Figure 1 - Create wallet (legitimate)

Figure 2 - Call new seed function

The seed will be sent to: node.hashmonero[.]com.

cryptonote::simple_wallet::send_to_cc

As you may have guessed, this function will send data off to the CC or C2 (command and control) server - this will be stolen funds.

Figure 3 - Send to cc

Sending funds to the C2 is handled using an HTTP POST request to the following C2 servers:

• node.xmrsupport[.]co
• 45.9.148[.]65

As far I can see, it doesn't seem to create any additional files or folders - it simply steals your seed and attempts to exfiltrate funds from your wallet.

Windows binary

The C2 server 45.9.148[.]65 also hosts a Windows binary with the following properties:

• MD5: 72417ab40b8ed359a37b72ac8d399bd7
• SHA-1: 6bd94803b3487ae1997238614c6c81a0f18bcbb0
• SHA-256: 963c1dfc86ff0e40cee176986ef9f2ce24fda53936c16f226c7387e1a3d67f74
• File type: Win32 EXE
• Magic: PE32+ executable for MS Windows (console) Mono/.Net assembly
• File size: 65.14 MB (68302960 bytes)
• VirusTotal report: https://www.virustotal.com/gui/file/963c1dfc86ff0e40cee176986ef9f2ce24fda53936c16f226c7387e1a3d67f74/summary

The Windows version is essentially doing the same things as the Linux version - stealing your seed and wallet funds - the function names are just different, e.g. _ZN10cryptonote13simple_wallet9send_seedERKN4epee15wipeable_stringE.

Figure 4 - Send to cc

Note: this doesn’t mean the official Windows binary was also compromised - it simply means there’s also a compromised Windows binary out there. Only the Monero team can confirm if other binaries (besides the Linux one mentioned in this blog) have been compromised.

Detection

• If you have a firewall or proxy, whether hardware or software, verify if you had any network traffic or connections to;
• node.hashmonero[.]com
• node.xmrsupport[.]co
• 45.9.148[.]65
• 91.210.104[.]245
• Remove all the binaries listed in this blog post;
• Verify the hashes of your Monero setup or installer file. Guides to do that here;
• Beginner: https://src.getmonero.org/resources/user-guides/verification-windows-beginner.html
• Advanced: https://src.getmonero.org/resources/user-guides/verification-allos-advanced.html
• Note: hashes list is available here: https://web.getmonero.org/downloads/hashes.txt.

Note: What is a hash? A hash is a unique identifier. This can be for a file, a word, ... It is preferred to use SHA256 hashes for file integration checks, as it is more secure.

You may also use the following Yara rule to detect the malicious or compromised binaries:

Recommendations

• Install an antivirus, and if possible, use a firewall (free or paid is of less importance);
• If you already use an antivirus: it may be a good idea to not exclude a specific folder in your antivirus when using Monero (or other miners), and if needed, only do so after the hashes have been verified;
• Restore your seed or account;
• How to restore your account: https://web.getmonero.org/resources/user-guides/restore_account.html
• Recovering wallet using the mnemonic seed: https://monero.stackexchange.com/questions/10/how-can-i-recover-a-wallet-using-the-mnemonic-seed
• Monitor your account/wallet for the next days and verify there have been no fraudulent transactions. Contact the Monero team for support.

Indicators

On AlienVault:

https://otx.alienvault.com/pulse/5dd4574fc7c82cddbdcb8d12

MITRE ATT&CK techniques

ID: T1195 - Supply Chain Compromise
ID: T1199 - Trusted Relationship