Phorpiex, Mozi, Mirai: Direct-to-IP C2 Tactics — OTX Pulse Analysis

title: Potential Malware Direct-to-IP C2 Communication
id: 4b05d0f8-9f5a-4f8e-8c1a-3d0a1b2c3d4e
description: Detects suspicious processes establishing network connections to non-local IP addresses on common C2 ports without prior DNS resolution, indicative of D2IP tactics observed in Phorpiex and Mozi campaigns.
author: Security Arsenal Research
date: 2026/08/04
status: experimental
references:
    - https://otx.alienvault.com/pulse/622e1c3e941c2240563840a4/
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Initiated: 'true'
        DestinationPort:
            - 80
            - 443
            - 8080
            - 8443
    filter_localhost:
        DestinationIp:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
            - '127.0.0.0/8'
    filter_known_good:
        Image|contains:
            - '\Program Files\'
            - '\Windows\System32\'
    condition: selection and not filter_localhost and not filter_known_good
falsepositives:
    - Legitimate software calling hard-coded IP updates (rare)
level: high
---
title: Phorpiex Worm Persistence via Registry Run Keys
id: a9f2b3c4-d5e6-4789-8012-345678901234
description: Detects persistence mechanisms often used by Phorpiex (Trik) worm creating run keys with obscure names.
author: Security Arsenal Research
date: 2026/08/04
status: experimental
logsource:
    product: windows
    category: registry_set
detection:
    selection:
        TargetObject|contains: '\Software\Microsoft\Windows\CurrentVersion\Run'
        Details|contains:
            - 'rundll32.exe'
            - 'powershell.exe'
    condition: selection
falsepositives:
    - Administrative scripts
level: medium
---
title: Mozi IoT Botnet Inbound Connection Attempt
id: b1c2d3e4-f5a6-4789-b0c1-234567890123
description: Detects inbound connections on ports commonly scanned by Mozi and Mirai botnets targeting IoT devices.
author: Security Arsenal Research
date: 2026/08/04
status: experimental
logsource:
    category: firewall
    product: paloalto
detection:
    selection:
        destination_port:
            - 23
            - 2323
            - 80
            - 8080
        action: 'allowed'
    condition: selection
falsepositives:
    - Authorized management of network infrastructure
level: medium

// Hunt for Direct-to-IP connections to OTX listed IOCs
let IOCs = dynamic(["103.245.236.146", "154.92.19.71", "178.16.54.109", "91.92.243.29", "194.76.227.94"]);
DeviceNetworkEvents
| where RemoteIP in (IOCs)
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RemoteIP, RemotePort, ActionType
| summarize count() by DeviceName, RemoteIP, InitiatingProcessFileName
| order by count_ desc

<#
.SYNOPSIS
    IOC Hunt for Phorpiex/Mozi File Hashes and Network Connections.
.DESCRIPTION
    Scans the C: drive for specific SHA256 hashes and checks active TCP connections.
#>

$TargetHashes = @(
    "9639f7ebc6a6d69d7bf5b8bc869e7783a1406088f192868624ad8919e9bfd1d4",
    "0d94bf4d0418061907ff7977e3f25a463cb25188"
)

$MaliciousIPs = @(
    "103.245.236.146",
    "154.92.19.71",
    "178.16.54.109",
    "91.92.243.29",
    "194.76.227.94"
)

Write-Host "[+] Checking for file indicators..." -ForegroundColor Cyan
Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | Where-Object { 
    $_.Length -gt 0kb -and $_.Extension -in ".exe", ".dll", ".ps1" 
} | ForEach-Object {
    $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
    if ($TargetHashes -contains $hash) {
        Write-Host "[!] MALICIOUS FILE FOUND: $($_.FullName)" -ForegroundColor Red
    }
}

Write-Host "[+] Checking active network connections for known C2 IPs..." -ForegroundColor Cyan
$connections = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue
foreach ($ip in $MaliciousIPs) {
    $hits = $connections | Where-Object { $_.RemoteAddress -eq $ip }
    if ($hits) {
        $hits | ForEach-Object {
            $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
            Write-Host "[!] C2 CONNECTION DETECTED: RemoteIP $ip connected by PID $($_.OwningProcess) ($($proc.ProcessName))" -ForegroundColor Red
        }
    }
}