Almost Half of Malware Samples Communicate Direct to IP

Executive Summary

Nearly half of malware samples that exhibit command-and-control (C2) activity bypass DNS entirely, connecting directly to hard-coded IP addresses. Analysis of over 4 million dynamic analysis reports by Palo Alto Networks Unit 42 found that 45.32% of malware samples with any C2 activity made at least one direct-to-IP (D2IP) connection — a raw IP contact with no preceding DNS query. Even after excluding bulk port-scanning behavior, the figure remains 41.97%. Measured as a fraction of all C2 connection attempts, D2IP traffic accounts for 23.17% of the total.

This behavior renders DNS-based security controls — including protective DNS sinkholing and DNS anomaly detection — completely blind. The connection simply appears as raw IP traffic with no prior context. To address this gap, Unit 42 introduces zero trust IP (ZT-IP), a network-level enforcement approach that verifies whether outbound connection destinations were ever sanctioned by a DNS response. This technique successfully surfaced threats including Phorpiex ransomware droppers, a persistent data exfiltration campaign, and Mozi P2P botnet payloads delivered to IoT devices without DNS.

Technical Analysis

The DNS visibility gap is well-known, but its scale has been under-quantified. Unit 42's analysis of 4 million Advanced WildFire dynamic analysis reports over a 30-day period filtered out connections to common legitimate services, internal addresses, and DNS resolvers. After filtering, 20.11% of malware samples exhibited C2 activity. In contrast, only 1% of benign samples established connections to untrusted IP addresses, averaging just 1.6 such connections per sample.

Among malware with C2 connections, TCP dominates (94.43% prevalence, averaging 4.17 unique C2 IP addresses per sample). UDP is present in 17.50% of cases but contacts far more IP addresses per sample (average 13.79), consistent with scanning and P2P mesh behavior.

A concrete example: a backdoor sample made no DNS query at all before initiating a WebSocket connection directly to wss://154.92.19[.]71:39989. Disassembly via Ghidra revealed the destination address was hard-coded into the binary as a Unicode string. This is not an isolated edge case — it's a systemic evasion technique.

Unit 42's ZT-IP approach applies zero trust principles to IP-based traffic. It verifies whether an outbound connection destination was ever sanctioned by a DNS response. If not, the connection is flagged as suspicious. This method successfully identified multiple threats:

• Phorpiex Ransomware Dropper: Suspicious HTTP GET requests to 178.16.54[.]109 with sequential numeric paths (e.g., /1 through /6) and specific file downloads (e.g., /sex/k/n.txt, /new.php). The binary retrieved from hxxp[:]//178.16.54[.]109/st.exe correlates with Phorpiex (aka Trik), a long-running malware family used primarily as a dropper and spam botnet. The IP address hosts multiple malicious samples, and the absence of DNS queries preceding connections was a key indicator.
• The \GET Exfiltration Campaign: A persistent campaign using a non-standard HTTP request method ("\GET") for data exfiltration, demonstrating how D2IP traffic can evade heuristic detectors that rely on request body analysis.
• Mozi P2P Botnet: Payloads delivered to IoT devices without any DNS involvement, leveraging P2P mesh networking.

Indicators of Compromise

The following IOCs were identified in the Unit 42 analysis:

• IP: 178.16.54.109 — C2 server hosting Phorpiex dropper and multiple malicious samples
• URL: hxxp://178.16.54.109/st.exe — Phorpiex dropper binary
• WebSocket endpoint: wss://154.92.19.71:39989 — hard-coded C2 in a backdoor sample

These IOCs are tied to the specific campaigns described. Defenders should also monitor for any outbound connections to raw IP addresses that lack corresponding DNS queries in their logs.

Tactics, Techniques & Procedures

The D2IP behavior maps to several MITRE ATT&CK techniques:

• T1071.001 - Application Layer Protocol: Web Protocols: Malware uses WebSocket connections to hard-coded IPs, bypassing DNS.
• T1571 - Non-Standard Port: The backdoor sample connects to port 39989, a non-standard port for WebSocket traffic.
• T1041 - Exfiltration Over C2 Channel: The \GET campaign exfiltrates data over the same channel used for C2.

The sequencing is notable: malware often skips DNS entirely, making the connection appear as benign raw IP traffic. This is particularly effective against DNS-based defenses that rely on domain reputation or sinkholing.

Threat Actor Context

Phorpiex (aka Trik) is a long-running malware family used primarily as a dropper and spam botnet. Its staged payload delivery mechanism — first fetching configuration, then retrieving additional malicious components such as ransomware — was observed in the D2IP traffic. The family continues to evolve, leveraging direct IP connections to evade DNS-based defenses.

Mitigations & Recommendations

Defenders should implement zero trust IP (ZT-IP) enforcement at the network level. This involves verifying whether outbound connection destinations were ever sanctioned by a DNS response. If a destination was never resolved via DNS, the connection should be treated as suspicious and subject to additional inspection or blocking.

Additionally, organizations should:

• Monitor for outbound connections to raw IP addresses, especially on non-standard ports.
• Deploy network-level detection that correlates DNS logs with connection logs to identify D2IP anomalies.
• Use threat intelligence feeds to block known malicious IPs, but recognize that D2IP campaigns often use dynamic or rotating infrastructure.
• For IoT environments, apply strict egress filtering and consider network segmentation to limit the impact of P2P botnets like Mozi.