tactic[.]asDomain
Reported by 1 independent source · first reported by Elastic Security Labs · last reported
Last reported 4 years ago
What the reports say
1 report, newest first · the exact sentence from each-
Collecting and operationalizing threat data from the Mozi botnet“MITRE ATT&CK® describes additional subtechniques for the Obfuscated Files or Information technique from the Defense Evasion tactic[.]As noted above, the observed anti-analysis technique used by the analyzed Mozi samples consists solely of zeroing out the 8 bytes after the “UPX!” ma…”
Indicators reported together
named in the same reports- dht.transmissionbt[.]comin 1 report
- 832fb4090879c1be…7e03ee687d3bin 1 report
- abc.abc.abc[.]abcin 1 report
- xxx.xxx.xxx[.]xxxin 1 report
- hxxps://github[.]com/elastic/examples/tree/master/blog/mozin-aboutin 1 report
- hxxps://cujo[.]com/upx-anti-unpacking-techniques-in-iot-malwarein 1 report
- cujo[.]comin 1 report
- hxxps://vcodispot[.]com/corrupted-upx-packed-elf-repairin 1 report
- vcodispot[.]comin 1 report
- hxxps://blag.nullteilerfrei[.]de/2019/12/26/upx-packed-elf-binaries-of-the-peer-to-peer-botnet-family-moziin 1 report
- blag.nullteilerfrei[.]dein 1 report
- hxxps://blog.netlab.360[.]com/mozi-another-botnet-using-dhtin 1 report
- hxxps://threatpost[.]com/mozi-botnet-majority-iot-traffic/159337in 1 report
Copy these 13 indicators · defanged
Thanks — we review every report.