zerofox logo
Advisories

Mozi Botnet Analysis

|by Alpha Team

banner image

Mozi Botnet Analysis

Netlab recently published a blog identifying a botnet using Distributed Hash Table (DHT) dubbed Mozi. This botnet uses the DHT protocol to build its P2P botnet that has been spreading through Telnet with weak passwords as well as some known exploits for various systems and software and performs a variety of attacks controlled from the botnet master.

Recommendations

  • Make sure you patch and update any networking appliances which could be impacted by the vulnerabilities listed in this advisory
  • It is recommended to use YARA or similiar file scanning software to analyze potentially malicious files
  • Evaluate network traffic to identify potentially nefarious communications, especially those using DHT/P2P

Details

Mozi gets its name from the propogation sample file, Mozi.m and Mozi.a, and currently performs a variety of attacks, including:

  • DDoS attacks
  • Collecting information from the bots
  • Execute payload of specified URL
  • Update sample from the specified URL
  • Execute system or custom commands

Mozi Network Overview

Figure 1. Network Structure of Mozi (Image from https://blog.netlab.360.com/mozi-another-botnet-using-dht/)

The infection process is relatively simple, with an infected bot starting a http service locally that can provide the samples to other victims or can download the sample identified in the configuration file issued by the botnet master. The bots will then either login to the new victim with a weak password and will copy the malware locally from the download address provided by the bot, or will exploit one of a few vulnerabilities that have been identified to download the malware by the provided address from the bot.

Once the code is fetched, the code will execute on the victim machine, and then join the Mozi P2P network to become the new Mozi bot node and proceed to infect other devices. At the moment there are 11 known vulnerabilities being used to exploit systems:

List of Vulnerabilities

Figure 2. List of vulnerabilities currently being exploited by Mozi (Image from https://blog.netlab.360.com/mozi-another-botnet-using-dht/)

During cursory analysis of potentially impacted devices, there are around 22,000 devices identifying one of the vulnerable versions of software that are being exploited, with Netgear and GPON Routers being around 85% of the total number of potentially impacted devices. This number could potentially be in the 240,000 range however, due to the number of D-Link devices which could be exploited, however, not enough information is known about the devices available and if the vulnerability is present on these systems.

Another unknown factor to the scale of this botnet is devices using the Realtek SDK. In some reporting, there are around 350 wireless networking devices that could be using this SDK, which would be a large number of IoT devices, and the potential scale is not known, however, it could be assumed to be relatively high based on the number of models of networking devices impacted.

Mozi reuses quite a bit of code from the Gafgyt's malware, and is seen reproduced in various functions in Mozi, including the single instance, process name modification, and ACL modification. Based on this, the majority of Mozi samples get flagged by Anti-Virus vendors as Gafgyt.

Due to the packed nature of this file, it has been identified through the YARA signature, SUSP_ELF_LNX_UPX_Compressed_File, which can identify suspicious ELF binaries with UPX compression (which is how Mozi is currently packed). In addition, two MD5 hashes have been identified as associated with this botnet and have been included below.

Conclusion

Mozi could pose a decent threat to network based devices and with the amount of IoT devices available, this botnet could quickly scale to a signficant amount of victims capable of leveraging a large scale botnet to attack targets.

Customers should ensure that all their devices have been patched and updated to potentially mitigate these vulnerabiltiies, as well as monitoring network traffic for indications that hosts are using DHT to communicate with potential victim hosts.

ThreatFeed Customers

Threat Feed Customers can access these indicators through the following cURL command:

curl -X GET --header 'Accept: application/json' --header 'Authorization: Token TOKEN' 'https://tg-api.zerofox.com/campaigns/117/list_indicators/

IOC's

eda730498b3d0a97066807a2d98909f3
849b165f28ae8b1cebe0c7430f44aff3

Tags: malware, all industries, global