reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/analyzing-cryptominer-malware/references/api-reference.md

@@ -0,0 +1,39 @@
+# API Reference: Analyzing Cryptominer Malware
+
+## Overview
+
+`scripts/analyst.py` extracts a coinminer's configuration from static strings: stratum pool
+endpoints, wallet addresses (Monero/Bitcoin/Ethereum formats), algorithm identifiers, miner
+family strings, and resource-control/stealth keys. It reads bytes statically, defangs pool
+endpoints, and executes nothing.
+
+## Dependencies
+
+| Package | Version | Purpose |
+|---------|---------|---------|
+| (stdlib) | — | regex, JSON, file IO |
+
+## Core functions
+
+### `profile(path)`
+Returns pool endpoints, wallet addresses (by coin), algorithms, miner family, resource controls,
+and a cryptominer likelihood flag.
+
+## Extracted indicators
+
+- **Pools**: `stratum+tcp://` / `stratum+ssl://`.
+- **Wallets**: Monero (`4…`, 95 chars), Bitcoin (legacy + bech32), Ethereum (`0x…40 hex`).
+- **Algorithms**: `rx/0`, `cn/r`, `randomx`, `kawpow`, `ethash`, etc.
+- **Resource controls**: `max-cpu-usage`, `donate-level`, `background`, `idle`.
+
+## Usage
+
+```bash
+python scripts/analyst.py profile sample.bin
+```
+
+## Sources
+
+- MITRE ATT&CK T1496 Resource Hijacking — https://attack.mitre.org/techniques/T1496/
+- XMRig configuration keys — https://xmrig.com/docs/miner/config
+- Coin address formats from each coin's public address specification