⛏️
#CoinIMP: MintMe JavaScript mining in your browser
🌕 The
#MintMe cryptocurrency, with the
#Lyra2 webchain algorithm, is mined using a compiled
#WebAssembly module controlled via
#JavaScript code that connects to the mining pool by a
#WebSocket
Sequence of Events:
⏩ Browse HTML page → Load JS Miner Worker → Load WASM Miner Binary → WebSocket
📥 Components loaded by the miner:
💾️ Obfuscated JS wrapper code (~ 130 kb)
💾 Obfuscated JS miner launcher (~ 3 kb)
💾️ XORed .wasm module (~ 25 kb)
🛠️ More Details:
Miner configuration is hard-coded inside the JavaScript body:
[LIB_URL, ASMJS_NAME, WEBSOCKET_SHARDS_W, OUR_SITEKEYS, MINER_HOST etc]
XORed .wasm module gets loaded from an external source:
[www.hostingcloud[.]racing/L2drCvN6.wasm]
JS wrapper communicates via an encrypted XOR masked WebSocket with the mining pool:
[s11.hostcontent[.]live/sv8HPzAu]
💡 A similar scheme was previously observed in
#CoinHive. Replacing
#cryptonight-webchain with
#lyra2-webchain is a step towards reducing the hash rate difference between high-end and low-end processors at the cost of memory usage.
Examples of infected websites:
➡️
app.any.run/tasks/52b3277a-f…
➡️
app.any.run/tasks/e7eaae92-1…
Check suspicious links with
#ANYRUN! 🔎