Domain siblings and contents of the second javascript file
In my previous post, we saw that someone is apparently injecting Monero-harvesting code into what appear to be compromised websites. One method was to inject an invisible frame with a page that contained a script calling https://coin-hive.com/lib/coinhive.min.js, which is the Coinhive javascript Monero miner. Another method, present on the same page (presumably in case the browser used didn't support frames) was to directly call a javascript file from a different site. The contents of this javascript file is an array of numbers, followed by a loop.
This code extracts ASCII codes from the string of numbers, revealing obfuscated HTML.
The result calls the same Coinhive miner, but also another script that appears to create a bunch of ads. I'll run that on a victim machine and post the output later.
In the meantime, both methods used the same Coinhive script with the same unique site ID. This ID is to identify what account gets credited with the site owner's share of the cryptocurrency (the rest goes to Coinhive). This means that the site ID can be used to identify which sites were compromised by a common threat actor. Naturally, one would expect the threat actor to register a number of unique site IDs and rotate them to avoid too many sites being attributed to them.
The domains for the invisible frame and the obfuscated javascript were different, but a quick domain search revealed that they were obviously related.
The next steps are to run the advertising javascript and see what it pulls in, and try to find out how many sites have been compromised and injected with scripts that use the same, or related, unique Coinhive IDs. Interestingly, Coinhive's site (coin-hive.com) is down at the time of this post.Sucuri posted about a week ago regarding nefarious cryptocurrency mining on compromised sites.
In the meantime, both methods used the same Coinhive script with the same unique site ID. This ID is to identify what account gets credited with the site owner's share of the cryptocurrency (the rest goes to Coinhive). This means that the site ID can be used to identify which sites were compromised by a common threat actor. Naturally, one would expect the threat actor to register a number of unique site IDs and rotate them to avoid too many sites being attributed to them.
The domains for the invisible frame and the obfuscated javascript were different, but a quick domain search revealed that they were obviously related.
The next steps are to run the advertising javascript and see what it pulls in, and try to find out how many sites have been compromised and injected with scripts that use the same, or related, unique Coinhive IDs. Interestingly, Coinhive's site (coin-hive.com) is down at the time of this post.Sucuri posted about a week ago regarding nefarious cryptocurrency mining on compromised sites.
Comments
Post a Comment