{"id":"9fdc50e844e1376a149c0ec2ec6ba1d7","title":"IoT-Botnet-Rust-ARM — IoT-Botnet-Rust-ARM · IoT僵尸网络 · ELF32","md5":"9fdc50e844e1376a149c0ec2ec6ba1d7","sha256":"0017ec0b36f0a10e37951329126e28d8bf03030124de8001061ee3c9193b4481","family":"IoT-Botnet-Rust-ARM","apt":null,"verdict":null,"sample_type":"IoT僵尸网络","lang":"Rust","file_format":"ELF32","compiler":"Rust","published_at":"2026-08-09T16:00:00.000Z","summary":"该样本是一个针对 ARM 架构 IoT 设备的 Rust 编译僵尸网络恶意软件。它利用 ChaCha20 算法进行网络通信加密，通过 systemd 服务和 cron 任务实现持久化，具备自我复制到多个临时目录的能力。样本包含容器/VM 检测机制（检查 /proc/mounts 中的 devtmpfs）和 CPU 核心数检测。通过 /oom_score_adj 设置为 -1000 来避免被 OOM killer 终止。网络通信使用 SOAP/XML 协议格式，表明其 C2 通信可能封装在 HTTP/SOAP 中。","url":"https://zseceye.com/report/9fdc50e844e1376a149c0ec2ec6ba1d7","json_url":"https://zseceye.com/report/9fdc50e844e1376a149c0ec2ec6ba1d7.json","html_url":"https://zseceye.com/report/9fdc50e844e1376a149c0ec2ec6ba1d7","hash_urls":{"md5":"https://zseceye.com/hash/9fdc50e844e1376a149c0ec2ec6ba1d7","sha256":"https://zseceye.com/hash/0017ec0b36f0a10e37951329126e28d8bf03030124de8001061ee3c9193b4481"},"search_urls":{"md5":"https://zseceye.com/?q=9fdc50e844e1376a149c0ec2ec6ba1d7","sha256":"https://zseceye.com/?q=0017ec0b36f0a10e37951329126e28d8bf03030124de8001061ee3c9193b4481"},"sample_download_url":"https://zseceye.com/report/9fdc50e844e1376a149c0ec2ec6ba1d7/sample","sample_filename":"0017ec0b36f0a10e.zip","iocs":[],"ips":[]}