{"id":"0227fde0bb0c05809f84e34bb6c7b8e9","title":"IoT 僵尸网络投放脚本 — IoT 僵尸网络投放脚本 · 木马/恶意软件 · Shell Script","md5":"0227fde0bb0c05809f84e34bb6c7b8e9","sha256":"963d986f444f3a811ab89a50dd7f642621d709fc5d374f6d34445ee730c5924a","family":"IoT 僵尸网络投放脚本","apt":null,"verdict":null,"sample_type":"木马/恶意软件","lang":"N","file_format":"Shell Script","compiler":"Bash","published_at":"2026-08-09T16:00:00.000Z","summary":"该样本为 IoT 僵尸网络投放脚本 (Bash, 4725 字节)。脚本首先尝试在 /tmp、/root、/home 目录下创建隐藏目录 /.n，然后使用 wget 从硬编码 C2 服务器 130.12.182.77 下载 47 种 CPU 架构的僵尸网络客户端 (main.*)。下载后通过 chmod +x 赋予执行权限并以 'tvt' 参数运行。该脚本是典型的 Mirai 变种 IoT 僵尸网络投放器，针对嵌入式设备 (路由器、摄像头、DVR 等)。多架构支持覆盖 47 种 CPU 架构。","url":"https://zseceye.com/report/0227fde0bb0c05809f84e34bb6c7b8e9","json_url":"https://zseceye.com/report/0227fde0bb0c05809f84e34bb6c7b8e9.json","html_url":"https://zseceye.com/report/0227fde0bb0c05809f84e34bb6c7b8e9","hash_urls":{"md5":"https://zseceye.com/hash/0227fde0bb0c05809f84e34bb6c7b8e9","sha256":"https://zseceye.com/hash/963d986f444f3a811ab89a50dd7f642621d709fc5d374f6d34445ee730c5924a"},"search_urls":{"md5":"https://zseceye.com/?q=0227fde0bb0c05809f84e34bb6c7b8e9","sha256":"https://zseceye.com/?q=963d986f444f3a811ab89a50dd7f642621d709fc5d374f6d34445ee730c5924a"},"sample_download_url":"https://zseceye.com/report/0227fde0bb0c05809f84e34bb6c7b8e9/sample","sample_filename":"963d986f.zip","iocs":[],"ips":[]}