gsuareztangil / cryptomining-malware

Resources for our (extended) version of our IMC Crypto-Mining Malware paper

Home Page:https://arxiv.org/abs/1901.00846

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Our Work

We have been looking at the Crypto-Mining Malware Ecosystem for over a decade. This repository provides further details into our investigation, source code and data used present our findings at the 2019 Internet Measurement Conference (IMC). Our analysis is live and we keep getting a better understanding of this ecosystem. We have an extended version of our IMC paper, although academic citations should look as follows for the time being:

@inproceedings{imc2019miners,
  title={{A First Look at the Crypto-Mining Malware Ecosystem: A Decade of Unrestricted Wealth}},
    booktitle={Proceedings of the Internet Measurement Conference (IMC)},
  year={2019},
  author={Pastrana, Sergio and Suarez-Tangil, Guillermo},
  note={Extended version: \url{https://arxiv.org/abs/1901.00846}},
  year={2019}
}

We next provide a summary of the most prominent campaigns found in the wild.

Campaigns

All 2K campaigns are listed in here.

Top 10 campaigns (ranked by XMR)

Campaign Total Paid Num. Samples Num. Wallets First Payment
627 163,756 XMR (20 M USD) 66 7 2016-06-13
3027 59,620 XMR (8 M USD) 20 2 2016-10-20
268 42,069 XMR (323 K USD) 134 4 2015-01-21
102 32,886 XMR (53 K USD) 59 1 2014-09-01
693 27,985 XMR (95 K USD) 106 2 2014-08-30
1290 27,086 XMR (1 M USD) 91 14 2016-06-14
10465 23,300 XMR (2 M USD) 6 1 2016-09-05
3311 22,520 XMR (5 M USD) 9 1 2016-06-13
2642 21,389 XMR (42 K USD) 46 1 2014-09-01
2202 20,694 XMR (38 K USD) 25 1 2014-09-01

Top 10 campaigns (ranked by size -- num. samples)

Campaign Total Paid Num. Samples Num. Wallets First Payment
4 13 XMR (3 K USD) 12,327 1 2017-10-29
8 1,011 XMR (139 K USD) 11,463 37 2014-11-15
40 68 XMR (11 K USD) 5,589 2 2017-09-07
1 20 XMR (2 K USD) 4,918 1 2018-04-06
75 8 XMR (58 USD) 2,953 1 2016-10-21
63 0 XMR (0 USD) 1,973 2 2018-09-27
76 207 XMR (18 K USD) 1,822 4 2017-06-13
49 0 XMR (0 USD) 1,787 1 1999-01-01
98 29 XMR (6 K USD) 1,417 3 2017-08-20
29 7,261 XMR (1 M USD) 1,092 38 2017-06-17

Top 10 campaigns (ranked by size -- num. wallets)

Campaign Total Paid Num. Samples Num. Wallets First Payment
29 7,261 XMR (1 M USD) 1,092 38 2017-06-17
8 1,011 XMR (139 K USD) 11,463 37 2014-11-15
280 15 XMR (1 K USD) 248 17 2017-10-01
1290 27,086 XMR (1 M USD) 91 14 2016-06-14
54 34 XMR (6 K USD) 87 11 2017-08-05
385 18 XMR (3 K USD) 82 8 2017-09-08
596 970 XMR (34 K USD) 45 8 2016-11-30
627 163,756 XMR (20 M USD) 66 7 2016-06-13
255 45 XMR (14 K USD) 119 6 2017-12-30
755 39 XMR (6 K USD) 16 6 2018-03-02

Campaigns previously reported

Name Campaign Total Paid Num. Samples Num. Wallets First Payment Date reported Report
Rocke 611 28 XMR (4 K USD) 37 3 2017-10-28 August, 2018 CISCO Talos
Photominer 8 1,011 XMR (139 K USD) 11,463 37 2014-11-15 June, 2016 Guardicore
Adylkuzz 1290 27,086 XMR (1 M USD) 91 14 2016-06-14 May, 2017 Proofpoint
Smominru 483 3,897 XMR (391 K USD) 51 4 2017-06-12 January, 2018 Proofpoint
Jenkins 148 10,948 XMR (2 M USD) 72 2 2016-09-10 February, 2018 Checkpoint
Xbooster 29 7,261 XMR (1 M USD) 1,092 38 2017-06-17 May, 2018 Netskope

About

Resources for our (extended) version of our IMC Crypto-Mining Malware paper

https://arxiv.org/abs/1901.00846


Languages

Language:Python 99.7%Language:YARA 0.3%