ARMv7l IoT DDoS Botnet - Multi-Vector Flood + Anti-Honeypot

§1 📋 样本概要信息

§2 🏷️ 分类标签与威胁情报

★ §3 🔬 持久化机制

In-memory only - no file writes, no crontab, no init scripts

★ §3b 🌐 C2 架构分析

通联关系图

    graph TD
    A[IoT Device Infected] --> B[Sample Executes]
    B --> C{Architecture Check}
    C -->|armv7l| D[Anti-Honeypot: /proc scan]
    C -->|non-armv7l| X[Exit]
    D -->|honeypot detected| X
    D -->|clean env| E[socket TCP created]
    E --> F[connect 31.56.209.222:31337]
    F --> G{Connected?}
    G -->|Yes| H[NUL heartbeat loop]
    G -->|No EINPROGRESS| I[pselect6 wait]
    I -->|10s timeout| J[fork + reconnect]
    H --> K[Receive DDoS commands]
    K --> L[Execute attack]
    L --> M[tcpraw / icmpecho / udpplain]
    J --> E
    

(无 ASCII 回退)

通道 1: Primary C2

C2 通信时序

§4 🏗️ 结构分析

§5 ⚙️ 反汇编与行为流程

行为执行流

§6 🔬 家族溯源

编译元数据

家族特征比对

已知变种

§7 🔬 深度行为分析

行为阶段拆解

协议/行为状态机

stateDiagram-v2
    [*] --> Init
    Init --> ArchCheck: /proc/cpuinfo
    ArchCheck --> Exit: non-armv7l
    ArchCheck --> HoneypotCheck: armv7l confirmed
    HoneypotCheck --> Exit: honeypot detected
    HoneypotCheck --> C2Connect: clean env
    C2Connect --> Heartbeat: connect OK
    C2Connect --> Retry: connect fail
    Retry --> C2Connect: fork new process
    Heartbeat --> CommandWait: heartbeat cycle
    CommandWait --> DDoSAttack: receive cmd
    DDoSAttack --> Heartbeat: attack done

gantt
    title       Malware Execution Timeline (milliseconds)
    dateFormat  x
    axisFormat  %L ms

    section 1. Recon
    Memory Init            :crit,  m1, 0,     5
    Arch Check             :crit,  m2, 5,    15

    section 2. Evasion
    Anti-Honeypot Scan     :active, h1, 15,  200

    section 3. C2
    Socket + Connect       :       c1, 200, 300

    section 4. Persistence
    Heartbeat Loop         :done,  hb, 300, 10000
    Reconnect (10s to)     :       rc, 10000,10100
    

§8 🔬 恶意性综合判定

多维度证据评估

§9 🎯 ATT&CK 映射

§10 🛡️ 反分析技术评估

反调试

反虚拟机

综合评估

★ §10b 🧹 痕迹清理

§11 🔧 逆向分析

Ghidra 反编译

调用链分析 (GitNexus)

N/A

★ §12 🔬 QEMU 动态分析

§13 📦 IOC 汇总

IOC 字符串

YARA 检测规则

rule IoT_Bot_Rust_4bf982fc {
    meta:
        description = "Rust-based ARM IoT DDoS Bot (4bf982fc)"
        hash = "4bf982fcbc5f74bb9d72087e0d38ee739bfeeec8a5b0a63c9414c8fc4126208d"
    strings:
        $c2 = "31.56.209.222"
        $hp = "Looks like you are a honeypot!" ascii
        $tcp = "[attacks/tcpraw]" ascii
        $icmp = "icmpecho" ascii
        $udp = "udpplain" ascii
        $arch = "armv7l" ascii
        $proc = "/proc/%s/comm" ascii
    condition:
        all of them
}