Attack Chain

1. A user downloads and installs the “Calendar 2” application from the official Mac App Store.
2. Upon launch, the application’s applicationDidFinishLaunching: delegate method executes.
3. This triggers a call to [MinerManager manager] which initializes a MinerManager object.
4. During initialization, the runMining method is invoked.
5. The runMining method interacts with the Coinstash_XMRSTAK.framework, specifically calling the +[Coinstash_XMRSTAK.Coinstash startMiningWithPort:password:coreCount:slowMemory:currency:] method.
6. This method executes the xmr-stak miner binary located within the framework.
7. The xmr-stak miner connects to a mining pool (pool.graft.hashvault.pro:7777) and begins mining Monero (XMR) using CPU resources.
8. The application periodically sends mining statistics to calendar.qbix.com/api/mining.

Impact

The “Calendar 2” application surreptitiously utilized users’ CPU resources to mine Monero, leading to performance degradation and increased power consumption. While the exact number of affected users is unknown, the application’s presence on the Mac App Store suggests a potentially wide reach. Successful exploitation could lead to reduced system lifespan due to increased heat and stress on hardware components. The mining profits accrued by the developer, greg@qbix.com, at the expense of unsuspecting users.

Recommendation

• Monitor process creations for the execution of xmr-stak from within application frameworks, using the provided Sigma rule, to detect potentially malicious cryptocurrency mining activity.
• Enable process monitoring with command-line argument logging to identify processes connecting to known cryptocurrency mining pools (see xmr-stak command-line arguments in the attack chain).
• Inspect network traffic for connections to calendar.qbix.com/api/mining to identify applications reporting mining statistics.
• Deploy the file integrity monitoring rule to track changes in application frameworks that may indicate the addition of mining capabilities.