D2IP Malware and Obfuscated HTTP Exfiltration

Source

---
analysis: A simple detection rule for the backslash-GET method or known IPs is easily
  bypassed by rotation. This hunt adds value by baselining Direct-to-IP behavior across
  the fleet, allowing an analyst to find unknown threats using the same behavioral
  profile.
blind_spots:
- id: incomplete-proxy-visibility
  question: whether encrypted HTTPS requests use the backslash-GET method or malicious
    paths
  requires: hb_http_activity from a decrypted forward proxy
  risk: Malware using TLS will hide its URI and HTTP method from the surface, leaving
    only raw IP destination metadata in hb_network_connection.
  stage: obfuscated-http-exfiltration
- id: dns-cache-hits
  question: whether a connection was truly D2IP or simply missed because the OS cache
    was used
  requires: hb_dns_activity covering both live lookups and local cache hits
  risk: A host might appear to be performing D2IP if its local cache answered the
    query and the telemetry source only captures live network DNS traffic.
  stage: dns-bypass-c2
coverage:
- stage: direct-to-ip-payload-delivery
  status: covered
  steps:
  - match-known-c2-ips
  - suspicious-proxy-endpoints
- stage: dns-bypass-c2
  status: covered
  steps:
  - baseline-d2ip-connections
  - match-known-c2-ips
- stage: obfuscated-http-exfiltration
  status: covered
  steps:
  - malformed-backslash-get
- stage: in-browser-proxy-theft
  status: covered
  steps:
  - suspicious-proxy-endpoints
guardrails:
  claims: no_unsupported
  evidence: citation_required
  missing_data: not_benign
  telemetry: untrusted
hunt:
  applicability: campaign-specific
  handoff: keep-as-periodic-hunt
  justification: Nearly half of malware with C2 activity bypasses DNS entirely. This
    hunt correlates connection metadata (D2IP) with application indicators (malformed
    methods) to identify what standard DNS-based filtering misses.
  methodology: model-assisted
  trigger: intel-report
hypothesis: An adversary is using hard-coded IP addresses and malformed HTTP protocols
  to bypass DNS-based security controls, exfiltrate data, and proxy credential theft
  in real-time.
labels:
- hunt
- attack.t1071.001
- attack.t1568
- attack.t1041
- attack.t1132.001
- attack.t1185
- attack.t1056.001
- attack.t1105
name: D2IP Malware and Obfuscated HTTP Exfiltration
parameters:
  c2_ips:
    default:
    - 154.92.19.71
    - 178.16.54.109
    - 87.120.107.33
    - 194.76.227.94
    - 2.26.98.67
    - 62.60.179.230
    - 91.92.243.29
    - 103.245.236.146
    - 178.16.54.31
    - 206.189.229.43
    description: Known malicious destination IP addresses from the research.
    from:
      kind: article
      observed: '2024-08-04'
      ref: unit42-d2ip-2024
    type: list[ip]
  lookback_days:
    default: '14'
    description: Days of history to examine.
    from:
      kind: manual
      observed: '2024-08-04'
      ref: standard-lookback
    type: number
  malicious_paths:
    default:
    - /churl
    - /fsave
    - /new.php
    - /st.exe
    description: URI paths associated with Phorpiex and SectopRAT exfiltration and
      payload delivery.
    from:
      kind: article
      observed: '2024-08-04'
      ref: unit42-d2ip-2024
    type: list[string]
  scope_hosts:
    default: []
    description: Optional list of hostnames to focus the hunt; leave empty to scan
      the entire estate.
    from:
      kind: manual
      observed: '2024-08-04'
      ref: analyst-defined
    type: list[host]
provenance:
  authors:
  - name: Huntbase hunt generation
    org: huntbase.io
  generated:
    by: huntbase-hunt-generation
    from: https://unit42.paloaltonetworks.com/malware-bypass-dns-direct-to-ip/
    gates:
    - dry-run
    - lint
    - critic
    model: hb_google/gemini-3-flash-preview
rationale: Start with general endpoints. If high-fidelity malformed HTTP activity
  is detected, focus specifically on those hosts and expand the lookback to catch
  the original infection vector.
references:
- name: "Unit 42 \u2014 Almost Half of Malware Samples Communicate Direct to IP"
  url: https://unit42.paloaltonetworks.com/malware-bypass-dns-direct-to-ip/
related:
- hunt: standard-http-c2-path-hunting
  reason: This hunt focuses on connections that lack a preceding DNS resolution; standard
    hunts assume resolution exists.
  relation: out-of-scope-alternative
scenario:
  stages:
  - name: D2IP Payload Delivery
    observables:
    - /st.exe
    - /hiddenbin/
    - Wget/1.13.4
    - HTTP Range headers
    - 178.16.54.109
    - 2.26.98.67
    slug: direct-to-ip-payload-delivery
    tactic: execution
    techniques:
    - T1105
  - name: DNS-Bypass Command and Control
    observables:
    - wss://154.92.19.71:39989
    - 154.92.19.71
    - 87.120.107.33
    - 194.76.227.94
    - Hardcoded IP addresses in binary strings
    - TCP connections without prior DNS queries
    slug: dns-bypass-c2
    tactic: command-and-control
    techniques:
    - T1071.001
    - T1568
  - name: Obfuscated HTTP Exfiltration
    observables:
    - \GET method prefix
    - URI length 250-666 characters
    - Hex-like payload encoding
    - Rotating destination ports and IPs
    slug: obfuscated-http-exfiltration
    tactic: exfiltration
    techniques:
    - T1041
    - T1132.001
  - name: In-Browser Proxy Credential Theft
    observables:
    - /churl
    - /fsave
    - pcid
    - clid
    - 87.120.107.33
    - 194.76.227.94
    slug: in-browser-proxy-theft
    tactic: credential-access
    techniques:
    - T1185
    - T1056.001
  summary: Nearly half of modern malware samples bypass DNS-based defenses by using
    direct-to-IP (D2IP) communication for command-and-control and payload delivery.
    High-profile threats including Phorpiex, SectopRAT, and Mozi botnets utilize this
    technique to download components, exfiltrate credentials via in-browser proxies,
    and maintain P2P mesh networks while remaining invisible to DNS security layers.
severity: high
targets:
  analyst:
    name: Tier-2 analyst
    role: analyst
  endpoint:
    category: endpoint
    name: Endpoint telemetry (hb_ surfaces)
    telemetry:
    - endpoint
  hunter:
    agent: true
    name: Hunt agent
  network:
    category: network
    name: Network telemetry
    telemetry:
    - network
  web:
    category: siem
    name: Web server / proxy logs
    telemetry:
    - network
tlp: clear
type: investigation
---


# D2IP Malware and Obfuscated HTTP Exfiltration

This hunt identifies malware that avoids DNS resolution, rendering standard DNS-based filtering blind. It focuses on identifying Direct-to-IP (D2IP) connections, corroborating them with malformed HTTP signals like the backslash-GET method and long encoded URIs, and checking for specific browser-proxy endpoints used by SectopRAT for credential theft. It follows a phased approach to link network-level anomalies with application-layer evidence of exfiltration.

## scope-managed-endpoints
<!-- Scope to managed endpoints -->
Identify active hosts in the inventory to provide a baseline for the scope_hosts parameter.

```sqlite target=endpoint role=scoping
~~~yaml
expected: A list of hostnames representing the managed estate. This step is for inventory
  reference.
reads:
- device_hostname
- package_type
silence: not_evidence_of_absence
source: hb_software_inventory
verified: dry-run
verified_at: '2026-09-20'
~~~
SELECT DISTINCT device_hostname FROM hb_software_inventory WHERE package_type IN ('deb', 'rpm', 'msi', 'pkg')
```

## early-parallel
<!-- Search for early stage C2 and D2IP behavior -->
parallel:
- → match-known-c2-ips
- → baseline-d2ip-connections
join: → early-stage-agent

## match-known-c2-ips
<!-- Match known C2 IP addresses -->
Identify any host directly contacting the IP addresses named in the research.

```sqlite target=network role=enrichment params=(c2_ips=c2_ips, scope_hosts=scope_hosts, lookback_days=lookback_days)
~~~yaml
expected: Connections to specific report IPs. Silence is expected if the adversary
  has rotated their infrastructure.
reads:
- device_hostname
- process_name
- dst_endpoint_ip
- dst_endpoint_port
- time
silence: not_evidence_of_absence
source: hb_network_connection
verified: dry-run
verified_at: '2026-09-20'
~~~
SELECT device_hostname, process_name, dst_endpoint_ip, dst_endpoint_port, time FROM hb_network_connection WHERE instr(',' || '{{c2_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')
```

## baseline-d2ip-connections
<!-- Stack-count connections without DNS resolution -->
Find rare outbound connections where the hostname is missing, indicating a D2IP bypass.

```sqlite target=network role=baseline params=(scope_hosts=scope_hosts, lookback_days=lookback_days)
~~~yaml
baseline:
  compare: first_seen
  window: '{{lookback_days}}d'
expected: Small clusters of hosts talking to an IP that was never resolved via DNS.
  Benign tools (like internal admin scripts) will have high host counts.
prevalence:
  by: device_hostname
  key:
  - dst_endpoint_ip
  - process_name
  rare_below: 3
reads:
- dst_endpoint_ip
- process_name
- device_hostname
- dst_endpoint_hostname
- direction
- time
silence: not_evidence_of_absence
source: hb_network_connection
verified: dry-run
verified_at: '2026-09-20'
~~~
SELECT dst_endpoint_ip, process_name, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_network_connection WHERE (dst_endpoint_hostname IS NULL OR dst_endpoint_hostname = '') AND direction = 'outbound' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY dst_endpoint_ip, process_name HAVING host_count <= 3 ORDER BY host_count ASC
```

## early-stage-agent
<!-- Evaluate early C2 and D2IP findings -->
```agent target=hunter
cite: required
context:
- match-known-c2-ips
- baseline-d2ip-connections
max_iterations: 3
objective: Identify hosts making rare or matched outbound connections that bypassed
  DNS resolution.
success_criteria: A verdict of suspicious or malicious for hosts with low-prevalence
  D2IP traffic.
tools:
- endpoint
- network
- web
```

## follow-on-parallel
<!-- Search for obfuscation and exfiltration -->
parallel:
- → malformed-backslash-get
- → suspicious-proxy-endpoints
join: → follow-on-agent

## malformed-backslash-get
<!-- Detect malformed backslash-GET and long URIs -->
Find the high-fidelity backslash-GET method and URIs with lengths (250-666) characteristic of exfiltration.

```sqlite target=web role=detection-candidate params=(scope_hosts=scope_hosts, lookback_days=lookback_days)
~~~yaml
expected: Requests using '\GET' or unusually long URIs. Benign tracking scripts may
  have long URIs, but the '\GET' string is a definitive malware indicator.
reads:
- device_hostname
- http_method
- url_full
- time
silence: not_evidence_of_absence
source: hb_http_activity
verified: dry-run
verified_at: '2026-09-20'
~~~
SELECT device_hostname, http_method, url_full, LENGTH(url_full) AS uri_len, time FROM hb_http_activity WHERE (http_method LIKE '%\GET%' OR LENGTH(url_full) BETWEEN 250 AND 666) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')
```

## suspicious-proxy-endpoints
<!-- Detect suspicious proxy and dropper endpoints -->
Find traffic to endpoints used by Phorpiex and SectopRAT for payload delivery and credential exfiltration.

```sqlite target=web role=triage params=(malicious_paths=malicious_paths, scope_hosts=scope_hosts, lookback_days=lookback_days)
~~~yaml
expected: Requests to /churl, /fsave, /st.exe, or hidden directories. Matching these
  on hosts that also show D2IP behavior confirms a high-confidence threat.
reads:
- device_hostname
- url_path
- url_hostname
- time
silence: not_evidence_of_absence
source: hb_http_activity
verified: dry-run
verified_at: '2026-09-20'
~~~
SELECT device_hostname, url_path, url_hostname, time FROM hb_http_activity WHERE (instr(',' || '{{malicious_paths}}' || ',', ',' || LOWER(url_path) || ',') > 0 OR url_path LIKE '%/hiddenbin/%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')
```

## follow-on-agent
<!-- Final synthesis and verdict -->
```agent target=hunter
cite: required
context:
- early-stage-agent
- malformed-backslash-get
- suspicious-proxy-endpoints
max_iterations: 5
objective: Link D2IP connections from the first phase to malformed HTTP exfiltration
  or browser-proxy activity in the second phase.
success_criteria: A malicious verdict for any host where a D2IP network connection
  correlates with malformed HTTP methods or known-bad URIs.
tools:
- endpoint
- network
- web
```

## route-on-verdict
<!-- Route on verdict -->
if~: "the follow-on-agent verdict is malicious for at least one host" (confidence: high, judge=hunter)
then: → isolate-host
indeterminate: → analyst-review
unavailable: → analyst-review (blind_spot: incomplete-proxy-visibility)
else: → close-out

## isolate-host
<!-- Isolate compromised host -->
```action target=endpoint
~~~yaml
approval: required
~~~
Isolate the host immediately. Collect the binary responsible for the network traffic and examine it for hard-coded IP strings. Revoke any browser session tokens used by the host during the lookback period.
```
→ analyst-review

## analyst-review
<!-- Analyst review and tuning -->
```manual target=analyst
Examine the context of the D2IP connections. If the destination is a cloud provider (AWS/Azure) and the URI contains long encoded strings, prioritize the investigation. Verify if the process is a legitimate browser or a standalone binary.
```
→ end

## close-out
<!-- Close out -->
```manual target=analyst
Record the results. If no malicious activity was found, ensure any newly discovered legitimate D2IP admin tools are noted for future exclusions.
```
→ end