Open Directory Hosted Coin-Mining Malware and a Possible Mozi-Linked Payload
Summary
An investigation found suspicious files in open directories, including Windows screen savers that dropped payloads, modified firewall rules, and ran XMRig to mine Monero. BitTorrent-related DNS requests suggested possible Mozi-like activity.
Key points
- Researchers found 53 potentially malicious files across two open directories hosted on a web server in China.
- The Windows .scr files dropped HelpPane.exe and additional components into temporary directories, then used command-line tools to copy files and kill processes.
- The malware added itself to the Windows Firewall allowlist and ran XMRig to mine Monero.
- Analysis observed FTP connections to 172.240.108[.]178 on ports 21 and 2121, and mining-related connections to 141.95.206.77:3333.
- DNS requests to BitTorrent-related domains and threat alerts showing Mozi DHT configuration indicate possible Mozi-botnet involvement, though the article describes this as a possibility.
- A modified TiviMate APK in the directory had permissions associated with network access, boot persistence, and background activity; the article warns it may contain malicious modifications.
Article Details
- Attack Vectors
- The modified TiviMate APK may target Android devices; the article notes its permissions could enable autostart and background activity.
- AV.scr, Photo.scr, and Video.scr drop and execute HelpPane.exe, which drops additional files and runs commands on the infected Windows system.
- HelpPane.exe adds itself as an allowed program in the Windows Firewall using netsh.exe.
- The malware executes xmrig.exe to mine cryptocurrency using infected systems' resources.
- The article reports DNS requests to BitTorrent-related domains and says the malware may use the BitTorrent DHT for communication or distribution, possibly using techniques similar to Mozi.
- Defensive Notes
- The article advises caution when exploring or downloading files from the GitHub repository hosting the modified TiviMate APK.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 130[.]239[.]18[.]158 | IP listed among connections in the Photo.scr indicator section. |
| IPV4 | 141[.]95[.]206[.]77 | Host contacted by the malware on port 3333 and associated in the article with a cryptocurrency mining pool. |
| IPV4 | 172[.]240[.]108[.]178 | Host contacted by the malware over FTP on ports 21 and 2121. |
| IPV4 | 212[.]129[.]33[.]59 | IP listed among connections in the Photo.scr indicator section. |
| IPV4 | 45[.]235[.]49[.]49 | IP listed among the malware's connections. |
| IPV4 | 67[.]215[.]246[.]10 | IP listed among connections in the Photo.scr indicator section. |
| IPV4 | 82[.]221[.]103[.]244 | IP listed among connections in the Photo.scr indicator section. |
| IPV4 | 87[.]98[.]162[.]88 | IP listed among connections in the Photo.scr indicator section. |
| MD5 | 5616a3471565d34d779b5b3d0520bb70 | Hash of the suspicious Photo.scr.__rev7 file. |
| MD5 | a9d4007c9419a6e8d55805b8f8f52de0 | Hash of the suspicious AV.scr file. |
| SHA1 | 42df726156bee4a54ea328bd72a659602ab7d03e | Hash reported for the suspicious Photo.scr.__rev7 file. |
| SHA1 | 9f9d47ec6dd80bfcb4c3e0a1530b89d2d587c230 | Hash of the suspicious AV.scr file. |
| SHA256 | 1de815d23e82a3a94c42f5e5ac1c5dfc690a585ca495c57d2e4a283ab4008208 | Hash of a file dropped by the Photo.scr infection. |
| SHA256 | 4bf737b29ff521bc263eb1f2c1c5ea04b47470cccd1beae245d98def389929bd | Hash of xmrig.exe dropped by the AV.scr infection. |
| SHA256 | 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca | Hash reported for AV.scr and the dropped HelpPane.exe malware. |
| SHA256 | 9194b57673209c8534888f61b0cdefa34f463ae50cd78f72ab2b3348220baaf9 | Hash of xmrig.exe dropped by the Photo.scr infection. |
| SHA256 | c1a900615c9500c46b9602c30c53f299290b03632208ef1152af8830ab73ad17 | Hash of a Crypto.Cipher._AES.pyd file dropped by the Photo.scr infection. |
| SHA256 | ed551536ff22587cdf7701a279e088eb370a4121e7a3fa1f3c8b121e767318a2 | Hash of a file dropped by the AV.scr infection. |
| URL | hxxps[:]//github[.]com/skysolf/iptv/blob/main/README[.]md | GitHub repository URL traced by the article to the modified TiviMate APK, whose modifications may include malicious code. |
MITRE ATT&CK
T1059.003 · Windows Command ShellHelpPane.exe uses cmd.exe to run commands, including copying files and killing processes.T1496.001 · Compute HijackingThe malware executes xmrig.exe to mine cryptocurrency using infected systems' computing resources.T1562.004 · Disable or Modify System FirewallThe malware uses netsh.exe to add itself as an allowed program in the Windows Firewall.T1624.001The modified Android APK's RECEIVE_BOOT_COMPLETED permission is described as enabling the app to start automatically after device boot.