{"id":11411,"date":"2018-02-07T16:40:10","date_gmt":"2018-02-08T00:40:10","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2018\/02\/07\/news-5182\/"},"modified":"2018-02-07T16:40:10","modified_gmt":"2018-02-08T00:40:10","slug":"news-5182","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2018\/02\/07\/news-5182\/","title":{"rendered":"The Growing Trend of Coin Miner JavaScript Infection"},"content":{"rendered":"

Credit to Author: Eric Chong| Date: Wed, 07 Feb 2018 11:45:00 +0000<\/strong><\/p>\n

\n

1. CharCode JavaScript <\/h3>\n

On 6th<\/sup> December 2017, FortiGuard Labs discovered a compromised website – acenespargc[.]com. Looking into the source code, we noticed a suspicious encrypted script which the uses eval()<\/strong> function to convert all the characters into numbers. We used a tool called CharCode Translator<\/a> to reverse the numbers back into characters. We were then able to retrieve a link which redirects to a scam page or phishing website.<\/p>\n

<\/p>\n

Part 1<\/em><\/p>\n

 <\/p>\n

<\/p>\n

Part 2 <\/em><\/p>\n

The above is just a simple example. The threat actor can actually customize the phishing content by geographical location, and to better avoid detection, it will also disappear when it detects that you have visited the phishing page before.<\/p>\n

Using this technique, threat actors are able to hide malicious\/phishing\/advertising URLs from being seen with the naked eye.  <\/p>\n

As you will see below, this technique has now been adopted by threat actors to hide Cryptocurrency mining JavaScript in compromised websites, so that whoever visits the website will be “infected” and their computer will start cryptomining for the threat actor. We classify this activity as malicious because it uses other people’s resources without their permission.<\/p>\n

 <\/p>\n

2. Packer tool hides CoinHive script   <\/strong><\/h3>\n

On the 28th<\/sup> of December, FortiGuard Labs learned about another malicious website using the very obfuscation technique we described above – romance-fire[.]com – through a referral from a customer. This website contained obscured malicious code for cryptocurrency mining.<\/p>\n

We uncovered the encoded script, and by using the packer tool<\/a> to unpack it, we found the script has a connection to CoinHive.<\/p>\n

\"breaking-news\"<\/p>\n

JavaScript from the source code<\/em><\/p>\n

\"unpack\"<\/p>\n

Unpacking the JavaScript – Part 1<\/em><\/p>\n

We noticed that the URL (hxxp:\/\/3117488091\/lib\/jquery-3.2.1.min.js?v=3.2.11) didn’t seem like a valid IP or domain. We did some research and found that ‘3117488091’ is the decimal IP of 185.209.23.219 after we converted it at KLOTH.NET<\/a>. Below is the result:<\/p>\n

<\/p>\n

This site converted the URL  to hxxp:\/\/185.209.23.219\/lib\/jquery-3.2.1.min.js?v=3.2.11. From the URL, we retrieved the same pattern of JavaScript, so we unpacked the Script again.<\/p>\n

<\/p>\n

Unpacking the JavaScript – Part 2<\/em><\/p>\n

After a final round of unpacking, we were finally able to retrieve the script that contains CoinHive URLs:<\/p>\n

\"unpack2\"<\/p>\n

Unpacking the JavaScript – Part 3<\/em><\/p>\n

3. Coin miner from GitHub <\/h3>\n

On 26th<\/sup> January 2018, we discovered another website – sorteosrd[.]com – which also mines cryptocurrency by hijacking a visitor’s CPU. This cryptomining malware again allows hijackers to benefits from mining digital currency without the computer user’s permission. We believe that this site might have been compromised or used by the webmaster.<\/p>\n

<\/p>\n

Source code of the website hxxp:\/\/sorteosrd.com:<\/em><\/p>\n

 <\/p>\n

<\/p>\n

Impact of surreptitious cryptomining on user’s device<\/em><\/p>\n

As we can see from the screenshot above, coin miner dramatically slows down the PC as its CPU is fully utilized after visiting the site.<\/p>\n

4. Compromised website – BlackBerry infected with CryptoCoin mining <\/h3>\n

Another example of a CoinHive script was found at a surprising compromised website – blackberrymobile.com.<\/p>\n

\"9cae0885135b83c1b7d1637a5880c0bf\"<\/p>\n

<\/p>\n

Even the Blackberry site was compromised for a short time to mine for Monero cryptocurrency.<\/em><\/p>\n

5. Compromised website – Milk New Zealand infected with deepMiner tool<\/h3>\n

In addition, we also discovered that one of the largest dairy farm groups in New Zealand, Milk New Zealand, had also been compromised. Our AV lab detected malicious activity from the site, so we look into the source code and found a script using the deepMiner<\/a> tool at github to Mine Monero, Electroneum, Sumokoin, etc. See the screenshot below:<\/p>\n

 <\/p>\n

<\/p>\n

JavaScript using deepMiner<\/em><\/p>\n

Based on the data in the screenshot above, we learned that this kind of script uses DDNS for its domain and only increases CPU usage by 50% in order to be less noticeable to end users.<\/p>\n

6. Even YouTube serves ads with coin mining<\/h3>\n

The problem of cryptocurrency-mining malware is getting serious. As the number of threat actors looking to earn from cryptomining by hijacking CPU cycles continues to grow, cryptomining malware is showing up in more and more places. A week ago, several malicious ads popped up on YouTube after a threat actor managed to inject a coin miner script into online ads. Luckily, YouTube found the issue and removed the affected ads within two hours.<\/p>\n

 <\/p>\n

<\/p>\n

Malicious cryptomining YouTube ads<\/em><\/p>\n

What can you do to prevent or avoid Coin Miner hijacking?<\/p>\n

    \n
  1. Clear your browser cache, or install ccleaner software to find and remove unwanted files and invalid Windows Registry entries from your computer<\/li>\n
  2. Disable JavaScript in your browser or run a script blocker tool or extension<\/li>\n
  3. Install Antivirus software such as FortiClient<\/li>\n
  4. Install and run AdBlocker or similar tools, such as Ghostery<\/li>\n<\/ol>\n

    FortiGuard has blacklisted all the URLs listed in this blog as Malicious.   <\/p>\n

    IOCs:<\/strong>
    Compromised Websites:<\/p>\n