosted at 5.45.79[.]15/xxxphoto.exe. Using VirusTotal Intelligence, we were able to expand on this infrastructure and identify another coin miner, which is an ELF file this time, based on this cnrig library, hosted at: 5.45.79[.]15/monero/cnrig.
Figure 10: Graph showing an ELF and Win32 miner hosted on the same server
A comment left on this VirusTotal report page indicates that this miner was found on an infected server and pulled down from a PHP backdoor called zz1.php. Searching for that file name, we located a possible candidate uploaded to a public site. Decoding the Base64 encoded strings, we can assert with greater confidence that this is the malicious PHP file used by the attackers to download the Linux coin miner from 5.45.79[.]15/monero/cnrig:
Figure 11: PHP code uploaded into compromised sites responsible for ELF miner download
Once it has retrieved the ELF binary, it runs it, using the following command in order to begin mining:
./cnrig -o 5.61.46[.]146:80 --donate-level=1 > /dev/null 2>&1
Proxies
Because the miners are connecting to private pools (and likely via proxy) without using a wallet address, we cannot assess how much money the perpetrators have generated with this scheme.
In fact, the server at 5.45.79[.]15 also has its own ProxyPanel:
Figure 12: A proxy based on xmrig-proxy
The XMRig version of the miner had a public stats page indicating that there were close to 500 infected machines that had participated in the mining activity. For the CNRig version, we weren’t able to find any such stat, although the number of hacked servers was much higher.
A growing number of sites
The interest surrounding cryptocurrencies has drastically changed the malware landscape with criminals hoping to get a piece of the action. As such, a growing number of websites are being compromised both client- and server-side to distribute and run coin miners.
In this campaign, we see infrastructure used to push an XMRig miner onto users by tricking them into downloading files they were searching for online. In the meantime, hacked servers are instructed to download and run a Linux miner, generating profits for the perpetrators but incurring costs for their owners. Finally, it seems only fitting to see an abuse of Coinhive’s shortlinks to perform in-browser mining.
Malwarebytes blocks malicious mining, whether it is triggered by malware or loaded via compromised websites.
Thanks to @DynamicAnalysis for sharing additional information.
Indicators of compromise
String for obfuscated cnvh[.]co injection
vhisduhvuhiusdhfbjhewvhisdhbybguyebrrfsd
Coinhive shortlink
cnhv[.]co/3h2b2
Coinhive site key
Dkpy5v4CBgwZqzPRosdHKDB7DQsc1Sav
Regex for compromised sites redirection
/(w{4}|w{8})/(w{5}|w{9}).php?([a-z]{6}|[a-z]{3})=[w]{1,25}-[w]{1,25}Redirection server
5.45.79[.]15
Windows miner dropper
5.45.79[.]15/xxxphoto.exe 38f55239519523638dc2b3958f5e9951a6b04f813336927a4f7de717518e5b44
Linux miner
5.45.79[.]15/monero/cnrig c890d18fe3753a9ea4d026fc713247a9b83070b6fe40539779327501916be031
