{"id":"bf32078b169c8215b51ba6e1c7e6ade2","title":"Rust QUIC IoT Botnet — Rust QUIC IoT Botnet · 木马/恶意软件 · ELF32","md5":"bf32078b169c8215b51ba6e1c7e6ade2","sha256":"7826f1073f73991968b774fe7d9514c069e44b4f0477fe2429d5781523806f50","family":"Rust QUIC IoT Botnet","apt":null,"verdict":null,"sample_type":"木马/恶意软件","lang":"Rust","file_format":"ELF32","compiler":"Rust (ARM static-pie)","published_at":"2026-08-09T16:00:00.000Z","summary":"该样本为 Rust 编译的 ARM 32-bit 物联网僵尸网络 (static-pie 链接)，代表 IoT 恶意软件向现代技术栈的演进。核心技术特征：(1) 使用 QUIC 协议 (HTTP/3) 进行 C2 通信，内嵌 quic/quicv2 key/iv/hp TLS 密钥标签，支持 TLS 1.3 (tls13)；(2) 5 种 Chrome/Edge/Firefox/Safari User-Agent 伪装覆盖 Windows/Mac/Linux/Android/iPhone 全平台；(3) 三重持久化机制: systemd 服务 (systemctl enable)、crontab @reboot、Android init.d 脚本；(4) 进程伪装为 systemd-journald、polkitd、fwupd、boltd、accounts-daemon 等 20+ 合法系统进程；(5) C2 认证端点: /api/login、/account/login、/auth/login；(6) HTTP 头部完整伪装: Sec-CH-UA、Accept-Encoding、Accept-Language、X-Forwarded-For；(7) 字符串 'CONNECTED TO HOST BOX' 和 '[+] connected to control operations' 确认远程控制功能。Ghidra 反编译 482 函数，最大函数 34KB (格式化引擎) 和 30KB (网络状态机)。C2 地址未硬编码，通过运行时配置或 DNS 解析获得。","url":"https://zseceye.com/report/bf32078b169c8215b51ba6e1c7e6ade2","json_url":"https://zseceye.com/report/bf32078b169c8215b51ba6e1c7e6ade2.json","html_url":"https://zseceye.com/report/bf32078b169c8215b51ba6e1c7e6ade2","hash_urls":{"md5":"https://zseceye.com/hash/bf32078b169c8215b51ba6e1c7e6ade2","sha256":"https://zseceye.com/hash/7826f1073f73991968b774fe7d9514c069e44b4f0477fe2429d5781523806f50"},"search_urls":{"md5":"https://zseceye.com/?q=bf32078b169c8215b51ba6e1c7e6ade2","sha256":"https://zseceye.com/?q=7826f1073f73991968b774fe7d9514c069e44b4f0477fe2429d5781523806f50"},"sample_download_url":"https://zseceye.com/report/bf32078b169c8215b51ba6e1c7e6ade2/sample","sample_filename":"7826f1073f739919.zip","iocs":[],"ips":[]}