{"id":"bba14867fd9c3158489aa5a3018ac2f7","title":"IoT-Botnet-Mirai-ARM64 — IoT-Botnet-Mirai-ARM64 · 僵尸网络/DDoS · ELF64","md5":"bba14867fd9c3158489aa5a3018ac2f7","sha256":"4d24c9c629ce5e5a35544d656228de3ea15b8f4c42ac2497df926b3179ce30cc","family":"IoT-Botnet-Mirai-ARM64","apt":"Mirai-Botnet","verdict":null,"sample_type":"僵尸网络/DDoS","lang":"C++","file_format":"ELF64","compiler":"GCC ARM64 (stripped)","published_at":"2026-08-05T16:00:00.000Z","summary":"该样本为 ARM64 (AArch64) 架构的 IoT 僵尸网络植入物，静态链接、剥离符号表。采用 HTTP/HTTPS 协议与 C2 通信（URL 模板: https://%s%s），内置 6+ 种 User-Agent 轮换（Android/iOS/Windows 浏览器）以规避检测。集成 busybox 工具集实现 telnet 暴力破解（admin/e8telnet 默认凭据）、wget/tftp/ftpget 多协议载荷下载、以及自传播（/proc/self/exe）。属于 Mirai/Gafgyt 僵尸网络家族的 ARM64 变种。目标设备：ARM64 路由器、IoT 设备、Android 设备。","url":"https://zseceye.com/report/bba14867fd9c3158489aa5a3018ac2f7","json_url":"https://zseceye.com/report/bba14867fd9c3158489aa5a3018ac2f7.json","html_url":"https://zseceye.com/report/bba14867fd9c3158489aa5a3018ac2f7","hash_urls":{"md5":"https://zseceye.com/hash/bba14867fd9c3158489aa5a3018ac2f7","sha256":"https://zseceye.com/hash/4d24c9c629ce5e5a35544d656228de3ea15b8f4c42ac2497df926b3179ce30cc"},"search_urls":{"md5":"https://zseceye.com/?q=bba14867fd9c3158489aa5a3018ac2f7","sha256":"https://zseceye.com/?q=4d24c9c629ce5e5a35544d656228de3ea15b8f4c42ac2497df926b3179ce30cc"},"sample_download_url":"https://zseceye.com/report/bba14867fd9c3158489aa5a3018ac2f7/sample","sample_filename":"4d24c9c629ce5e5a.zip","iocs":[],"ips":[]}