40 lines
1.3 KiB
Markdown
40 lines
1.3 KiB
Markdown
# API Reference: Analyzing Cryptominer Malware
|
|
|
|
## Overview
|
|
|
|
`scripts/analyst.py` extracts a coinminer's configuration from static strings: stratum pool
|
|
endpoints, wallet addresses (Monero/Bitcoin/Ethereum formats), algorithm identifiers, miner
|
|
family strings, and resource-control/stealth keys. It reads bytes statically, defangs pool
|
|
endpoints, and executes nothing.
|
|
|
|
## Dependencies
|
|
|
|
| Package | Version | Purpose |
|
|
|---------|---------|---------|
|
|
| (stdlib) | — | regex, JSON, file IO |
|
|
|
|
## Core functions
|
|
|
|
### `profile(path)`
|
|
Returns pool endpoints, wallet addresses (by coin), algorithms, miner family, resource controls,
|
|
and a cryptominer likelihood flag.
|
|
|
|
## Extracted indicators
|
|
|
|
- **Pools**: `stratum+tcp://` / `stratum+ssl://`.
|
|
- **Wallets**: Monero (`4…`, 95 chars), Bitcoin (legacy + bech32), Ethereum (`0x…40 hex`).
|
|
- **Algorithms**: `rx/0`, `cn/r`, `randomx`, `kawpow`, `ethash`, etc.
|
|
- **Resource controls**: `max-cpu-usage`, `donate-level`, `background`, `idle`.
|
|
|
|
## Usage
|
|
|
|
```bash
|
|
python scripts/analyst.py profile sample.bin
|
|
```
|
|
|
|
## Sources
|
|
|
|
- MITRE ATT&CK T1496 Resource Hijacking — https://attack.mitre.org/techniques/T1496/
|
|
- XMRig configuration keys — https://xmrig.com/docs/miner/config
|
|
- Coin address formats from each coin's public address specification
|