{"id":"6d9b7701af997b029acf62a4c57e2c63","title":"IoT-DDoS-Botnet-m68k — IoT-DDoS-Botnet-m68k · IoT僵尸网络 · ELF32","md5":"6d9b7701af997b029acf62a4c57e2c63","sha256":"00a9a0864035e994f255c3bdbcebb5c860844555bf279aa711462f86b0f11e30","family":"IoT-DDoS-Botnet-m68k","apt":null,"verdict":null,"sample_type":"IoT僵尸网络","lang":"C","file_format":"ELF32","compiler":"GCC","published_at":"2026-08-09T16:00:00.000Z","summary":"该样本是一个针对罕见 Motorola 68020 (m68k) 架构的 IoT DDoS 僵尸网络客户端。编译时使用 -DKILLER=1 标志，表明会清除其他竞争僵尸网络进程。支持多种 HTTP DDoS 攻击方法（GET/POST 请求），使用 Chrome 131 User-Agent 模拟正常浏览器流量，并通过 X-Forwarded-For 随机 IP 伪造源地址。持久化机制覆盖 systemd 服务、cron 任务、dhclient 钩子、inetd 配置、profile.d 脚本等多种路径。同时具备 SSH 暴力破解和看门狗禁用功能。二进制内包含 mipsel、aarch64 等多架构字符串，表明为跨架构编译工具链的一部分。","url":"https://zseceye.com/report/6d9b7701af997b029acf62a4c57e2c63","json_url":"https://zseceye.com/report/6d9b7701af997b029acf62a4c57e2c63.json","html_url":"https://zseceye.com/report/6d9b7701af997b029acf62a4c57e2c63","hash_urls":{"md5":"https://zseceye.com/hash/6d9b7701af997b029acf62a4c57e2c63","sha256":"https://zseceye.com/hash/00a9a0864035e994f255c3bdbcebb5c860844555bf279aa711462f86b0f11e30"},"search_urls":{"md5":"https://zseceye.com/?q=6d9b7701af997b029acf62a4c57e2c63","sha256":"https://zseceye.com/?q=00a9a0864035e994f255c3bdbcebb5c860844555bf279aa711462f86b0f11e30"},"sample_download_url":"https://zseceye.com/report/6d9b7701af997b029acf62a4c57e2c63/sample","sample_filename":"00a9a0864035e994.zip","iocs":[],"ips":[]}