ThreatFox: Mozi IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt hypothesis targets adversaries utilizing the Mozi malware family to establish command-and-control channels for initial data exfiltration and subsequent payload deployment. Proactively hunting for these specific IOCs in Azure Sentinel is critical because Mozi acts as a stealthy downloader that can rapidly expand an attack’s scope by introducing secondary threats before traditional detection mechanisms trigger.

IOC Summary

Malware Family: Mozi Total IOCs: 63 IOC Types: url

Type	Value	Threat Type	First Seen	Confidence
url	`hxxp://103[.]68[.]31[.]134:38038/Mozi.m`	payload_delivery	2026-07-23	75%
url	`hxxp://221[.]225[.]124[.]161:50875/Mozi.m`	payload_delivery	2026-07-23	75%
url	`hxxp://103[.]244[.]172[.]155:53639/Mozi.m`	payload_delivery	2026-07-23	75%
url	`hxxp://105[.]184[.]28[.]228:59307/Mozi.a`	payload_delivery	2026-07-23	75%
url	`hxxp://153[.]117[.]6[.]49:50145/Mozi.m`	payload_delivery	2026-07-23	75%
url	`hxxp://153[.]117[.]29[.]53:54397/Mozi.a`	payload_delivery	2026-07-23	75%
url	`hxxp://218[.]59[.]12[.]92:42984/Mozi.m`	payload_delivery	2026-07-23	75%
url	`hxxp://139[.]135[.]41[.]205:41015/Mozi.m`	payload_delivery	2026-07-23	75%
url	`hxxp://111[.]92[.]157[.]252:52409/Mozi.a`	payload_delivery	2026-07-23	75%
url	`hxxp://103[.]181[.]160[.]225:45451/Mozi.m`	payload_delivery	2026-07-23	75%
url	`hxxp://223[.]123[.]35[.]175:51875/Mozi.m`	payload_delivery	2026-07-23	75%
url	`hxxp://103[.]82[.]252[.]246:59187/Mozi[.]7`	payload_delivery	2026-07-23	75%
url	`hxxp://182[.]126[.]83[.]212:46410/Mozi.m`	payload_delivery	2026-07-23	75%
url	`hxxp://110[.]36[.]93[.]217:55109/Mozi.m`	payload_delivery	2026-07-23	75%
url	`hxxp://190[.]196[.]253[.]174:11865/Mozi.m`	payload_delivery	2026-07-23	75%
url	`hxxp://45[.]172[.]218[.]29:40260/Mozi.m`	payload_delivery	2026-07-23	75%
url	`hxxp://119[.]30[.]116[.]132:54360/Mozi.m`	payload_delivery	2026-07-23	75%
url	`hxxp://223[.]123[.]125[.]178:56479/Mozi.m`	payload_delivery	2026-07-23	75%
url	`hxxp://72[.]255[.]32[.]85:46993/Mozi.m`	payload_delivery	2026-07-23	75%
url	`hxxp://103[.]225[.]191[.]191:39325/Mozi.m`	payload_delivery	2026-07-23	75%
url	`hxxp://175[.]107[.]36[.]234:50510/Mozi.m`	payload_delivery	2026-07-23	75%
url	`hxxp://119[.]30[.]116[.]183:46906/Mozi[.]7`	payload_delivery	2026-07-23	75%
url	`hxxp://103[.]186[.]23[.]7:43620/Mozi.m`	payload_delivery	2026-07-23	75%
url	`hxxp://37[.]232[.]128[.]5:58602/Mozi.a`	payload_delivery	2026-07-23	75%
url	`hxxp://139[.]135[.]45[.]238:44993/Mozi[.]7`	payload_delivery	2026-07-23	75%

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Mozi
let malicious_urls = dynamic(["http://103.68.31.134:38038/Mozi.m", "http://221.225.124.161:50875/Mozi.m", "http://103.244.172.155:53639/Mozi.m", "http://105.184.28.228:59307/Mozi.a", "http://153.117.6.49:50145/Mozi.m", "http://153.117.29.53:54397/Mozi.a", "http://218.59.12.92:42984/Mozi.m", "http://139.135.41.205:41015/Mozi.m", "http://111.92.157.252:52409/Mozi.a", "http://103.181.160.225:45451/Mozi.m", "http://223.123.35.175:51875/Mozi.m", "http://103.82.252.246:59187/Mozi.7", "http://182.126.83.212:46410/Mozi.m", "http://110.36.93.217:55109/Mozi.m", "http://190.196.253.174:11865/Mozi.m", "http://45.172.218.29:40260/Mozi.m", "http://119.30.116.132:54360/Mozi.m", "http://223.123.125.178:56479/Mozi.m", "http://72.255.32.85:46993/Mozi.m", "http://103.225.191.191:39325/Mozi.m", "http://175.107.36.234:50510/Mozi.m", "http://119.30.116.183:46906/Mozi.7", "http://103.186.23.7:43620/Mozi.m", "http://37.232.128.5:58602/Mozi.a", "http://139.135.45.238:44993/Mozi.7", "http://182.116.85.178:38214/Mozi.m", "http://103.26.86.109:33900/Mozi.a", "http://223.123.43.69:52040/Mozi.m", "http://175.107.230.96:55631/Mozi.a", "http://119.30.117.164:43855/Mozi.m"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`UrlClickEvents`	Ensure this data connector is enabled

References

ThreatFox — Mozi

False Positive Guidance

False Positive Scenarios for “ThreatFox: Mozi IOCs” Rule

Scenario: Legitimate Software Updates via Enterprise Management Tools
- Context: The Mozi rule flags outbound connections to specific C2 domains. In an enterprise using Microsoft Endpoint Configuration Manager (ConfigMgr) or Jamf Pro, the update agents frequently contact vendor repositories that share IP ranges or domain patterns with known Mozi infrastructure. These automated update cycles often mimic the “downloader” behavior of Mozi by establishing persistent connections to fetch patches and payloads.
- Suggested Filter/Exclusion: Create a whitelist exclusion for traffic originating from specific service accounts (e.g., DOMAIN\EndpointMgrSvc) connecting to known vendor update domains (e.g., *.update.microsoft.com, *.jamfsoftware.com). Additionally, exclude the specific source IPs of the enterprise’s internal proxy or gateway if they are acting as intermediaries for these updates.
Scenario: Scheduled Backup and Data Exfiltration Jobs
- Context: Mozi is known for data exfiltration. Enterprise environments often run nightly scheduled jobs using tools like Veeam Backup & Replication or Rubrik, which establish C2-like connections to cloud storage buckets (AWS S3, Azure Blob) to upload backup metadata and chunks. The traffic patterns (periodic bursts of data transfer to external IPs) can closely resemble the exfiltration phase of a Mozi infection.
- Suggested Filter/Exclusion: Implement an exclusion based on the executable path and process name of the backup agents (e.g., C:\Program Files\Veeam\Backup and Replication\Engine\Veeam.Backup.Engine.exe). Furthermore, add the destination IP ranges of the organization’s designated cloud storage providers to a trusted list within the detection logic.
Scenario: Third-Party Security Scanning Appliances *