MoziMalware
Mozi is a IoT botnet, that makes use of P2P for communication and reuses source code of other well-known malware families, including Gafgyt, Mirai, and IoT Reaper.From MISP Galaxy
Last reported 4 years ago, by Elastic Security Labs1 report
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1027Obfuscated Files or Information
“MITRE ATT&CK® describes additional subtechniques for the Obfuscated Files or Information technique from the Defense Evasion tactic.As noted above, the observed anti-analysis technique used by the analyzed Mozi samples consists solely of zeroing out the 8 bytes after the “UPX!” ma…”
- T1110Brute Force
“…campaigns that can take advantage of the force multiplication provided by a botnet (Distributed Denial of Service (DDoS), email spam, brute-force, password spraying, etc.).”
- T1110.003Password Spraying
“…an take advantage of the force multiplication provided by a botnet (Distributed Denial of Service (DDoS), email spam, brute-force, password spraying, etc.).”
What the reports say
1 report, newest first · the exact sentence from each-
Collecting and operationalizing threat data from the Mozi botnet“Collecting and operationalizing threat data from the Mozi botnet”
Indicators in its reports
named in the reports above- dht.transmissionbt[.]comin 1 report
- 832fb4090879c1be…7e03ee687d3bin 1 report
- abc.abc.abc[.]abcin 1 report
- xxx.xxx.xxx[.]xxxin 1 report
- tactic[.]asin 1 report
- hxxps://github[.]com/elastic/examples/tree/master/blog/mozin-aboutin 1 report
- hxxps://cujo[.]com/upx-anti-unpacking-techniques-in-iot-malwarein 1 report
- cujo[.]comin 1 report
- hxxps://vcodispot[.]com/corrupted-upx-packed-elf-repairin 1 report
- vcodispot[.]comin 1 report
- hxxps://blag.nullteilerfrei[.]de/2019/12/26/upx-packed-elf-binaries-of-the-peer-to-peer-botnet-family-moziin 1 report
- blag.nullteilerfrei[.]dein 1 report
- hxxps://blog.netlab.360[.]com/mozi-another-botnet-using-dhtin 1 report
- hxxps://threatpost[.]com/mozi-botnet-majority-iot-traffic/159337in 1 report
Copy these 14 indicators · defanged
Thanks — we review every report.