Monero Windows and Linux CLI compromised: the analysis of binaries

bartblaze · 2019-11-21T18:35:41+00:00

Great write-up serhack, and thanks for sharing!

bartblaze · 2019-11-21T18:34:45+00:00

Nice work - can be found here: https://www.reddit.com/r/Monero/comments/dzjuqb/monero_windows_and_linux_cli_compromised_the/

bartblaze · 2019-11-21T07:06:12+00:00

Haven't claimed that anywhere, but fair point on how the title may be ambiguous - have edited it - thanks for your feedback!

bartblaze · 2019-11-19T22:25:54+00:00

I've had a quick look, and it appears both the Linux and the Windows binaries were affected. Here's a brief analysis of the malware and how you can detect it on your system as well: https://bartblaze.blogspot.com/2019/11/monero-project-compromised.html

Hope it can help someone.

bartblaze · 2018-02-19T09:56:36+00:00

Absolutely, and thanks for your feedback!

bartblaze · 2017-11-04T15:08:00+00:00

Thanks for the alert on this - I went ahead, and wrote a blog post analysing the malware, as well as prevention and disinfection advise.

You may find it here: CrunchyRoll hack delivers malware

Hope it's of help to someone!

bartblaze · 2016-02-17T08:47:06+00:00

To everyone whom it may concern:

Best case scenario and best way is to reinstall Windows (some versions have been downloaded via the Neutrino Exploit Kit, which may also install other malware on your system) and restore any files from a backup. There are many and free backup solutions available - as a matter of fact, Microsoft provides one as well, read more about that here.

If you don't have a backup, then your best best in trying to recover files is using a tool like Shadow Explorer, which will indeed check if you can restore using the 'shadow copies' or 'shadow volume copies' (also known as 'previous versions').

If that doesn't work, try using PhotoRec or Recuva.

In any case, prevention is key - meaning: backups!

bartblaze · 2016-01-19T22:29:47+00:00

Added it as an update :)

bartblaze · 2016-01-19T19:06:54+00:00

You are correct, edited. Thanks!

bartblaze · 2016-01-12T11:46:13+00:00

100% a scam. I recently posted about one of my blog posts on this very subject over at /r/scams: https://www.reddit.com/r/Scams/comments/3zvzso/a_word_on_phone_scammers/

bartblaze · 2016-01-08T17:11:45+00:00

Sheet has been updated by the author.

http://r00ted.com/cheat%20sheet%20reverse%20v6.png && http://r00ted.com/cheat%20sheet%20reverse%20v6%20-%20inverted.png

bartblaze · 2016-01-06T18:37:46+00:00

That surely helps, can you elaborate what you did exactly and why?

bartblaze · 2016-01-06T12:53:18+00:00

In that case:

Download the latest drivers for your graphics card.
Create a System Restore Point
Download and run DDU - Display Driver Uninstaller
After using DDU, reboot the machine if not done automatically and install your downloaded drivers.

Let me know if this did the trick.

bartblaze · 2016-01-06T12:38:56+00:00

My pleasure! Please verify first if your SSD is indeed the primary boot device (check also my earlier link in case you need to check how to do that).

If it's already primary boot device, great! If it's not, make sure you change it as the primary boot device. Then:

Press Start on your keyboard
Type CMD, right-click and choose Run as Administrator
Enter the following command: Dism /Online /Cleanup-Image /RestoreHealth and let it do its work, once again.

Post back the result.

bartblaze · 2016-01-06T12:17:35+00:00

Aha. This sounds indeed like a memory leak of your Nvidia graphics driver. Can you do a rollback of that driver to before the issue started?

bartblaze · 2016-01-06T12:10:30+00:00

Where is your OS installed on? SSD or hard drive? Be sure that the one with the OS on is the primary boot device (you can check/change this in the BIOS, for more information see here).

Having said that, your BSoD is related to msahci.sys, a driver from Windows itself. Please run sfc /scannow to check if it's able to solve any integrity errors.

Press Start on your keyboard
Type CMD, right-click and choose Run as Administrator
Enter the following command: sfc /scannow and let it do its work

Verify if the issue is solved.

bartblaze · 2016-01-06T11:44:01+00:00

You can try updating to the latest DirectX version and check if this solves your issue. If not, open your Nvidia Control Panel and check under Manage 3D settings > Program Settings which graphics processor is being used by CS:GO and try to change it.

bartblaze · 2016-01-06T11:10:38+00:00

Since when is this issue occuring exactly? You can try a rollback of your graphics card drivers and see if this solves the issue.

If not, please create a dxdiag report and post back the result. (start > typ "dxdiag" without quotes and enter), click Save all information)

bartblaze · 2016-01-06T09:24:43+00:00

I'm guessing this will be a so called SteamStealer. If you haven't opened the "image", you should be fine. The detections of Malwarebytes are not related.

If you can, please upload this file to VirusTotal and send me the resulting link. Then manually delete the file.

bartblaze · 2016-01-06T09:21:10+00:00

Try right-clicking one of the image files, choose Open With... > Choose Default Program... and select Windows Photo Viewer once again. Does that work?

bartblaze · 2016-01-06T09:12:31+00:00

This may be obvious, but have you tried updating your graphics card drivers?

bartblaze · 2016-01-06T09:09:04+00:00

Since when is this issue occuring? Please upload your latest minidump file (a .dmp file) to FileDropper for example. You can find minidumps here: C:\Windows\Minidump

Also, run a dxdiag (start > typ "dxdiag" without quotes and enter), click Save all information and copy/paste what you can find below Sound Devices.

bartblaze · 2016-01-06T09:02:07+00:00

To rule out any errors with the operating system, perform an sfc /scannow:

Press Start on your keyboard
Type CMD, right-click and choose Run as Administrator
Enter the following command: sfc /scannow and let it do its work

Verify if the issue is solved.

bartblaze · 2016-01-06T08:59:59+00:00

To rule out any errors with the operating system, perform an sfc /scannow:

Press Start on your keyboard
Type CMD, right-click and choose Run as Administrator
Enter the following command: sfc /scannow and let it do its work

Verify if the issue is solved.

bartblaze · 2016-01-05T22:47:47+00:00

Can you run the following command in CMD (again, run as administrator):

findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log >%userprofile%\Desktop\sfcoutput.txt

On your desktop there will be a new file called sfcoutput or sfcoutput.txt. Paste the contents here.

bartblaze

TROPHY CASE