Official Monero Website Hacked, Delivers Backdoored Software

Figure 1 – Create wallet (legitimate)

Figure 2 – Call new seed function

The seed will be sent to: node.hashmonero[.]com.

cryptonote::simple_wallet::send_to_cc

As you may have guessed, this function will send data off to the CC or C2 (command and control) server – this will be stolen funds.

Figure 3 – Send to cc

Sending funds to the C2 is handled using an HTTP POST request to the following C2 servers:

• node.xmrsupport[.]co
• 45.9.148[.]65

As far I can see, it doesn’t seem to create any additional files or folders – it simply steals your seed and attempts to exfiltrate funds from your wallet.

Windows binary

The C2 server 45.9.148[.]65 also hosts a Windows binary with the following properties:

• MD5: 72417ab40b8ed359a37b72ac8d399bd7
• SHA-1: 6bd94803b3487ae1997238614c6c81a0f18bcbb0
• SHA-256: 963c1dfc86ff0e40cee176986ef9f2ce24fda53936c16f226c7387e1a3d67f74
• File type: Win32 EXE
• Magic: PE32+ executable for MS Windows (console) Mono/.Net assembly
• File size: 65.14 MB (68302960 bytes

The Windows version is essentially doing the same things as the Linux version – stealing your seed and wallet funds – the function names are just different, e.g. _ZN10cryptonote13simple_wallet9send_seedERKN4epee15wipeable_stringE.

Figure 4 – Send to cc

Note: this doesn’t mean the official Windows binary was also compromised – it simply means there’s also a compromised Windows binary out there. Only the Monero team can confirm if other binaries (besides the Linux one mentioned in this blog) have been compromised.

Detection

• If you have a firewall or proxy, whether hardware or software, verify if you had any network traffic or connections to;
• • node.hashmonero[.]com
  • node.xmrsupport[.]co
  • 45.9.148[.]65
  • 91.210.104[.]245
• Remove all the binaries listed in this blog post;
• Verify the hashes of your Monero setup or installer file. Guides to do that here;

• Install an antivirus, and if possible, use a firewall (free or paid is of less importance);
• If you already use an antivirus: it may be a good idea to not exclude a specific folder in your antivirus when using Monero (or other miners), and if needed, only do so after the hashes have been verified;
• Restore your seed or account;
• Monitor your account/wallet for the next days and verify there have been no fraudulent transactions. Contact the Monero team for support.

On AlienVault:

https://otx.alienvault.com/pulse/5dd4574fc7c82cddbdcb8d12