Openload.co and Other Popular Alex Sites Are Abusing Client Browsers to Mining Cryptocurrency
<!--kg-card-begin: markdown--><p>As of December 24, 2017, we noticed a group of Alex top websites abusing client browser's computing power in cryptocurrency mining. The javascript code is based on CoinHive with tricks to completely circumvent CoinHive's own operations to avoid CoinHive's commission fee. A total of 22 domain names were  observed providing this kind of mining services, with earliest possible activity began on November 29, 2017.</p>
<p>Sites that use the above mining services include some popular websites such as openload.co(Alex ranking 136), oload.stream, thevideo.me, streamcherry.com, and streamango.com, which means the impact could be fairly large.</p>
<h4 id="fiveunusualdomainnames">Five Unusual Domain Names</h4>
<p>DNSMon is our DNS anomaly detection system. On 2017-12-24, the system spotted a group of domain names, with the corresponding access profiles as follows:</p>
<pre><code>do69ifsly4.me
hzsod71wov.me
kho3au7l4z.me
npdaqy6x1j.me
vg02h8z1ul.me
</code></pre>
<p><img src="__GHOST_URL__/content/images/2017/12/1_suspicous_domain.png" alt="" loading="lazy"></p>
<p>As you can see in the image above, the amazingly consistent access profiles across all the domain names suggests that traffic between different domains are likely to be driven by some same factor.</p>
<p>By using our DNSMon, we could further explore where these traffic comes from. As shown in the picture below, the above five domain names always show up together, interestingly, with an extra domain name always follows up, the streamcherry.com.</p>
<p><img src="__GHOST_URL__/content/images/2017/12/2_streamcherry.com_in_domain_time_sequence.png" alt="" loading="lazy"></p>
<h4 id="thestreamcherrycomandthesefivedomains">The streamcherry.com and These Five Domains</h4>
<p>To continue our exploration on the relationship between streamcherry and those five abnormal domains, we need to leave the DNS land, and look for data in other dimensions. In this case we can simply utilize the URL database from Virus Total to reach following URLs:</p>
<p><img src="__GHOST_URL__/content/images/2017/12/3_streamcherry_in_virustotal_url.png" alt="" loading="lazy"></p>
<p>When opened by a browser, these URLs will lead to do69ifsly4.me, one of the five abnormal domains.</p>
<p><img src="__GHOST_URL__/content/images/2017/12/3_streamcherry_is_touching_do69ifsly4_dot_me_in_browser_javascript.png" alt="" loading="lazy"></p>
<p>Further, all these 5 abnormal domains are equivalent, all providing web-socket services. This can be seen in hxxps://do69ifsly4.me/v.js. After several rounds of decoding and de-obfuscation, following JavaScript code fragment is exposed:</p>
<p><img src="__GHOST_URL__/content/images/2017/12/4_all_five_abnormal_domains_are_equivlent.png" alt="" loading="lazy"></p>
<h4 id="javascriptcodefromcoinhivewithtweaktoavoidthefairpayouts">JavaScript Code From CoinHive with Tweak to Avoid the &quot;Fair Payouts&quot;</h4>
<p>Wait a minute ... Why this code looks so familiar ... with Coinhive's XMR mining code ?</p>
<p>Let us take a look at the code comparison, Streamcherry on the left and CoinHive on the right, they use the same naming pattern to set up mining service addresses.</p>
<p><img src="__GHOST_URL__/content/images/2017/12/8_compare_miner_server_config.png" alt="" loading="lazy"></p>
<p>From the second code comparison we can see the function names of creating and starting a mining instance are also the same.</p>
<p><img src="__GHOST_URL__/content/images/2017/12/6_compare_miner_create_and_start.png" alt="" loading="lazy"></p>
<p>Now let's move on to see more code comparisons:</p>
<ul>
<li>site-key: a key configuration, used to mark different source sites, can be treated as miners' bank account；</li>
<li>throttle: another key configuration, used to control the browsers' CPU usage threshold. If adjusted to an appropriate threshold, users will be hard to notice any changes. This threshold is intended to be used to balance the end users' experience and the site's revenue;</li>
</ul>
<p><img src="__GHOST_URL__/content/images/2017/12/7_compare_miner_inner_define.png" alt="" loading="lazy"></p>
<p>Since streamcherry has already throttles the CPU usage, end users will not notice significant change when open the website. To confirm that the mining code will be executed we manually modified the JavaScript code. The two alerts in the following figures confirm that the mining object is indeed running:</p>
<p><img src="__GHOST_URL__/content/images/2017/12/9_miner_does_activated.png" alt="" loading="lazy"></p>
<p>Basically, we think streamcherry obtained the mining code from CoinHive, tweaks the computation threshold, and is abusing the end user browsers to mine XMR. In this way, they can bypass CoinHive completely and save CoinHive's 30% &quot;fair payout&quot;.</p>
<h4 id="openloadcoandothersareusingtheseminingservicedomains">openload.co and others Are Using These Mining Service Domains</h4>
<p>Just like CoinHive, streamcherry also uses site-keys to differentiate different source sites. This inspires us to hunt for more websites using the same code.</p>
<p>By now we have seen five websites using these codes.</p>
<pre><code>openload.co
oload.stream
thevideo.me
streamcherry.com
streamango.com
</code></pre>
<p><img src="__GHOST_URL__/content/images/2017/12/10_related_web_site-3.png" alt="" loading="lazy"></p>
<h4 id="totally22miningservicedomainsappearingroups">Totally 22 Mining Service Domains Appear in Groups</h4>
<p>Besides from the above 5 mining service domains, we further discover 17 mining service domains from our DNSMon system, which emerged in groups.</p>
<p>The following two figures show the number of daily active domains and their popular ranks.</p>
<p><img src="__GHOST_URL__/content/images/2017/12/11_all_mining_service_domain.png" alt="" loading="lazy"></p>
<p><img src="__GHOST_URL__/content/images/2017/12/12_all_mining_service_domain_popularity_rank.png" alt="" loading="lazy"></p>
<p>We conclude these mining service domains as follow:</p>
<ul>
<li>first appeared on 2017-11-29</li>
<li>have quite a few visiting volume and become more and more popular as time goes by</li>
<li>new domains appear periodically, while old domains are still active</li>
<li>22 domains in total and 5 domains in each groups in most case. (For the 2 domains as exception, the corresponding JavaScript code contains 7 domains)</li>
<li>While these domains looks like DGA, their generating mechanism and usage are different from the common malware.</li>
</ul>
<h4 id="ioc">IoC</h4>
<p>Mining Service Domains</p>
<pre><code>0aqpqdju.me
5vz3cfs0yd.me
6tsbe1zs.me
8jd2lfsq.me
aqqgli3vle.bid
avualrhg9p.bid
c0i8h8ac7e.bid
do69ifsly4.me
fge9vbrzwt.bid
hzsod71wov.me
iisl7wpf.me
kho3au7l4z.me
npdaqy6x1j.me
ny7f6goy.bid
r8nu86wg.me
uebawtz7.me
vcfs6ip5h6.bid
vg02h8z1ul.me
vjcyehtqm9.me
vl8c4g7tmo.me
xgmc6lu8fs.me
zgdfz6h7po.me
</code></pre>
<p>Mining Service Consumers</p>
<pre><code>openload.co
streamcherry.com
streamango.com
thevideo.me
thevideo.me
</code></pre>
<!--kg-card-end: markdown-->
As of December 24, 2017, we noticed a group of Alex top websites abusing client browser's computing power in cryptocurrency mining. The javascript code is based on CoinHive with tricks to completely circumvent CoinHive's own operations to avoid CoinHive's commission fee. A total of 22 domain names were observed providing this kind of mining services, with earliest possible activity began on November 29, 2017.


Sites that use the above mining services include some popular websites such as openload.co(Alex ranking 136), oload.stream, thevideo.me, streamcherry.com, and streamango.com, which means the impact could be fairly large.


Five Unusual Domain Names


DNSMon is our DNS anomaly detection system. On 2017-12-24, the system spotted a group of domain names, with the corresponding access profiles as follows:


do69ifsly4.me
hzsod71wov.me
kho3au7l4z.me
npdaqy6x1j.me
vg02h8z1ul.me






As you can see in the image above, the amazingly consistent access profiles across all the domain names suggests that traffic between different domains are likely to be driven by some same factor.


By using our DNSMon, we could further explore where these traffic comes from. As shown in the picture below, the above five domain names always show up together, interestingly, with an extra domain name always follows up, the streamcherry.com.





The streamcherry.com and These Five Domains


To continue our exploration on the relationship between streamcherry and those five abnormal domains, we need to leave the DNS land, and look for data in other dimensions. In this case we can simply utilize the URL database from Virus Total to reach following URLs:





When opened by a browser, these URLs will lead to do69ifsly4.me, one of the five abnormal domains.





Further, all these 5 abnormal domains are equivalent, all providing web-socket services. This can be seen in hxxps://do69ifsly4.me/v.js. After several rounds of decoding and de-obfuscation, following JavaScript code fragment is exposed:





JavaScript Code From CoinHive with Tweak to Avoid the "Fair Payouts"


Wait a minute ... Why this code looks so familiar ... with Coinhive's XMR mining code ?


Let us take a look at the code comparison, Streamcherry on the left and CoinHive on the right, they use the same naming pattern to set up mining service addresses.





From the second code comparison we can see the function names of creating and starting a mining instance are also the same.





Now let's move on to see more code comparisons:


 * site-key: a key configuration, used to mark different source sites, can be treated as miners' bank account；
 * throttle: another key configuration, used to control the browsers' CPU usage threshold. If adjusted to an appropriate threshold, users will be hard to notice any changes. This threshold is intended to be used to balance the end users' experience and the site's revenue;





Since streamcherry has already throttles the CPU usage, end users will not notice significant change when open the website. To confirm that the mining code will be executed we manually modified the JavaScript code. The two alerts in the following figures confirm that the mining object is indeed running:





Basically, we think streamcherry obtained the mining code from CoinHive, tweaks the computation threshold, and is abusing the end user browsers to mine XMR. In this way, they can bypass CoinHive completely and save CoinHive's 30% "fair payout".


openload.co and others Are Using These Mining Service Domains


Just like CoinHive, streamcherry also uses site-keys to differentiate different source sites. This inspires us to hunt for more websites using the same code.


By now we have seen five websites using these codes.


openload.co
oload.stream
thevideo.me
streamcherry.com
streamango.com






Totally 22 Mining Service Domains Appear in Groups


Besides from the above 5 mining service domains, we further discover 17 mining service domains from our DNSMon system, which emerged in groups.


The following two figures show the number of daily active domains and their popular ranks.








We conclude these mining service domains as follow:


 * first appeared on 2017-11-29
 * have quite a few visiting volume and become more and more popular as time goes by
 * new domains appear periodically, while old domains are still active
 * 22 domains in total and 5 domains in each groups in most case. (For the 2 domains as exception, the corresponding JavaScript code contains 7 domains)
 * While these domains looks like DGA, their generating mechanism and usage are different from the common malware.


IoC


Mining Service Domains


0aqpqdju.me
5vz3cfs0yd.me
6tsbe1zs.me
8jd2lfsq.me
aqqgli3vle.bid
avualrhg9p.bid
c0i8h8ac7e.bid
do69ifsly4.me
fge9vbrzwt.bid
hzsod71wov.me
iisl7wpf.me
kho3au7l4z.me
npdaqy6x1j.me
ny7f6goy.bid
r8nu86wg.me
uebawtz7.me
vcfs6ip5h6.bid
vg02h8z1ul.me
vjcyehtqm9.me
vl8c4g7tmo.me
xgmc6lu8fs.me
zgdfz6h7po.me



Mining Service Consumers


openload.co
streamcherry.com
streamango.com
thevideo.me
thevideo.me


{"version":"0.3.1","markups":[],"atoms":[],"cards":[["markdown",{"cardName":"card-markdown","markdown":"As of December 24, 2017, we noticed a group of Alex top websites abusing client browser's computing power in cryptocurrency mining. The javascript code is based on CoinHive with tricks to completely circumvent CoinHive's own operations to avoid CoinHive's commission fee. A total of 22 domain names were  observed providing this kind of mining services, with earliest possible activity began on November 29, 2017.\n\nSites that use the above mining services include some popular websites such as openload.co(Alex ranking 136), oload.stream, thevideo.me, streamcherry.com, and streamango.com, which means the impact could be fairly large.\n\n#### Five Unusual Domain Names\n\nDNSMon is our DNS anomaly detection system. On 2017-12-24, the system spotted a group of domain names, with the corresponding access profiles as follows:\n\n```\ndo69ifsly4.me\nhzsod71wov.me\nkho3au7l4z.me\nnpdaqy6x1j.me\nvg02h8z1ul.me\n```\n\n![](__GHOST_URL__/content/images/2017/12/1_suspicous_domain.png)\n\nAs you can see in the image above, the amazingly consistent access profiles across all the domain names suggests that traffic between different domains are likely to be driven by some same factor. \n\nBy using our DNSMon, we could further explore where these traffic comes from. As shown in the picture below, the above five domain names always show up together, interestingly, with an extra domain name always follows up, the streamcherry.com.\n\n![](__GHOST_URL__/content/images/2017/12/2_streamcherry.com_in_domain_time_sequence.png)\n\n#### The streamcherry.com and These Five Domains\n\nTo continue our exploration on the relationship between streamcherry and those five abnormal domains, we need to leave the DNS land, and look for data in other dimensions. In this case we can simply utilize the URL database from Virus Total to reach following URLs:\n\n![](__GHOST_URL__/content/images/2017/12/3_streamcherry_in_virustotal_url.png)\n\nWhen opened by a browser, these URLs will lead to do69ifsly4.me, one of the five abnormal domains.\n\n![](__GHOST_URL__/content/images/2017/12/3_streamcherry_is_touching_do69ifsly4_dot_me_in_browser_javascript.png)\n\nFurther, all these 5 abnormal domains are equivalent, all providing web-socket services. This can be seen in hxxps://do69ifsly4.me/v.js. After several rounds of decoding and de-obfuscation, following JavaScript code fragment is exposed:\n\n![](__GHOST_URL__/content/images/2017/12/4_all_five_abnormal_domains_are_equivlent.png)\n\n\n####  JavaScript Code From CoinHive with Tweak to Avoid the \"Fair Payouts\"\n\nWait a minute ... Why this code looks so familiar ... with Coinhive's XMR mining code ?\n\nLet us take a look at the code comparison, Streamcherry on the left and CoinHive on the right, they use the same naming pattern to set up mining service addresses.\n\n![](__GHOST_URL__/content/images/2017/12/8_compare_miner_server_config.png)\n\nFrom the second code comparison we can see the function names of creating and starting a mining instance are also the same.\n\n![](__GHOST_URL__/content/images/2017/12/6_compare_miner_create_and_start.png)\n\nNow let's move on to see more code comparisons:\n\n - site-key: a key configuration, used to mark different source sites, can be treated as miners' bank account；\n - throttle: another key configuration, used to control the browsers' CPU usage threshold. If adjusted to an appropriate threshold, users will be hard to notice any changes. This threshold is intended to be used to balance the end users' experience and the site's revenue;\n\n![](__GHOST_URL__/content/images/2017/12/7_compare_miner_inner_define.png)\n\nSince streamcherry has already throttles the CPU usage, end users will not notice significant change when open the website. To confirm that the mining code will be executed we manually modified the JavaScript code. The two alerts in the following figures confirm that the mining object is indeed running:\n\n![](__GHOST_URL__/content/images/2017/12/9_miner_does_activated.png)\n\nBasically, we think streamcherry obtained the mining code from CoinHive, tweaks the computation threshold, and is abusing the end user browsers to mine XMR. In this way, they can bypass CoinHive completely and save CoinHive's 30% \"fair payout\".\n\n#### openload.co and others Are Using These Mining Service Domains\n\nJust like CoinHive, streamcherry also uses site-keys to differentiate different source sites. This inspires us to hunt for more websites using the same code.\n\nBy now we have seen five websites using these codes.\n\n```\nopenload.co\noload.stream\nthevideo.me\nstreamcherry.com\nstreamango.com\n```\n\n![](__GHOST_URL__/content/images/2017/12/10_related_web_site-3.png)\n\n#### Totally 22 Mining Service Domains Appear in Groups\n\nBesides from the above 5 mining service domains, we further discover 17 mining service domains from our DNSMon system, which emerged in groups.\n\nThe following two figures show the number of daily active domains and their popular ranks.\n\n![](__GHOST_URL__/content/images/2017/12/11_all_mining_service_domain.png)\n\n![](__GHOST_URL__/content/images/2017/12/12_all_mining_service_domain_popularity_rank.png)\n\nWe conclude these mining service domains as follow:\n\n  - first appeared on 2017-11-29\n  - have quite a few visiting volume and become more and more popular as time goes by\n  - new domains appear periodically, while old domains are still active\n  - 22 domains in total and 5 domains in each groups in most case. (For the 2 domains as exception, the corresponding JavaScript code contains 7 domains)\n  - While these domains looks like DGA, their generating mechanism and usage are different from the common malware.\n\n#### IoC\nMining Service Domains\n```\n0aqpqdju.me\n5vz3cfs0yd.me\n6tsbe1zs.me\n8jd2lfsq.me\naqqgli3vle.bid\navualrhg9p.bid\nc0i8h8ac7e.bid\ndo69ifsly4.me\nfge9vbrzwt.bid\nhzsod71wov.me\niisl7wpf.me\nkho3au7l4z.me\nnpdaqy6x1j.me\nny7f6goy.bid\nr8nu86wg.me\nuebawtz7.me\nvcfs6ip5h6.bid\nvg02h8z1ul.me\nvjcyehtqm9.me\nvl8c4g7tmo.me\nxgmc6lu8fs.me\nzgdfz6h7po.me\n```\n\nMining Service Consumers\n\n```\nopenload.co\nstreamcherry.com\nstreamango.com\nthevideo.me\nthevideo.me\n```"}]],"sections":[[10,0]],"ghostVersion":"3.0"}