https://blog.efespain.com/en/tags/monero/A honeypot in some corner of the network. Every infection, a story worth telling.HugoeneFeSpaineFeSpain2026 eFeSpainTue, 01 Sep 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-28/Tue, 01 Sep 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-28/The two previous chapters left the kit taken apart piece by piece, and one question unanswered: who it pays. I went looking. And what I found was a design that prevents it — the mining config never travels inside the critter, it gets downloaded afterwards — and scaffolding somebody had already dismantled. This is the chase, what it does plant when you let it run, and how far what I can prove about who's behind it actually goes.https://blog.efespain.com/en/chapter-24/Tue, 01 Sep 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-24/The previous chapter left a number unexplained: the backdoor was deleting a different process on every installation, and that can't be known in advance. I open the miner and the answer shows up — a template with the gap already reserved. Along the way out comes the wallet the money goes to, behind encryption that's frankly laughable.https://blog.efespain.com/en/chapter-25/Tue, 01 Sep 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-25/The teardown left me a Monero wallet and a question the binary doesn't answer: how much has this thing earned. Monero is built so no balance can be looked up — but the pool they mine against publishes per-wallet statistics, and that's an open page. What turned up when I asked: one wallet collecting since January 2021, another already running months before it showed up in any sample, about twenty-three dollars a day, and an electricity bill paid by the victims that comes to more than the operator makes.https://blog.efespain.com/en/chapter-15/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-15/I built a cage, ran the miner and pulled from memory the configuration I couldn't decrypt back in chapter 6. I got excited… and walked away with two things I wasn't looking for: that this family was already documented top to bottom —somewhere it never occurred to me to look— and that the piece I thought I'd decrypted was for something else.https://blog.efespain.com/en/chapter-13/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-13/In chapter 10 I caught the miner, but not the thing that hands it out: that part I told on loan, using someone else's analysis. The honeypot holds a grudge, and brought me the whole thing — armoured three times over, with a blob that resisted everything I know how to do. Until I stopped trying to read it.https://blog.efespain.com/en/chapter-10/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-10/Another APK came in through the debug cable, but this one weighs fifteen times less than the last and doesn't carry a single line of native code. I opened it expecting something mediocre. What I found was a 2018 fossil still infecting phones to mine for a company that shut down seven years ago — and which today, without knowing it, warns its own victims.https://blog.efespain.com/en/chapter-5/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-5/The previous critter kicked the door in with wget. This one walked in with an SSH key in its pocket, cleared the house of rival miners, and settled in with a professional's manners. It's RedTail, and it plays in a different league.