Collecting and operationalizing threat data from the Mozi botnet

This report analyzes the Mozi peer-to-peer IoT botnet: how samples were collected from ThreatFox and Malware Bazaar, how corrupted UPX-packed ARM ELF samples were repaired and unpacked, and which indicators and TTPs were extracted (network IOCs, ip:port, iptables changes, HTTP fingerprint). It demonstrates ingestion and enrichment into the Elastic Stack for visualization and hunting, provides a YARA rule to detect the UPX header zeroing obfuscation, describes propagation fingerprints useful for discovery (HTTP response headers), and gives mitigation advice (change default credentials, patch firmware, segment and limit Internet exposure).