Trick or treat?
summary
Researchers collect ~20,000 miner samples, extract Stratum configs and wallet addresses with YARA rules, decode packed binaries and memory with Volatility memory dumps, and parse JSON‑RPC in PCAPs to pull pool host:port pairs. Internet-wide discovery uses Shodan/OnifSense plus parsing of pool websites, yielding ~8,000 Stratum endpoints (≈4,000 live, ~1,000 IPs, ~12,000 domains). A scanner and Snort rules run against those endpoints, indicators land in MISP, and the GitHub repo hosts the scripts and rules.
AI-written summary · about
chapters (23)
- 0:00Intro
- 3:17ryptomining malware is still a thing
- 4:47Mining pools 101
- 6:46We developed different strategies to identify Stratum servers
- 8:47Let's hunt for interesting samples
- 9:25Processing workflow (static analysis)
- 10:56Here are some way to specify Stratum server
- 12:10Dynamic analysis
- 13:22Extracting Stratum configuration from PCAPS
- 15:26Looking for stratum servers over the Internet
- 15:48Search Engines for Connected Hosts
- 16:27Keywords to identify stratum servers
- 18:05Identifying Mining Pool Websites
- 19:19Extracting config: JS config file + API call
- 20:38Extracting config: parsing HTML
- 21:34Extracting config: (Parsing HTML) + API Call
- 23:00Stratum TCP Scanner
- 23:48Collected data
- 27:14Default ports?
- 29:55Scanning Internet
- 34:46Docker exploitations?
- 37:11Killing the competition
- 38:11Very persistent miner
related talks
41mInternet Spelunking: IPv6 Scanning and Device Fingerprinting
43mWho are the people in your neighborhood? Tracking 'Shady' CIDR blocks
28mBlue Team Fundamentals
58mWhere did you find that?
47mDetecting and analyzing files-less malware
48mDawn Of The Dead: The Tale Of The Resurrected Domains
43mAttack or Noise?: Tracking and Evaluating the Impact of Internet-Wide Survey Scanners
21mRise of Coinminers