Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Coin Miner and Mozi Botnet

hunt.io | blog | #malware | #android | #apk | #open-directories | #coin-miner | #mozi-botnet

Summary

Hunt examined an open directory on a Chinese web server holding 53 suspicious files — coin miners, a tampered TiviMate APK with risky Android permissions, and .m3u files targeting mobile devices.
Published
Collected

original ↗

Related coverage

blog · hunt.io
Caught in the Act: Uncovering SpyNote in Unexpected Places
Hunt uncovered SpyNote Android spyware samples in open directories, disguised as Google Translate, Temp Mail and Deutsche Postbank apps, detailing how the leaked spyware steals user data.
blog · hunt.io
Redis Cryptomining Botnet Compromised 3,562 Servers, Exposed by the Operator's Own Files
Hunt.io parsed a Redis cryptomining botnet's own exposed logs: 3,562 servers compromised, rogue replication as the only technique that scaled, and 72.6% success against a no-auth target list.
blog · hunt.io
The Complete Guide to Hunting Cobalt Strike – Part 1: Detecting in Open Directories
Part 1 of the Cobalt Strike series: using AttackCapture to mine open directories for PowerShell loaders and configs, then pivoting via SSL certificates and fingerprints to map live C2 servers.
blog · hunt.io
Uncovering Threat Actor Tactics: How Open Directories Provide Insight into XWorm Delivery Strategies
Using open directories, Hunt.io shows how XWorm RAT samples masquerade as browsers, security tools and file-transfer apps—including a lone SecurityHealthService.exe on a Thai-hosted server.
blog · hunt.io
RunningRAT’s Next Move: From Remote Access to Crypto mining For Profit
Hunt.io spots RunningRAT—previously an access and data-theft tool linked to 2018 Olympics campaigns—now staging crypto-mining payloads via open directories and a separate staging VPS.
blog · hunt.io
Tricks, Treats, and Threats: Cobalt Strike & the Goblin Lurking in Plain Sight
A Halloween-themed open directory on a Hong Kong host exposed Cobalt Strike 4.2, exploit code, the BrowserGhost tool and a Goblin phishing kit aimed at Chinese-speaking education platforms.
back