URLhaus: Mozi Malicious URLs

Hunt Hypothesis

Hunt package for 9 malicious URLs tagged as Mozi

IOC Summary

Threat: Mozi Total URLs: 9 Active URLs: 6

URL	Status	Threat	Date Added
`hxxp://120.61.240.186:56988/bin.sh`	online	malware_download	2026-03-19
`hxxp://117.206.66.23:33386/bin.sh`	online	malware_download	2026-03-19
`hxxp://103.61.243.11:58596/i`	online	malware_download	2026-03-19
`hxxp://27.32.255.147:38620/i`	online	malware_download	2026-03-19
`hxxp://103.61.243.11:58596/bin.sh`	online	malware_download	2026-03-19
`hxxp://27.32.255.147:38620/bin.sh`	online	malware_download	2026-03-19
`hxxp://117.241.178.184:44199/i`	offline	malware_download	2026-03-19
`hxxp://117.241.178.184:44199/bin.sh`	offline	malware_download	2026-03-19
`hxxp://120.56.7.130:38674/i`	offline	malware_download	2026-03-19

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["103.61.243.11", "27.32.255.147", "117.206.66.23", "120.61.240.186"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["103.61.243.11", "27.32.255.147", "117.206.66.23", "120.61.240.186"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DnsEvents`	Ensure this data connector is enabled

References

URLhaus