analyzing-cryptominer-malware

Name: analyzing-cryptominer-malware
Author: meltedinhex

18stars5forks

How to install analyzing-cryptominer-malware?

meltedinhex/analyst-ai-pack/analyzing-cryptominer-malware

$npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-cryptominer-malware

Installs into the current project.

Summary

Analyzes cryptojacking/coinminer malware by extracting mining pool endpoints

Files · 1

View on GitHub

SKILL.md

1	# Analyzing Cryptominer Malware
2
3	## When to Use
4
5	- You have a suspected coinminer (often an XMRig fork) and need to extract its pool, wallet,
6	algorithm, and resource-control configuration for IOCs and attribution.
7	- You are confirming a host's high CPU/GPU usage is malicious mining.
8
9	Do not use this to run the miner — extract its configuration statically.
10
11	## Prerequisites
12
13	- The miner sample or its extracted config/strings, read inertly.
14
15	## Safety & Handling
16
17	- Read bytes statically; defang pool endpoints; never start the miner.
18
19	## Workflow
20
21	### Step 1: Extract mining configuration
22
23	```bash
24	python scripts/analyst.py profile sample.bin
25	```
26
27	Extracts `stratum+tcp://`/`stratum+ssl://` pool URLs, wallet addresses (Monero and common
28	formats), algorithm names (`rx/0`, `cn/r`, etc.), and the XMRig/miner identifier strings.
29
30	### Step 2: Identify resource and stealth controls
31
32	Surface `max-cpu-usage`, `--background`, idle-detection, and `donate-level` settings, plus
33	watchdog/persistence indicators.
34
35	### Step 3: Build IOCs
36
37	Record defanged pool endpoints, wallet addresses, and the miner family for detection and takedown
38	referral.
39
40	### Step 4: Document
41
42	Summarize the campaign's pool/wallet and the resource-control posture.
43
44	## Validation
45
46	- Pool URLs use a recognized `stratum` scheme and resolve to plausible hosts.
47	- Wallet addresses match a known coin's format/length.
48	- The miner family is identified from its config keys/strings.
49
50	## Pitfalls
51
52	- Legitimate mining software shares the same config keys — context (deployment, stealth) matters.
53	- Encrypted/packed config requiring decryption first.
54	- Proxy pools masking the true upstream pool.
55
56	## References
57
58	- See [`references/api-reference.md`](references/api-reference.md) for the profiler.
59	- ATT&CK T1496 and the XMRig config reference (linked in frontmatter).

People who liked this also viewed

6 picks

Type

find-skillsHelps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skSkillsJul 20262.6M27k
grill-meA relentless interview to sharpen a plan or design.SkillsJul 2026633k182k
vercel-react-best-practicesVercel's official collection of agent skillsSkillsJul 2026573k29k
improve-codebase-architectureScan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.SkillsJul 2026522k182k
setup-matt-pocock-skillsConfigure this repo for the engineering skills — set up its issue tracker, triage label vocabulary, and domain doc layout. Run once before first use of the other engineering skills.SkillsJul 2026454k182k
triageMove issues and external PRs through a state machine of triage roles — categorise, verify, grill if needed, and write agent-ready briefs.SkillsJul 2026424k182k

analyzing-cryptominer-malware

18stars5forks

View on GitHub

How to install analyzing-cryptominer-malware?

meltedinhex/analyst-ai-pack/analyzing-cryptominer-malware

$npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-cryptominer-malware

Installs into the current project.

Summary

Analyzes cryptojacking/coinminer malware by extracting mining pool endpoints

Files · 1

View on GitHub

SKILL.md

1	# Analyzing Cryptominer Malware
2
3	## When to Use
4
5	- You have a suspected coinminer (often an XMRig fork) and need to extract its pool, wallet,
6	algorithm, and resource-control configuration for IOCs and attribution.
7	- You are confirming a host's high CPU/GPU usage is malicious mining.
8
9	Do not use this to run the miner — extract its configuration statically.
10
11	## Prerequisites
12
13	- The miner sample or its extracted config/strings, read inertly.
14
15	## Safety & Handling
16
17	- Read bytes statically; defang pool endpoints; never start the miner.
18
19	## Workflow
20
21	### Step 1: Extract mining configuration
22
23	```bash
24	python scripts/analyst.py profile sample.bin
25	```
26
27	Extracts `stratum+tcp://`/`stratum+ssl://` pool URLs, wallet addresses (Monero and common
28	formats), algorithm names (`rx/0`, `cn/r`, etc.), and the XMRig/miner identifier strings.
29
30	### Step 2: Identify resource and stealth controls
31
32	Surface `max-cpu-usage`, `--background`, idle-detection, and `donate-level` settings, plus
33	watchdog/persistence indicators.
34
35	### Step 3: Build IOCs
36
37	Record defanged pool endpoints, wallet addresses, and the miner family for detection and takedown
38	referral.
39
40	### Step 4: Document
41
42	Summarize the campaign's pool/wallet and the resource-control posture.
43
44	## Validation
45
46	- Pool URLs use a recognized `stratum` scheme and resolve to plausible hosts.
47	- Wallet addresses match a known coin's format/length.
48	- The miner family is identified from its config keys/strings.
49
50	## Pitfalls
51
52	- Legitimate mining software shares the same config keys — context (deployment, stealth) matters.
53	- Encrypted/packed config requiring decryption first.
54	- Proxy pools masking the true upstream pool.
55
56	## References
57
58	- See [`references/api-reference.md`](references/api-reference.md) for the profiler.
59	- ATT&CK T1496 and the XMRig config reference (linked in frontmatter).

People who liked this also viewed

6 picks

Type