Analyzing cryptominer malware
Skill meltedinhex/analyst-ai-pack/skills/analyzing-cryptominer-malware
An open agent-skills library for malware analysis, reverse engineering, and threat hunting - 118 curated, runnable skills mapped to MITRE ATT&CK, D3FEND, and CAR.
npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-cryptominer-malwareAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 19 stars19 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Analyzes cryptojacking/coinminer malware by extracting mining pool endpoints (stratum), wallet addresses, algorithm and miner identifiers (XMRig and forks), and persistence or resource-control settings from static strings and config. Activates for requests to analyze a cryptominer, extract mining pool and wallet IOCs, or identify coinminer configuration.
The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.
SKILL.md
2.7 KB, as published. Nobody here has run it
Analyzing Cryptominer Malware
When to Use
- You have a suspected coinminer (often an XMRig fork) and need to extract its pool, wallet, algorithm, and resource-control configuration for IOCs and attribution.
- You are confirming a host's high CPU/GPU usage is malicious mining.
Do not use this to run the miner — extract its configuration statically.
Prerequisites
- The miner sample or its extracted config/strings, read inertly.
Safety & Handling
- Read bytes statically; defang pool endpoints; never start the miner.
Workflow
Step 1: Extract mining configuration
python scripts/analyst.py profile sample.bin
Extracts stratum+tcp:///stratum+ssl:// pool URLs, wallet addresses (Monero and common
formats), algorithm names (rx/0, cn/r, etc.), and the XMRig/miner identifier strings.
Step 2: Identify resource and stealth controls
Surface max-cpu-usage, --background, idle-detection, and donate-level settings, plus
watchdog/persistence indicators.
Step 3: Build IOCs
Record defanged pool endpoints, wallet addresses, and the miner family for detection and takedown referral.
Step 4: Document
Summarize the campaign's pool/wallet and the resource-control posture.
Validation
- Pool URLs use a recognized
stratumscheme and resolve to plausible hosts. - Wallet addresses match a known coin's format/length.
- The miner family is identified from its config keys/strings.
Pitfalls
- Legitimate mining software shares the same config keys — context (deployment, stealth) matters.
- Encrypted/packed config requiring decryption first.
- Proxy pools masking the true upstream pool.
References
- See
references/api-reference.mdfor the profiler. - ATT&CK T1496 and the XMRig config reference (linked in frontmatter).