Malware News Supply chain compromise: Hola Browser's delivery pipeline inadvertently bundled crypto-mining malware (me.exe) with legitimate browser installations

[Khushal]

Content source

https://www.sophos.com/en-us/blog/you-do-surprise-me-exe-an-unexpected-executable-in-hola-browser

Sophos X-Ops Investigation Findings

You do surprise me.exe: An unexpected executable in Hola Browser

Following a certification test, Sophos X-Ops found an unexpected guest had hitched a ride

www.sophos.com

The malicious payload me.exe (SHA-256: e3541caf708c075f0bb22fc68b03acd8457fea7cf0732ea935b1eb016d1c7721) is an XMRig-derived cryptocurrency miner identified by security software as Troj/GoMiner-B. Upon execution, the binary duplicates itself to C:\Program Files\Hola\HolaMonitorService.exe and establishes persistence by registering an automatic startup service named "hola_monitor_svc". Embedded text strings within the code—such as "killed orphan miner pid %d", "user active, stopping miner", and "m/cmd/xmrig-idle"—reveal that the malware tracks user presence to blend in. To evade detection and run efficiently, it manipulates Windows Defender to add security exclusions and restricts its mining operations to periods when the host system is completely idle. Furthermore, the binary is entirely unsigned, employs obfuscation techniques to mask its intent, and features capabilities to write directly to system memory.

DFIR Artifacts

Forensic evidence of this activity includes Windows System event logs capturing the unauthorized creation of the "hola_monitor_svc" service, alongside file system telemetry showing unexpected file writes within the Hola installation directory that do not align with legitimate software components. Additionally, process execution logs confirm that HolaMonitorService.exe actively ran and initiated outbound network connections to external cryptocurrency mining pools.

Threat Hunting Strategy

To proactively detect this threat, hunt across the environment for unauthorized and unsigned executables residing within standard software installation directories. Prioritize the investigation of any anomalies that attempt to register system services or manipulate antivirus exclusion lists.

 

[Bot]

That Sophos write-up describes behavior that is clearly malicious, not just a questionable browser component.

Why it is malicious

• It drops and runs an XMRig-derived crypto miner.
• It creates persistence through a Windows service named hola_monitor_svc.
• It attempts to add Microsoft Defender exclusions to reduce detection.
• It is designed to mine only while the system is idle, which is a common stealth tactic.
• It is unsigned and uses obfuscation, both of which increase suspicion.

A legitimate browser component should not be silently installing a miner, modifying security settings, or registering disguised services for covert background activity.

What defenders should look for

• The file C:\Program Files\Hola\HolaMonitorService.exe
• A service named hola_monitor_svc
• Defender exclusion changes that were not approved by the administrator
• Unexpected outbound connections to mining pools
• Execution of unsigned binaries from normal application folders
• System or EDR logs showing service creation events tied to the Hola path

Practical response steps

• Isolate affected systems from the network if active mining or persistence is confirmed.
• Stop and remove the malicious service.
• Delete the dropped executable only after preserving copies if incident response or forensic review is needed.
• Review Microsoft Defender exclusions and remove any unauthorized entries.
• Run a full scan with reputable security software.
• Check for additional persistence mechanisms, scheduled tasks, startup entries, and related payloads.
• Reset credentials if there is evidence the host was more broadly compromised, because miners can sometimes arrive with other malware.

Threat hunting value

The hunting guidance is sensible because this kind of threat often blends into trusted-looking install paths.

Useful pivots include:

• Unsigned executables under Program Files or vendor folders
• New service creation events
• Processes spawning from application directories that should normally contain only signed vendor binaries
• Connections to known mining infrastructure
• Security control tampering, especially AV exclusion changes

Bottom line

Based on the quoted findings, this is a malware incident involving persistence, defense evasion, and illicit cryptomining. Systems showing these indicators should be treated as compromised and investigated accordingly.