Network Communication With Crypto Mining Pool

  1title: Network Communication With Crypto Mining Pool
  2id: fa5b1358-b040-4403-9868-15f7d9ab6329
  3status: stable
  4description: Detects initiated network connections to crypto mining pools
  5references:
  6    - https://www.poolwatch.io/coin/monero
  7    - https://github.com/stamparm/maltrail/blob/3ea70459b9559134449423c0a7d8b965ac5c40ea/trails/static/suspicious/crypto_mining.txt
  8    - https://www.virustotal.com/gui/search/behaviour_network%253A*.miningocean.org/files
  9author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
 10date: 2021/10/26
 11modified: 2024/01/19
 12tags:
 13    - attack.impact
 14    - attack.t1496
 15logsource:
 16    category: network_connection
 17    product: windows
 18detection:
 19    selection:
 20        DestinationHostname:
 21            - 'alimabi.cn'
 22            - 'ap.luckpool.net'
 23            - 'bcn.pool.minergate.com'
 24            - 'bcn.vip.pool.minergate.com'
 25            - 'bohemianpool.com'
 26            - 'ca-aipg.miningocean.org'
 27            - 'ca-dynex.miningocean.org'
 28            - 'ca-neurai.miningocean.org'
 29            - 'ca-qrl.miningocean.org'
 30            - 'ca-upx.miningocean.org'
 31            - 'ca-zephyr.miningocean.org'
 32            - 'ca.minexmr.com'
 33            - 'ca.monero.herominers.com'
 34            - 'cbd.monerpool.org'
 35            - 'cbdv2.monerpool.org'
 36            - 'cryptmonero.com'
 37            - 'crypto-pool.fr'
 38            - 'crypto-pool.info'
 39            - 'cryptonight-hub.miningpoolhub.com'
 40            - 'd1pool.ddns.net'
 41            - 'd5pool.us'
 42            - 'daili01.monerpool.org'
 43            - 'de-aipg.miningocean.org'
 44            - 'de-dynex.miningocean.org'
 45            - 'de-zephyr.miningocean.org'
 46            - 'de.minexmr.com'
 47            - 'dl.nbminer.com'
 48            - 'donate.graef.in'
 49            - 'donate.ssl.xmrig.com'
 50            - 'donate.v2.xmrig.com'
 51            - 'donate.xmrig.com'
 52            - 'donate2.graef.in'
 53            - 'drill.moneroworld.com'
 54            - 'dwarfpool.com'
 55            - 'emercoin.com'
 56            - 'emercoin.net'
 57            - 'emergate.net'
 58            - 'ethereumpool.co'
 59            - 'eu.luckpool.net'
 60            - 'eu.minerpool.pw'
 61            - 'fcn-xmr.pool.minergate.com'
 62            - 'fee.xmrig.com'
 63            - 'fr-aipg.miningocean.org'
 64            - 'fr-dynex.miningocean.org'
 65            - 'fr-neurai.miningocean.org'
 66            - 'fr-qrl.miningocean.org'
 67            - 'fr-upx.miningocean.org'
 68            - 'fr-zephyr.miningocean.org'
 69            - 'fr.minexmr.com'
 70            - 'hellominer.com'
 71            - 'herominers.com'
 72            - 'hk-aipg.miningocean.org'
 73            - 'hk-dynex.miningocean.org'
 74            - 'hk-neurai.miningocean.org'
 75            - 'hk-qrl.miningocean.org'
 76            - 'hk-upx.miningocean.org'
 77            - 'hk-zephyr.miningocean.org'
 78            - 'huadong1-aeon.ppxxmr.com'
 79            - 'iwanttoearn.money'
 80            - 'jw-js1.ppxxmr.com'
 81            - 'koto-pool.work'
 82            - 'lhr.nbminer.com'
 83            - 'lhr3.nbminer.com'
 84            - 'linux.monerpool.org'
 85            - 'lokiturtle.herominers.com'
 86            - 'luckpool.net'
 87            - 'masari.miner.rocks'
 88            - 'mine.c3pool.com'
 89            - 'mine.moneropool.com'
 90            - 'mine.ppxxmr.com'
 91            - 'mine.zpool.ca'
 92            - 'mine1.ppxxmr.com'
 93            - 'minemonero.gq'
 94            - 'miner.ppxxmr.com'
 95            - 'miner.rocks'
 96            - 'minercircle.com'
 97            - 'minergate.com'
 98            - 'minerpool.pw'
 99            - 'minerrocks.com'
100            - 'miners.pro'
101            - 'minerxmr.ru'
102            - 'minexmr.cn'
103            - 'minexmr.com'
104            - 'mining-help.ru'
105            - 'miningpoolhub.com'
106            - 'mixpools.org'
107            - 'moner.monerpool.org'
108            - 'moner1min.monerpool.org'
109            - 'monero-master.crypto-pool.fr'
110            - 'monero.crypto-pool.fr'
111            - 'monero.hashvault.pro'
112            - 'monero.herominers.com'
113            - 'monero.lindon-pool.win'
114            - 'monero.miners.pro'
115            - 'monero.riefly.id'
116            - 'monero.us.to'
117            - 'monerocean.stream'
118            - 'monerogb.com'
119            - 'monerohash.com'
120            - 'moneroocean.stream'
121            - 'moneropool.com'
122            - 'moneropool.nl'
123            - 'monerorx.com'
124            - 'monerpool.org'
125            - 'moriaxmr.com'
126            - 'mro.pool.minergate.com'
127            - 'multipool.us'
128            - 'myxmr.pw'
129            - 'na.luckpool.net'
130            - 'nanopool.org'
131            - 'nbminer.com'
132            - 'node3.luckpool.net'
133            - 'noobxmr.com'
134            - 'pangolinminer.comgandalph3000.com'
135            - 'pool.4i7i.com'
136            - 'pool.armornetwork.org'
137            - 'pool.cortins.tk'
138            - 'pool.gntl.co.uk'
139            - 'pool.hashvault.pro'
140            - 'pool.minergate.com'
141            - 'pool.minexmr.com'
142            - 'pool.monero.hashvault.pro'
143            - 'pool.ppxxmr.com'
144            - 'pool.somec.cc'
145            - 'pool.support'
146            - 'pool.supportxmr.com'
147            - 'pool.usa-138.com'
148            - 'pool.xmr.pt'
149            - 'pool.xmrfast.com'
150            - 'pool2.armornetwork.org'
151            - 'poolchange.ppxxmr.com'
152            - 'pooldd.com'
153            - 'poolmining.org'
154            - 'poolto.be'
155            - 'ppxvip1.ppxxmr.com'
156            - 'ppxxmr.com'
157            - 'prohash.net'
158            - 'r.twotouchauthentication.online'
159            - 'randomx.xmrig.com'
160            - 'ratchetmining.com'
161            - 'seed.emercoin.com'
162            - 'seed.emercoin.net'
163            - 'seed.emergate.net'
164            - 'seed1.joulecoin.org'
165            - 'seed2.joulecoin.org'
166            - 'seed3.joulecoin.org'
167            - 'seed4.joulecoin.org'
168            - 'seed5.joulecoin.org'
169            - 'seed6.joulecoin.org'
170            - 'seed7.joulecoin.org'
171            - 'seed8.joulecoin.org'
172            - 'sg-aipg.miningocean.org'
173            - 'sg-dynex.miningocean.org'
174            - 'sg-neurai.miningocean.org'
175            - 'sg-qrl.miningocean.org'
176            - 'sg-upx.miningocean.org'
177            - 'sg-zephyr.miningocean.org'
178            - 'sg.minexmr.com'
179            - 'sheepman.mine.bz'
180            - 'siamining.com'
181            - 'sumokoin.minerrocks.com'
182            - 'supportxmr.com'
183            - 'suprnova.cc'
184            - 'teracycle.net'
185            - 'trtl.cnpool.cc'
186            - 'trtl.pool.mine2gether.com'
187            - 'turtle.miner.rocks'
188            - 'us-aipg.miningocean.org'
189            - 'us-dynex.miningocean.org'
190            - 'us-neurai.miningocean.org'
191            - 'us-west.minexmr.com'
192            - 'us-zephyr.miningocean.org'
193            - 'usxmrpool.com'
194            - 'viaxmr.com'
195            - 'webservicepag.webhop.net'
196            - 'xiazai.monerpool.org'
197            - 'xiazai1.monerpool.org'
198            - 'xmc.pool.minergate.com'
199            - 'xmo.pool.minergate.com'
200            - 'xmr-asia1.nanopool.org'
201            - 'xmr-au1.nanopool.org'
202            - 'xmr-eu1.nanopool.org'
203            - 'xmr-eu2.nanopool.org'
204            - 'xmr-jp1.nanopool.org'
205            - 'xmr-us-east1.nanopool.org'
206            - 'xmr-us-west1.nanopool.org'
207            - 'xmr-us.suprnova.cc'
208            - 'xmr-usa.dwarfpool.com'
209            - 'xmr.2miners.com'
210            - 'xmr.5b6b7b.ru'
211            - 'xmr.alimabi.cn'
212            - 'xmr.bohemianpool.com'
213            - 'xmr.crypto-pool.fr'
214            - 'xmr.crypto-pool.info'
215            - 'xmr.f2pool.com'
216            - 'xmr.hashcity.org'
217            - 'xmr.hex7e4.ru'
218            - 'xmr.ip28.net'
219            - 'xmr.monerpool.org'
220            - 'xmr.mypool.online'
221            - 'xmr.nanopool.org'
222            - 'xmr.pool.gntl.co.uk'
223            - 'xmr.pool.minergate.com'
224            - 'xmr.poolto.be'
225            - 'xmr.ppxxmr.com'
226            - 'xmr.prohash.net'
227            - 'xmr.simka.pw'
228            - 'xmr.somec.cc'
229            - 'xmr.suprnova.cc'
230            - 'xmr.usa-138.com'
231            - 'xmr.vip.pool.minergate.com'
232            - 'xmr1min.monerpool.org'
233            - 'xmrf.520fjh.org'
234            - 'xmrf.fjhan.club'
235            - 'xmrfast.com'
236            - 'xmrigcc.graef.in'
237            - 'xmrminer.cc'
238            - 'xmrpool.de'
239            - 'xmrpool.eu'
240            - 'xmrpool.me'
241            - 'xmrpool.net'
242            - 'xmrpool.xyz'
243            - 'xx11m.monerpool.org'
244            - 'xx11mv2.monerpool.org'
245            - 'xxx.hex7e4.ru'
246            - 'zarabotaibitok.ru'
247            - 'zer0day.ru'
248    condition: selection
249falsepositives:
250    - Unlikely
251level: high