What Gridinsoft observed on Mouzi.cc
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260825044534-8d7f5382
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Safe
- Evidence basis
- First-party site analysis External vendor intelligence: Contradictory context — not used for this decision
The independent current review supports Safe for mouzi.cc and its six current release links. A fresh Gridinsoft rescan reached the homepage with HTTP 200 and recorded no positive behavior signal. All 35 sitemap URLs remained on-site and exposed no form, credential prompt, iframe, automatic download, meta refresh, or scripted external redirect. The download links lead to the disclosed GitHub v0.1.5 release; five downloaded files matched GitHub's SHA-256 records, and source plus successful release workflows are public. The exact MSI has a public malicious sandbox score, but its visible indicators describe conditional installation of Microsoft's official Edge WebView2 prerequisite. The downloaded child exactly matches Microsoft's current file, and the report names no malware family or Mouzi command-and-control behavior. Eleven malicious and one suspicious vendor results remain broad blacklist labels without an exact current harmful object. Unsigned Windows artifacts reduce publisher assurance and should be signed, but do not establish malware. Safe describes the reviewed deployment and release set, not future content or a reproducible-build certification.
Analyst findings
Review 9 documented observations View evidence
A fresh supported Gridinsoft rescan reached the exact HTTPS root with HTTP 200, stayed on mouzi.cc, and identified the Mouzi homepage. Before correction, Suspicious Website was retained by a broad domain signature even though the fresh first-party report contained no positive behavioral signal and identified no current harmful path, response, script, redirect, or download.
-
HTTP status
200 -
Final URL
https://mouzi.cc/ - Page element Title: Mouzi | The fastest way to find your files
- Analyst observation The fresh supported rescan recorded an empty current positive-signal list; the prior result was supplied by a broad domain signature.
All 35 public URLs enumerated from the current sitemap returned HTTP 200 and remained on mouzi.cc. Desktop, Android, crawler, and command-line request profiles received byte-identical root HTML. Across the 35 pages there were no forms, password inputs, iframes, meta-refresh instructions, scripted location changes, or automatic external navigation. The www host redirected once to the HTTPS apex.
-
HTTP status
200 -
Final URL
https://mouzi.cc/ -
Redirect destination
https://mouzi.cc/ - Analyst observation Thirty-five sitemap URLs returned same-host HTTP 200 responses; 0 forms, 0 password inputs, 0 iframes, 0 meta refresh directives, and 0 scripted location assignments were found.
- Analyst observation Root HTML SHA-256 for all four request profiles: b82e4be21d3df9e2c4bb72198d5bc925e187eab64416664a00cc85b24d76bd0f.
The current site exposed six explicit download links, all to the public GitHub release v0.1.5: Windows setup, MSI, portable executable, AppImage, Debian package, and RPM. Five downloaded artifacts matched the SHA-256 digests published by GitHub's release API; the AppImage digest was also recorded from that API. The site did not start any download automatically. The public repository, tagged source, successful release workflows, and release assets were mutually consistent.
- Public artifact URL https://github.com/hsr88/mouzi/releases/tag/v0.1.5
- Public artifact URL https://github.com/hsr88/mouzi/tree/v0.1.5
- File SHA-256 ee9b173aaa10c03fac5c201345cb388115bbb0c78e2e294a92d18fad454e99a2
- File SHA-256 b04f976ef5ee95b1c8b282f4c487daac1cc58390cf3bd4cc22a3f1cea720ed90
- File SHA-256 ee7852f57933642c998526d52bd022e49e63dfc6321304c9630c9961ce96585a
- File SHA-256 6801341766201a7a2a6c45fb3217757567b27507bef74b5e7bf6d847fdbfc5bb
- File SHA-256 73301c563a7c00dd4a68d143550d953ca8644c206a7603b4f3f8be066e0efe6a
- File SHA-256 62a2e565f4dcd3e6a19c19122d4399b77684c07826419d2515a1e1aa532f56d6
A public Hybrid Analysis report marked the exact current MSI malicious with a threat score of 85, while also showing no malware family and 0 of 24 MetaDefender detections. Its visible adverse indicators describe hidden PowerShell downloading Microsoft's Edge WebView2 bootstrapper from go.microsoft.com, silently installing it, and Microsoft Edge Update processes. The MSI itself contains that conditional Tauri/WiX prerequisite command. A direct download from the same official Microsoft URL had the exact SHA-256 of the sandbox child, showing that the observed process activity belongs to the official runtime installer rather than to an identified Mouzi malware payload.
- Public artifact URL https://www.hybrid-analysis.com/sample/b04f976ef5ee95b1c8b282f4c487daac1cc58390cf3bd4cc22a3f1cea720ed90
- Public artifact URL https://developer.microsoft.com/en-us/microsoft-edge/webview2/
- File SHA-256 94314d8b20c8a370df81c5cc3d8d7a3e23fe5de14ef5e988229ff3208e449146
- Analyst observation The MSI command invokes the WebView2 bootstrapper only when an installed WebView2 version is not present; no Mouzi malware family, command-and-control host, or credential collection behavior was identified by the public report.
The public Rust and Tauri application source implements a local file-search utility backed by local files and SQLite. Source review found no configured application telemetry receiver or arbitrary remote service; explicit external-open actions point to the Mouzi site, GitHub, and Ko-fi. The website source is a static Astro deployment. The tagged release and subsequent asset-rebuild revision differ only in release documentation, date text, and the rebuild workflow rather than security-sensitive application behavior.
- Public artifact URL https://github.com/hsr88/mouzi
- Public artifact URL https://github.com/hsr88/mouzi/compare/b32e5ca...a75feaa
- Analyst observation No implemented application telemetry sender, credential receiver, remote-control endpoint, downloader, persistence mechanism, or arbitrary command execution path was identified in the reviewed source.
urlscan returned five records mentioning the domain. The relevant direct records included the apex and an older v0.1.0 setup executable and assigned no classification. One unrelated submitted softgratuit.eu URL redirected to mouzi.cc; that chain was an inbound third-party redirect to Mouzi, not an outbound redirect initiated by mouzi.cc. The older executable record preserved SHA-256 9787cd17239db5e6e43645f01095e4a595b4926dde96cb36aa357d6e25042c55 and no verdict.
- Public artifact URL https://urlscan.io/domain/mouzi.cc
- File SHA-256 9787cd17239db5e6e43645f01095e4a595b4926dde96cb36aa357d6e25042c55
- Analyst observation The softgratuit.eu record shows an external site redirecting into mouzi.cc; it does not show mouzi.cc redirecting visitors to the external site or serving a malicious object.
Four Wayback root snapshots from May through August 2026 consistently preserve the Mouzi file-search site. The May snapshots link the same-host v0.1.0 Windows downloads, the June snapshot links v0.1.3 Windows and Linux downloads, and the August snapshot links the current v0.1.5 GitHub release. None of the four archived roots contained a form, password field, iframe, meta refresh, or scripted location assignment.
- Public artifact URL https://web.archive.org/web/20260515191719/https://mouzi.cc/
- Public artifact URL https://web.archive.org/web/20260520095927/https://mouzi.cc/
- Public artifact URL https://web.archive.org/web/20260616115256/https://mouzi.cc/
- Public artifact URL https://web.archive.org/web/20260818074212/https://mouzi.cc/
AlienVault OTX reported zero pulses for the exact domain. Searches of publicly indexed sandbox, URL-scan, threat-intelligence, malware-sample, and general web records found no harmful exact Mouzi URL or sample beyond the Hybrid Analysis MSI report reviewed separately. The fresh external matrix contained 45 harmless, eleven malicious, one suspicious, and 33 undetected results; all adverse entries were blacklist classifications and supplied no current object-level trace.
- Public artifact URL https://otx.alienvault.com/indicator/domain/mouzi.cc
- Analyst observation URLhaus and ThreatFox public API requests required authorization; Common Crawl and crt.sh were unavailable during review. Unavailable sources were treated as unverified, not clean.
- Analyst observation mouzi.cc is itself the registrable apex, so the exact host and requested parent-domain scope are the same object. www.mouzi.cc is a redirecting alias to the apex; no broader parent verdict was inferred.
The reviewed portable and setup executables did not contain an Authenticode security directory, and the project states that code signing is pending. This reduces independently verifiable publisher identity and can increase reputation warnings, but it is a provenance and hardening weakness rather than evidence of malware behavior.
- Analyst observation Portable and NSIS setup PE Security Directory values were zero; no Authenticode signature was present.
- Public artifact URL https://mouzi.cc/download
Scope and limitations
- The verdict covers the publicly reachable mouzi.cc apex, its www redirect, all 35 sitemap URLs, and the six v0.1.5 release links exposed at the recorded time; content and release objects can change after publication.
- Five of six release assets were downloaded and hashed directly. The AppImage digest was verified against the GitHub release API but the AppImage itself was not downloaded during this review.
- Source, tags, workflow history, and release assets were reviewed, but a clean-room byte-for-byte rebuild of every release artifact was not performed.
- The Windows setup and portable executables were unsigned at review time. This limits publisher-identity assurance even though no malicious behavior was identified.
- The public Hybrid Analysis report covered the current MSI. Not every release asset had an available public dynamic-analysis report, and no private commercial sandbox or authenticated threat-intelligence dataset was used.
- Public search, sandbox, URL-scan, threat-intelligence, and archive indexes are incomplete. Sources that required authentication or were unavailable were treated as unverified, not clean.
- No private hosting account, build runner, signing account, repository secret, local user data, or server filesystem was penetration-tested.
Help protect others by sharing this page on social media! The more people who know about mouzi.cc, the fewer chances they have to deceive someone else. Help others evaluate mouzi.cc by sharing this page on social media!