KO | EN

GitLite

Minimalist Open Source Repository Search Engine

gitlite — search

#typescript #ai-agents #developer-tools #cli #codex #claude-code #react #mcp #open-source #deepseek-harness #dsh-plugin #ai

cryptomining-malware

★ 34 Open GitHub ↗

Resources for our (extended) version of our IMC Crypto-Mining Malware paper

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Our Work

We have been looking at the Crypto-Mining Malware Ecosystem for over a decade. This repository provides further details into our investigation, [source code](code) and [data](data) used present our findings at the [2019 Internet Measurement Conference (IMC)](https://conferences.sigcomm.org/imc/2019/program/#p67). Our analysis is live and we keep getting a better understanding of this ecosystem. We have an [extended version](https://arxiv.org/pdf/1901.00846.pdf) of our IMC paper, although academic citations should look as follows for the time being:

```
@inproceedings{imc2019miners,
  title={{A First Look at the Crypto-Mining Malware Ecosystem: A Decade of Unrestricted Wealth}},
    booktitle={Proceedings of the Internet Measurement Conference (IMC)},
  year={2019},
  author={Pastrana, Sergio and Suarez-Tangil, Guillermo},
  note={Extended version: \url{https://arxiv.org/abs/1901.00846}},
  year={2019}
}
```

We next provide a summary of the most prominent campaigns found in the wild.

# Campaigns

All 2K campaigns are listed in [here](all_graphs).

## Top 10 campaigns (ranked by XMR) ##

| Campaign | Total Paid | Num. Samples | Num. Wallets |  First Payment |
| --- | --- | --- | --- | --- |
| [627](all_graphs/C627_updated.pdf) | **163,756 XMR** (20 M USD) | 66 | 7 |  2016-06-13 |
| [3027](all_graphs/C3027_updated.pdf) | **59,620 XMR** (8 M USD) | 20 | 2 |  2016-10-20 |
| [268](all_graphs/C268_updated.pdf) | **42,069 XMR** (323 K USD) | 134 | 4 |  2015-01-21 |
| [102](all_graphs/C102_updated.pdf) | **32,886 XMR** (53 K USD) | 59 | 1 |  2014-09-01 |
| [693](all_graphs/C693_updated.pdf) | **27,985 XMR** (95 K USD) | 106 | 2 |  2014-08-30 |
| [1290](all_graphs/C1290_updated.pdf) | **27,086 XMR** (1 M USD) | 91 | 14 |  2016-06-14 |
| [10465](all_graphs/C10465_updated.pdf) | **23,300 XMR** (2 M USD) | 6 | 1 |  2016-09-05 |
| [3311](all_graphs/C3311_updated.pdf) | **22,520 XMR** (5 M USD) | 9 | 1 |  2016-06-13 |
| [2642](all_graphs/C2642_updated.pdf) | **21,389 XMR** (42 K USD) | 46 | 1 |  2014-09-01 |
| [2202](all_graphs/C2202_updated.pdf) | **20,694 XMR** (38 K USD) | 25 | 1 |  2014-09-01 |

## Top 10 campaigns (ranked by size -- num. samples) ##
| Campaign | Total Paid | Num. Samples | Num. Wallets |  First Payment |
| --- | --- | --- | --- | --- |
| [4](all_graphs/C4_updated.pdf) | 13 XMR (3 K USD) | **12,327** | 1 |  2017-10-29 |
| [8](all_graphs/C8_updated.pdf) | 1,011 XMR (139 K USD) | **11,463** | 37 |  2014-11-15 |
| [40](all_graphs/C40_updated.pdf) | 68 XMR (11 K USD) | **5,589** | 2 |  2017-09-07 |
| [1](all_graphs/C1_updated.pdf) | 20 XMR (2 K USD) | **4,918** | 1 |  2018-04-06 |
| [75](all_graphs/C75_updated.pdf) | 8 XMR (58 USD) | **2,953** | 1 |  2016-10-21 |
| [63](all_graphs/C63_updated.pdf) | 0 XMR (0 USD) | **1,973** | 2 |  2018-09-27 |
| [76](all_graphs/C76_updated.pdf) | 207 XMR (18 K USD) | **1,822** | 4 |  2017-06-13 |
| [49](all_graphs/C49_updated.pdf) | 0 XMR (0 USD) | **1,787** | 1 |  1999-01-01 |
| [98](all_graphs/C98_updated.pdf) | 29 XMR (6 K USD) | **1,417** | 3 |  2017-08-20 |
| [29](all_graphs/C29_updated.pdf) | 7,261 XMR (1 M USD) | **1,092** | 38 |  2017-06-17 |

## Top 10 campaigns (ranked by size -- num. wallets) ##
| Campaign | Total Paid | Num. Samples | Num. Wallets |  First Payment |
| --- | --- | --- | --- | --- |
| [29](all_graphs/C29_updated.pdf) | 7,261 XMR (1 M USD) | 1,092 | **38** |  2017-06-17 |
| [8](all_graphs/C8_updated.pdf) | 1,011 XMR (139 K USD) | 11,463 | **37** |  2014-11-15 |
| [280](all_graphs/C280_updated.pdf) | 15 XMR (1 K USD) | 248 | **17** |  2017-10-01 |
| [1290](all_graphs/C1290_updated.pdf) | 27,086 XMR (1 M USD) | 91 | **14** |  2016-06-14 |
| [54](all_graphs/C54_updated.pdf) | 34 XMR (6 K USD) | 87 | **11** |  2017-08-05 |
| [385](all_graphs/C385_updated.pdf) | 18 XMR (3 K USD) | 82 | **8** |  2017-09-08 |
| [596](all_graphs/C596_updated.pdf) | 970 XMR (34 K USD) | 45 | **8** |  2016-11-30 |
| [627](all_graphs/C627_updated.pdf) | 163,756 XMR (20 M USD) | 66 | **7** |  2016-06-13 |
| [255](all_graphs/C255_updated.pdf) | 45 XMR (14 K USD) | 119 | **6** |  2017-12-30 |
| [755](all_graphs/C755_updated.pdf) | 39 XMR (6 K USD) | 16 | **6** |  2018-03-02 |
## Campaigns previously reported ##
| Name | Campaign | Total Paid | Num. Samples | Num. Wallets |  First Payment | Date reported | Report |
| --- | --- | --- | --- | --- | --- | --- | --- |
| Rocke | [611](all_graphs/C611_updated.pdf) |  28 XMR (4 K USD) | 37 | 3 |  2017-10-28 | August, 2018 | [CISCO Talos](https://perma.cc/ZH4B-DBG3) |
| Photominer | [8](all_graphs/C8_updated.pdf) |  1,011 XMR (139 K USD) | 11,463 | 37 |  2014-11-15 | June, 2016 | [Guardicore](https://perma.cc/JE3Y-F42L) |
| Adylkuzz | [1290](all_graphs/C1290_updated.pdf) |  27,086 XMR (1 M USD) | 91 | 14 |  2016-06-14 | May, 2017 | [Proofpoint](https://perma.cc/3V7G-CDEN) |
| Smominru | [483](all_graphs/C483_updated.pdf) |  3,897 XMR (391 K USD) | 51 | 4 |  2017-06-12 | January, 2018 | [Proofpoint](https://perma.cc/V5UR-TDLU) |
| Jenkins | [148](all_graphs/C148_updated.pdf) |  10,948 XMR (2 M USD) | 72 | 2 |  2016-09-10 | February, 2018 | [Checkpoint](https://perma.cc/SVN4-C5B4) |
| Xbooster | [29](all_graphs/C29_updated.pdf) |  7,261 XMR (1 M USD) | 1,092 | 38 |  2017-06-17 | May, 2018 | [Netskope](https://perma.cc/8RZG-5QBS) |

cryptomining-malware

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README