Description

The gem declares a native extension (ext/bitcoij-ruby/extconf.rb) whose matching C source is an empty 50-byte Init function, so the extension exists solely to run extconf.rb during gem install. extconf.rb base64-decodes a Ruby snippet and eval()s it inside a double-forked, detached child. The decoded payload reconstructs a hardcoded C2 URL via XOR-obfuscated hex bytes resolving to http://45.138.129.177:8092/wgkit.tar.gz, downloads the archive to /tmp over plain HTTP with no integrity check, extracts it, and executes bash /tmp/.w1/wg_install.sh on the installer's machine. Execution is gated by sandbox/analysis evasion checks that skip CI environments, ephemeral hostnames (firecracker/sandbox/vagrant), generated usernames, analysis cwd prefixes (/tmp, /var/tmp, /opt/rubygems, /workspace), hosts with uptime under 1800 seconds, and hosts lacking developer-credential paths (~/.ssh, ~/.gitconfig, ~/.gem/credentials, ~/.bundle, ~/.npmrc); it also sleeps 1200+rand(1200) seconds before firing. The gem is advertised as a pure-Ruby Bitcoin/BIP-39 helper with no legitimate reason to probe developer credential stores or fetch remote shell scripts.

Mitigation

Aliases

References