minergate加矿池

① 网络流量威胁-xmrig协议PCAP分析

1、xmrig木马

挖矿木马成为黑产团伙的主要获利方式之一，也成为了企业内部安全的主要威胁之一。门罗币很多僵尸网络也把挖矿作为主要的获利手段。本文分析挖矿连接的行为。

2、具体样本

样本具有连接xmrig矿池通信行为，xmrig协议通信；

3、PCAP分析

相关实验的 xmrig通信PCAP

DNS  Standard query   A xmr.pool.minergate.com

xmrig协议格式【1】

request：

{"id":x,"jsonrpc":"2.0","method":"login","params":{"login":"xxxxxx","pass":"x","agent":"xxxxx","algo":["xxx","xxx","xxx"]}}

{"id":x,"jsonrpc":"2.0","method":"submit","params":{"id":"xxxx","job_id":"xx","nonce":"xxxx","result":"xxxxxxx"}}

response：

{"params":{"blob":"xxxxxx","taget":"xxxx","job_id":"xxxxx"},"method":"xxx"} 

本次抓包具体例子：

{"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"xxx","pass":"x","agent":"Static XMRig/2.13.1 (Linux x86_64) libuv/1.24.1 gcc/6.4.0","algo":["cn","cn/r","cn/wow","cn/2","cn/1","cn/0","cn/half","cn/xtl","cn/msr","cn/xao","cn/rto","cn/gpu"]}}

② 用家里的电脑挖矿可以吗

普通电脑可以选择一些挖矿难度不大的币进行挖，目前门罗币（XMR）挖矿难度相对不大，下面将以我个人经验进行说明。

工具/原料

• minergate v6.8

方法/步骤

• 第一步，注册账户，打开网站hminergate.com

  打开网站后点击右上角sign up。