agentsclimarketplace

Analyzing cryptominer malware

Skill meltedinhex/analyst-ai-pack/skills/analyzing-cryptominer-malware

An open agent-skills library for malware analysis, reverse engineering, and threat hunting - 118 curated, runnable skills mapped to MITRE ATT&CK, D3FEND, and CAR.

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-cryptominer-malware

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 19 stars19 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Analyzes cryptojacking/coinminer malware by extracting mining pool endpoints (stratum), wallet addresses, algorithm and miner identifiers (XMRig and forks), and persistence or resource-control settings from static strings and config. Activates for requests to analyze a cryptominer, extract mining pool and wallet IOCs, or identify coinminer configuration.

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.7 KB, as published. Nobody here has run it

Analyzing Cryptominer Malware

When to Use

  • You have a suspected coinminer (often an XMRig fork) and need to extract its pool, wallet, algorithm, and resource-control configuration for IOCs and attribution.
  • You are confirming a host's high CPU/GPU usage is malicious mining.

Do not use this to run the miner — extract its configuration statically.

Prerequisites

  • The miner sample or its extracted config/strings, read inertly.

Safety & Handling

  • Read bytes statically; defang pool endpoints; never start the miner.

Workflow

Step 1: Extract mining configuration

python scripts/analyst.py profile sample.bin

Extracts stratum+tcp:///stratum+ssl:// pool URLs, wallet addresses (Monero and common formats), algorithm names (rx/0, cn/r, etc.), and the XMRig/miner identifier strings.

Step 2: Identify resource and stealth controls

Surface max-cpu-usage, --background, idle-detection, and donate-level settings, plus watchdog/persistence indicators.

Step 3: Build IOCs

Record defanged pool endpoints, wallet addresses, and the miner family for detection and takedown referral.

Step 4: Document

Summarize the campaign's pool/wallet and the resource-control posture.

Validation

  • Pool URLs use a recognized stratum scheme and resolve to plausible hosts.
  • Wallet addresses match a known coin's format/length.
  • The miner family is identified from its config keys/strings.

Pitfalls

  • Legitimate mining software shares the same config keys — context (deployment, stealth) matters.
  • Encrypted/packed config requiring decryption first.
  • Proxy pools masking the true upstream pool.

References

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.