SECURITY REVIEW
Not yet assessed
Review the original instructions and requested permissions before installing.
No security review is available for this catalog entry yet.
Community / AGENT SKILL
analyzing-cryptominer-malware
0
Analyzes cryptojacking/coinminer malware by extracting mining pool endpoints (stratum), wallet addresses, algorithm and miner identifiers (XMRig and forks), and persistence or resource-control settings from static strings and config. Activates for requests to analyze a cryptominer, extract mining pool and wallet IOCs, or identify coinminer configuration.
Understand the trade-offs.
SKILL QUALITY
Not yet assessed
How clearly the skill guides your agent, how complete its workflow is, and how you can check the outcome.
No quality assessment is available for this catalog entry yet.
The full skill.
Original instructions from the publisher’s SKILL.md
# Analyzing Cryptominer Malware ## When to Use - You have a suspected coinminer (often an XMRig fork) and need to extract its pool, wallet, algorithm, and resource-control configuration for IOCs and attribution. - You are confirming a host's high CPU/GPU usage is malicious mining. **Do not use** this to run the miner — extract its configuration statically. ## Prerequisites - The miner sample or its extracted config/strings, read inertly. ## Safety & Handling - Read bytes statically; defang pool endpoints; never start the miner. ## Workflow ### Step 1: Extract mining configuration ```bash python scripts/analyst.py profile sample.bin ``` Extracts `stratum+tcp://`/`stratum+ssl://` pool URLs, wallet addresses (Monero and common formats), algorithm names (`rx/0`, `cn/r`, etc.), and the XMRig/miner identifier strings. ### Step 2: Identify resource and stealth controls Surface `max-cpu-usage`, `--background`, idle-detection, and `donate-level` settings, plus watchdog/persistence indicators. ### Step 3: Build IOCs Record defanged pool endpoints, wallet addresses, and the miner family for detection and takedown referral. ### Step 4: Document Summarize the campaign's pool/wallet and the resource-control posture. ## Validation - Pool URLs use a recognized `stratum` scheme and resolve to plausible hosts. - Wallet addresses match a known coin's format/length. - The miner family is identified from its config keys/strings. ## Pitfalls - Legitimate mining software shares the same config keys — context (deployment, stealth) matters. - Encrypted/packed config requiring decryption first. - Proxy pools masking the true upstream pool. ## References - See [`references/api-reference.md`](references/api-reference.md) for the profiler. - ATT&CK T1496 and the XMRig config reference (linked in frontmatter).