Mozi Botnet: Forensic Reverse-Engineering & Architectural Dossier

{
  "compiler": "GNU C++ Compiler (g++)",
  "runtime": "Native POSIX / Linux C++ Runtime (libstdc++ statically linked via uClibc)",
  "binary_footprint": "ELF 32-bit / 64-bit executable (file size: ~310 KB - 480 KB containing embedded DHT protocol engine and exploit payloads)",
  "stub_size": "344,064 bytes typical compiled MIPS/ARM ELF footprint",
  "packer_obfuscation": "Stripped ELF symbols; embedded configuration and exploit strings obfuscated using multi-byte XOR loops",
  "subsystem": "Linux POSIX Console / Background Daemon",
  "entry_point_flow": "_start -> main() -> Initialize DHT routing table -> Query hardcoded bootstrap peers -> Register node on DHT network -> Spawn exploit spreader thread -> Spawn local HTTP staging server -> Listen for ECDSA-signed DHT command broadcasts -> Verify signature -> Execute DDoS or arbitrary command",
  "technical_summary": "Mozi is an advanced P2P Linux IoT botnet derived from source elements of Mirai and Gafgyt, fundamentally re-architected to replace centralized C2 servers with an autonomous peer-to-peer routing overlay based on the BitTorrent Distributed Hash Table (DHT) protocol. To protect the swarm against hijacking, all configuration updates and commands must carry a valid ECDSA cryptographic signature verified against a hardcoded public key. Mozi propagates via automated exploitation of N-day vulnerabilities in networking devices and executes coordinated DDoS attacks."
}

{
  "interface_type": "Decentralized P2P Network / Master ECDSA Command Generator",
  "builder_tabs_options": [],
  "config_struct_layout": [
    {
      "offset": "0x00",
      "field": "dht_public_key",
      "type": "Byte Array [64]",
      "description": "Hardcoded ECDSA public key used to verify all incoming command and update broadcasts"
    },
    {
      "offset": "0x40",
      "field": "bootstrap_nodes",
      "type": "IP:Port Struct Array",
      "description": "Hardcoded list of initial DHT peer nodes used to join the P2P overlay"
    },
    {
      "offset": "0xA0",
      "field": "http_server_port",
      "type": "uint16_t",
      "description": "Local port opened by bot to host and serve the Mozi binary to freshly exploited devices"
    },
    {
      "offset": "0xA2",
      "field": "xor_key",
      "type": "Byte Array [8]",
      "description": "Static byte array used to decrypt internal configuration and exploit payloads"
    }
  ],
  "payload_generation_flags": [
    "Language: C++ (Object-Oriented DHT Stack)",
    "Signature Algorithm: ECDSA (secp256k1)",
    "P2P Protocol: Kademlia BitTorrent DHT (RFC 5389 / BEP-0005)",
    "Local Staging: Embedded Micro-HTTP Server"
  ],
  "operator_commands": [
    "CMD_DDOS_ATTACK: Initiates coordinated HTTP, TCP, or UDP volumetric flood against target IP:Port",
    "CMD_UPDATE_PAYLOAD: Downloads updated Mozi binary, validates ECDSA signature, and replaces existing executable",
    "CMD_EXEC_SHELL: Executes arbitrary shell command validated by master cryptographic signature",
    "CMD_CONFIG_UPDATE: Updates active DHT bootstrap peer list and exploit scanner parameters"
  ],
  "interface_telemetry_analysis": "Mozi operates without a centralized web panel or graphical builder. Threat actors control the botnet by generating signed command structures using an offline master ECDSA private key. These signed command blobs are injected into the BitTorrent DHT network as peer announcements, gossip-propagating autonomously across thousands of active infected nodes."
}

struct Mozi_Botnet_Config {
    uint32_t magic;
    char c2_host[128];
    uint16_t port;
    char install_path[260];
    char mutex[64];
    uint8_t aes_key[32];
};

{
  "injection_chain": "Multi-stage autonomous worm propagation: Scanner thread scans random IPv4 addresses for vulnerable web and management interfaces -> Launches target-specific HTTP POST/GET exploit payload (e.g., CVE-2017-17215 Huawei, CVE-2018-10561 GPON, CVE-2014-8361 Realtek SDK) -> Exploit injects shell command fetching Mozi binary from peer's local micro-HTTP server via wget or tftp -> Executes downloaded binary -> New instance initializes DHT node and joins swarm.",
  "ntapi_functions": [
    "sys_socket",
    "sys_sendto",
    "sys_recvfrom",
    "sys_bind",
    "sys_fork",
    "sys_kill",
    "sys_open",
    "sys_write",
    "sys_read",
    "sys_execve"
  ],
  "process_hollowing_target": "None (executes as a background Linux daemon process; drops files to /tmp/mozi.a or /tmp/mozi.m)",
  "persistence_mechanics": [
    "Firewall Hardening: Executes iptables commands dropping inbound traffic on management ports: iptables -A INPUT -p tcp --dport 23 -j DROP; iptables -A INPUT -p tcp --dport 22 -j DROP",
    "Process Renaming: Changes process name to [kworker/0:0] or masquerades as benign system daemons",
    "Reboot Survival: Overwrites flash storage init scripts (/etc/rc.d/rc.local or /etc/init.d/) when root privileges permit"
  ],
  "evasion_hooks": [
    "Decentralized Infrastructure: Eliminates static C2 IP addresses; commands are routed via millions of DHT nodes, resisting bulletproof hosting takedowns.",
    "ECDSA Cryptographic Verification: Prevents security researchers and rival botnets from issuing sinkhole or takeover commands without the private key.",
    "Port Dropping: Uses iptables to block ports 22 and 23 to lock out device administrators and rival IoT worms."
  ],
  "anti_analysis": [
    "Stripped ELF: Binary symbols stripped; strings decrypted strictly in memory using XOR loops.",
    "Local IP Filtering: Filters internal loopback and RFC 1918 subnets during external propagation phases."
  ]
}

Concrete technical breakdown of functional modules implemented in the Mozi Botnet binary:

{
  "framing": "BitTorrent Distributed Hash Table (DHT) protocol messages formatted in Bencode format over UDP",
  "serialization": "Bencode dictionary serialization ('d...e') with custom extension keys containing Mozi payload announcements",
  "handshake": "Standard DHT query sequence: ping, find_node, get_peers, and announce_peer; nodes discover peers and synchronize info_hash keys",
  "cryptography": "ECDSA digital signature (secp256k1 curve) appended to command payloads; internal strings obfuscated via 8-byte XOR key",
  "packet_types": [
    {
      "header": "UDP DHT ping query",
      "payload": "d1:ad2:id20:<Node_ID>e1:q4:ping1:t2:<TID>1:y1:qe",
      "direction": "Peer -> Peer"
    },
    {
      "header": "UDP DHT find_node query",
      "payload": "d1:ad2:id20:<Node_ID>6:target20:<Target_ID>e1:q9:find_node1:t2:<TID>1:y1:qe",
      "direction": "Peer -> Peer"
    },
    {
      "header": "UDP Mozi Command Broadcast",
      "payload": "[ss]<ECDSA_Signature>[cfg]attack:type=syn,target=...,port=...,time=...",
      "direction": "Peer -> Peer (Gossip Relay)"
    }
  ],
  "traffic_signature": "High-volume UDP traffic on high-numbered ports (35000-65535) consisting of Bencoded BitTorrent DHT packets; sudden bursts of outbound HTTP requests targeting embedded router vulnerability paths (e.g. /HNAP1/, /setup.cgi, /GponForm/diag_Form)."
}

Indicators of compromise and forensic patterns recorded across laboratory triage: