API Reference: Analyzing Cryptominer Malware

Overview

scripts/analyst.py extracts a coinminer's configuration from static strings: stratum pool endpoints, wallet addresses (Monero/Bitcoin/Ethereum formats), algorithm identifiers, miner family strings, and resource-control/stealth keys. It reads bytes statically, defangs pool endpoints, and executes nothing.

Dependencies

Package	Version	Purpose
(stdlib)	—	regex, JSON, file IO

Core functions

`profile(path)`

Returns pool endpoints, wallet addresses (by coin), algorithms, miner family, resource controls, and a cryptominer likelihood flag.

Extracted indicators

Pools: stratum+tcp:// / stratum+ssl://.
Wallets: Monero (4…, 95 chars), Bitcoin (legacy + bech32), Ethereum (0x…40 hex).
Algorithms: rx/0, cn/r, randomx, kawpow, ethash, etc.
Resource controls: max-cpu-usage, donate-level, background, idle.

Usage

python scripts/analyst.py profile sample.bin

Sources

MITRE ATT&CK T1496 Resource Hijacking — https://attack.mitre.org/techniques/T1496/
XMRig configuration keys — https://xmrig.com/docs/miner/config
Coin address formats from each coin's public address specification

1.3 KiB Raw Blame History