Analyzing Cryptominer Malware

When to Use

• You have a suspected coinminer (often an XMRig fork) and need to extract its pool, wallet, algorithm, and resource-control configuration for IOCs and attribution.
• You are confirming a host's high CPU/GPU usage is malicious mining.

Do not use this to run the miner — extract its configuration statically.

Prerequisites

• The miner sample or its extracted config/strings, read inertly.

Safety & Handling

• Read bytes statically; defang pool endpoints; never start the miner.

Workflow

Step 1: Extract mining configuration

python scripts/analyst.py profile sample.bin

Extracts stratum+tcp:///stratum+ssl:// pool URLs, wallet addresses (Monero and common formats), algorithm names (rx/0, cn/r, etc.), and the XMRig/miner identifier strings.

Step 2: Identify resource and stealth controls

Surface max-cpu-usage, --background, idle-detection, and donate-level settings, plus watchdog/persistence indicators.

Step 3: Build IOCs

Record defanged pool endpoints, wallet addresses, and the miner family for detection and takedown referral.

Step 4: Document

Summarize the campaign's pool/wallet and the resource-control posture.

Validation

• Pool URLs use a recognized stratum scheme and resolve to plausible hosts.
• Wallet addresses match a known coin's format/length.
• The miner family is identified from its config keys/strings.

Pitfalls

• Legitimate mining software shares the same config keys — context (deployment, stealth) matters.
• Encrypted/packed config requiring decryption first.
• Proxy pools masking the true upstream pool.

References

• See references/api-reference.md for the profiler.
• ATT&CK T1496 and the XMRig config reference (linked in frontmatter).