agentsclimarketplace
Sign in

Analyzing cryptominer malware

Skill meltedinhex/analyst-ai-pack/skills/analyzing-cryptominer-malware

Analyzes cryptojacking/coinminer malware by extracting mining pool endpoints (stratum), wallet addresses, algorithm and miner identifiers (XMRig and forks), and persistence or resource-control settings from static strings and config. Activates for requests to analyze a cryptominer, extract mining pool and wallet IOCs, or identify coinminer configuration.From its SKILL.md

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-cryptominer-malware

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

  • 21 stars21 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
  • runs commandsInstructs the agent to run 1 command, including `python scripts/analyst.py profile sample.bin`.

What its file declares

Copied from the file, not written here

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.7 KB, 426 tokens by cl100k_base, as published. Nobody here has run it

Analyzing Cryptominer Malware

When to Use

  • You have a suspected coinminer (often an XMRig fork) and need to extract its pool, wallet, algorithm, and resource-control configuration for IOCs and attribution.
  • You are confirming a host's high CPU/GPU usage is malicious mining.

Do not use this to run the miner — extract its configuration statically.

Prerequisites

  • The miner sample or its extracted config/strings, read inertly.

Safety & Handling

  • Read bytes statically; defang pool endpoints; never start the miner.

Workflow

Step 1: Extract mining configuration

python scripts/analyst.py profile sample.bin

Extracts stratum+tcp:///stratum+ssl:// pool URLs, wallet addresses (Monero and common formats), algorithm names (rx/0, cn/r, etc.), and the XMRig/miner identifier strings.

Step 2: Identify resource and stealth controls

Surface max-cpu-usage, --background, idle-detection, and donate-level settings, plus watchdog/persistence indicators.

Step 3: Build IOCs

Record defanged pool endpoints, wallet addresses, and the miner family for detection and takedown referral.

Step 4: Document

Summarize the campaign's pool/wallet and the resource-control posture.

Validation

  • Pool URLs use a recognized stratum scheme and resolve to plausible hosts.
  • Wallet addresses match a known coin's format/length.
  • The miner family is identified from its config keys/strings.

Pitfalls

  • Legitimate mining software shares the same config keys — context (deployment, stealth) matters.
  • Encrypted/packed config requiring decryption first.
  • Proxy pools masking the true upstream pool.

References

What ships with it: 3 files

4.1 KB alongside SKILL.md, 1 of them executable

references/

scripts/

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.