{"id":"e2b4e33f6804b2492f4221f84f6c47f4","title":"Mirai — Mirai · 僵尸网络/DDoS · ELF32","md5":"e2b4e33f6804b2492f4221f84f6c47f4","sha256":"d4b9248856c5fd3efd41d13209f0710465c272fd9d7505cb3ab9532a8131c8ae","family":"Mirai","apt":"Mirai-Botnet","verdict":null,"sample_type":"僵尸网络/DDoS","lang":"C++","file_format":"ELF32","compiler":"GCC","published_at":"2026-08-10T16:00:00.000Z","summary":"该样本为 Mirai 家族僵尸网络客户端（ARM 小端架构），与同日大端样本 1dfa46e7 为同一僵尸网络的不同架构构建（共享 C2 94.154.43.12、kernfailure 标志、GCC 3.3.2 工具链）。具备：① 连接硬编码 C2 94.154.43.12；② /dev/ptmx 进程隐藏；③ 内置 shell 执行；④ /tmp/.Kdat_tmp 落地 + 下载执行能力。与 1dfa46e7 的唯一区别为字节序（armv4 vs armv4eb），证明僵尸网络运营者针对不同字节序设备编译分发。","url":"https://zseceye.com/report/e2b4e33f6804b2492f4221f84f6c47f4","json_url":"https://zseceye.com/report/e2b4e33f6804b2492f4221f84f6c47f4.json","html_url":"https://zseceye.com/report/e2b4e33f6804b2492f4221f84f6c47f4","hash_urls":{"md5":"https://zseceye.com/hash/e2b4e33f6804b2492f4221f84f6c47f4","sha256":"https://zseceye.com/hash/d4b9248856c5fd3efd41d13209f0710465c272fd9d7505cb3ab9532a8131c8ae"},"search_urls":{"md5":"https://zseceye.com/?q=e2b4e33f6804b2492f4221f84f6c47f4","sha256":"https://zseceye.com/?q=d4b9248856c5fd3efd41d13209f0710465c272fd9d7505cb3ab9532a8131c8ae"},"sample_download_url":"https://zseceye.com/report/e2b4e33f6804b2492f4221f84f6c47f4/sample","sample_filename":"d4b92488.zip","iocs":[],"ips":[]}