This hunt detects adversary activity involving connections to known Mozi malware distribution channels by identifying traffic to a curated set of 39 malicious URLs. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly identify and isolate potential initial access or command-and-control communications before the malware establishes persistence on endpoints.
Threat: Mozi Total URLs: 39 Active URLs: 39
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://124.131.53.180:42721/i | online | malware_download | 2026-08-07 |
hxxp://182.121.144.189:60356/bin.sh | online | malware_download | 2026-08-07 |
hxxp://39.90.145.143:54042/bin.sh | online | malware_download | 2026-08-07 |
hxxp://125.43.35.24:55742/bin.sh | online | malware_download | 2026-08-07 |
hxxp://123.14.93.190:47055/i | online | malware_download | 2026-08-07 |
hxxp://124.131.53.180:42721/bin.sh | online | malware_download | 2026-08-07 |
hxxp://115.48.148.245:54758/i | online | malware_download | 2026-08-07 |
hxxp://110.37.84.212:34554/bin.sh | online | malware_download | 2026-08-07 |
hxxp://110.36.80.162:46146/i | online | malware_download | 2026-08-07 |
hxxp://42.232.226.240:39898/i | online | malware_download | 2026-08-07 |
hxxp://182.121.141.220:34479/i | online | malware_download | 2026-08-07 |
hxxp://42.225.228.107:44103/bin.sh | online | malware_download | 2026-08-07 |
hxxp://42.225.228.107:44103/i | online | malware_download | 2026-08-07 |
hxxp://182.121.141.220:34479/bin.sh | online | malware_download | 2026-08-07 |
hxxp://110.36.80.162:46146/bin.sh | online | malware_download | 2026-08-07 |
hxxp://182.113.205.38:37725/i | online | malware_download | 2026-08-07 |
hxxp://115.61.120.117:43905/i | online | malware_download | 2026-08-07 |
hxxp://221.15.90.244:47446/i | online | malware_download | 2026-08-07 |
hxxp://221.1.226.175:51370/bin.sh | online | malware_download | 2026-08-07 |
hxxp://115.58.130.246:33076/bin.sh | online | malware_download | 2026-08-07 |
hxxp://125.41.8.245:37624/i | online | malware_download | 2026-08-07 |
hxxp://124.131.154.251:35768/bin.sh | online | malware_download | 2026-08-07 |
hxxp://125.44.212.22:49662/bin.sh | online | malware_download | 2026-08-07 |
hxxp://42.239.252.36:36560/bin.sh | online | malware_download | 2026-08-07 |
hxxp://182.121.144.189:60356/i | online | malware_download | 2026-08-07 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["42.225.228.107", "124.131.154.251", "123.14.93.190", "182.113.205.38", "125.43.35.24", "110.39.239.253", "110.39.231.36", "42.232.226.240", "124.131.53.180", "182.116.9.201", "110.37.84.212", "115.58.130.246", "182.121.144.189", "115.48.148.245", "115.61.120.117", "221.15.90.244", "182.121.141.220", "125.41.8.245", "42.239.252.36", "221.1.226.175", "110.36.80.162", "42.231.92.171", "125.44.212.22", "39.90.145.143"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["42.225.228.107", "124.131.154.251", "123.14.93.190", "182.113.205.38", "125.43.35.24", "110.39.239.253", "110.39.231.36", "42.232.226.240", "124.131.53.180", "182.116.9.201", "110.37.84.212", "115.58.130.246", "182.121.144.189", "115.48.148.245", "115.61.120.117", "221.15.90.244", "182.121.141.220", "125.41.8.245", "42.239.252.36", "221.1.226.175", "110.36.80.162", "42.231.92.171", "125.44.212.22", "39.90.145.143"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Here are 4 specific false positive scenarios for the URLhaus: Mozi Malicious URLs detection rule, tailored for a legitimate enterprise environment:
Scenario: Automated Security Scanning by Internal Tools
C:\Program Files\CrowdStrike\csfalcon.exe or Tenable Agent Service) and restrict the alert to exclude traffic originating from the “Security” or “Infrastructure” security group in Active Directory.Scenario: Scheduled Backup and Synchronization Jobs
Veeam Backup Service or OneDrive Sync) combined with a time-window filter, excluding alerts generated during off-hours maintenance windows (e.g., 02:00 – 05:00 local time) for these specific service accounts.Scenario: Admin-Driven Software Updates and Patch Management