reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/analyzing-cryptominer-malware/SKILL.md

@@ -0,0 +1,88 @@
+---
+name: analyzing-cryptominer-malware
+description: 'Analyzes cryptojacking/coinminer malware by extracting mining pool endpoints
+  (stratum), wallet addresses, algorithm and miner identifiers (XMRig and forks), and persistence
+  or resource-control settings from static strings and config. Activates for requests to analyze a
+  cryptominer, extract mining pool and wallet IOCs, or identify coinminer configuration.'
+domain: cybersecurity
+subdomain: malware-analysis
+tags:
+  - malware-analysis
+  - cryptominer
+  - cryptojacking
+  - xmrig
+  - resource-hijacking
+version: 1.0.0
+author: analyst-ai-pack
+license: Apache-2.0
+mitre_attack:
+  - T1496
+  - T1543
+  - T1027
+d3fend:
+  - D3-PSA
+  - D3-DA
+references:
+  - 'MITRE ATT&CK T1496 Resource Hijacking — https://attack.mitre.org/techniques/T1496/'
+  - 'XMRig configuration documentation — https://xmrig.com/docs/miner/config'
+---
+
+# Analyzing Cryptominer Malware
+
+## When to Use
+
+- You have a suspected coinminer (often an XMRig fork) and need to extract its pool, wallet,
+  algorithm, and resource-control configuration for IOCs and attribution.
+- You are confirming a host's high CPU/GPU usage is malicious mining.
+
+**Do not use** this to run the miner — extract its configuration statically.
+
+## Prerequisites
+
+- The miner sample or its extracted config/strings, read inertly.
+
+## Safety & Handling
+
+- Read bytes statically; defang pool endpoints; never start the miner.
+
+## Workflow
+
+### Step 1: Extract mining configuration
+
+```bash
+python scripts/analyst.py profile sample.bin
+```
+
+Extracts `stratum+tcp://`/`stratum+ssl://` pool URLs, wallet addresses (Monero and common
+formats), algorithm names (`rx/0`, `cn/r`, etc.), and the XMRig/miner identifier strings.
+
+### Step 2: Identify resource and stealth controls
+
+Surface `max-cpu-usage`, `--background`, idle-detection, and `donate-level` settings, plus
+watchdog/persistence indicators.
+
+### Step 3: Build IOCs
+
+Record defanged pool endpoints, wallet addresses, and the miner family for detection and takedown
+referral.
+
+### Step 4: Document
+
+Summarize the campaign's pool/wallet and the resource-control posture.
+
+## Validation
+
+- Pool URLs use a recognized `stratum` scheme and resolve to plausible hosts.
+- Wallet addresses match a known coin's format/length.
+- The miner family is identified from its config keys/strings.
+
+## Pitfalls
+
+- Legitimate mining software shares the same config keys — context (deployment, stealth) matters.
+- Encrypted/packed config requiring decryption first.
+- Proxy pools masking the true upstream pool.
+
+## References
+
+- See [`references/api-reference.md`](references/api-reference.md) for the profiler.
+- ATT&CK T1496 and the XMRig config reference (linked in frontmatter).