{"id":"11b388e073236318b3851c168aa1abde","title":"ZetNet Rust Botnet — ZetNet Rust Botnet · 木马/恶意软件 · PE64","md5":"11b388e073236318b3851c168aa1abde","sha256":"254412f2ca69b69f8b686f874374e2584aaf55ad5c3e8ed6eddfa69f3fe6ea2b","family":"ZetNet Rust Botnet","apt":null,"verdict":null,"sample_type":"木马/恶意软件","lang":"Rust","file_format":"PE64","compiler":"Rust(MSVC)","published_at":"2026-08-06T16:00:00.000Z","summary":"该样本为 Rust 语言编译的高度复杂 Windows 僵尸网络客户端(ZetNet), 具备 50+ 远程控制命令。核心功能涵盖: 1) 完整 RAT 能力(Shell/PowerShell/VNC/HVNC 隐藏桌面/Webcam/Mic/键盘记录); 2) DDoS 攻击(start/stop); 3) 浏览器凭据窃取(Steal); 4) 代理隧道(Proxy/SOCKS); 5) 多重持久化(WMI EventFilter + Task Scheduler + Registry Run); 6) fodhelper UAC 绕过提权; 7) 反 CIS 地理过滤(不感染俄罗斯/白俄罗斯/乌克兰/哈萨克斯坦等独联体国家); 8) 自我更新/生存/工厂重置。使用 Tokio 异步运行时+SQLite 数据库+AES 加密。内置 ffmpeg 命令行用于麦克风捕获。该样本是目前分析到的最全面复杂的 Rust 恶意软件之一。","url":"https://zseceye.com/report/11b388e073236318b3851c168aa1abde","json_url":"https://zseceye.com/report/11b388e073236318b3851c168aa1abde.json","html_url":"https://zseceye.com/report/11b388e073236318b3851c168aa1abde","hash_urls":{"md5":"https://zseceye.com/hash/11b388e073236318b3851c168aa1abde","sha256":"https://zseceye.com/hash/254412f2ca69b69f8b686f874374e2584aaf55ad5c3e8ed6eddfa69f3fe6ea2b"},"search_urls":{"md5":"https://zseceye.com/?q=11b388e073236318b3851c168aa1abde","sha256":"https://zseceye.com/?q=254412f2ca69b69f8b686f874374e2584aaf55ad5c3e8ed6eddfa69f3fe6ea2b"},"sample_download_url":"https://zseceye.com/report/11b388e073236318b3851c168aa1abde/sample","sample_filename":"254412f2ca69b69f.zip","iocs":[],"ips":[]}