Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Gateway to Intrusion: Malware Delivery Via Open Directories

hunt.io | blog | #asyncrat | #open-directories | #malware-delivery | #supershell | #bits | #fernet

Summary

Two case studies of malware delivered via open directories: an AsyncRAT chain using VBScript and BITS to fetch a staged payload, and a Fernet-wrapped Python executable beside a SuperShell login page.
Published
Collected

original ↗

Related coverage

blog · hunt.io
Paste.ee Abuse Uncovered: XWorm & AsyncRAT Infrastructure
An obfuscated JavaScript downloader abusing paste.ee to stage payloads leads researchers to XWorm and AsyncRAT C2 infrastructure, with regex and SSL detection guidance for defenders.
blog · hunt.io
Uncovering Threat Actor Tactics: How Open Directories Provide Insight into XWorm Delivery Strategies
Using open directories, Hunt.io shows how XWorm RAT samples masquerade as browsers, security tools and file-transfer apps—including a lone SecurityHealthService.exe on a Thai-hosted server.
blog · hunt.io
In Plain Sight: Uncovering SuperShell & Cobalt Strike from an Open Directory
While hunting IOX copies, Hunt found an open directory holding two SuperShell/GOREVERSE payloads and a Linux ELF Cobalt Strike beacon, and shows how /supershell/login panels can be tracked.
blog · hunt.io
The Accidental Malware Repository: Hunting & Collecting Malware Via Open Directories (Part 1)
First in a hunting series: an open directory holding a phishing site and XWorm RAT, whose spoofed login pages — blockchain and device-verification lures — steal credentials and seed phrases.
blog · hunt.io
A Practical Guide to Uncovering Malicious Infrastructure With Hunt.io
A step-by-step infrastructure hunting walkthrough: from an AsyncRAT-linked IP, pivoting through ASN data, ports, services and TLS certificates to uncover a wider cluster of systems.
blog · hunt.io
The Complete Guide to Hunting Cobalt Strike – Part 1: Detecting in Open Directories
Part 1 of the Cobalt Strike series: using AttackCapture to mine open directories for PowerShell loaders and configs, then pivoting via SSL certificates and fingerprints to map live C2 servers.
back