허니팟 포착 샘플
악성코드 샘플 목록
Kinryū Labs 허니팟 네트워크에서 포착해 격리하고 해시를 산출한 악성코드입니다. 방어자가 대조하는 값이 해시이므로 해시는 전체를 그대로 표기하고, 공격자 인프라는 무해화해 표기합니다. 대부분의 패밀리는 요청하는 연구자와 방어자에게 공유합니다. 그중 하나는 실제 작동하는 로컬 루트 익스플로잇이 포함된 공개 저장소에 미러링되어 있습니다. 포착 샘플마다 개별 페이지가 있으며, 심층 분석한 샘플은 전체 보고서로 연결됩니다.
분석 글
24
11개 패밀리
전체 분석 완료
5
보고서 연결됨
포착 샘플
828
고유 SHA-256 345개
신규 (VT = 0)
130+
godhive 프레임워크 포함
유입 경로
8
Docker, Jenkins, Redis…
mozi 4
- mozi C2 verifiedProtocol documented
2e4506802aedea2e…Runs as a ddos-bot/worm; the entry vector is not established by static analysis October 24, 2026 - mozi (botv2) C2 verifiedProtocol documented
12013662c71da69d…Runs as a ddos-bot/worm; the entry vector is not established by static analysis September 30, 2026 - mozi C2 verifiedProtocol documented
f6c97b1e2ed02578…Runs as a ddos-bot/worm; the entry vector is not established by static analysis September 13, 2026 - mozi C2 verifiedProtocol documented
4293c1d8574dc87c…Runs as a ddos-bot/worm; the entry vector is not established by static analysis September 9, 2026
unclassified 10
- X86 PE32 executable for MS Windows 4.00 (GUI) worm (807126cbae47) C2 verifiedProtocol documented
807126cbae47c03c…Runs as a worm/cryptominer; the entry vector is not established by static analysis October 24, 2026 - X86_64 ELF 64-bit LSB pie executable ddos-bot (ada33a0316d3) C2 verifiedProtocol documented
ada33a0316d364d1…Runs as a ddos-bot/worm; the entry vector is not established by static analysis October 12, 2026 - Arm ELF 32-bit LSB executable ddos-bot (1fc37d38754d) C2 verifiedProtocol documented
1fc37d38754d3991…Runs as a ddos-bot/worm; the entry vector is not established by static analysis October 11, 2026 - Mips ELF 32-bit MSB executable ddos-bot (9200aac4a356) C2 verifiedProtocol documented
9200aac4a3561902…Runs as a ddos-bot/worm; the entry vector is not established by static analysis September 30, 2026 - Arm ELF 32-bit LSB executable ddos-bot (9e6da804ae9c) C2 verifiedProtocol documented
9e6da804ae9ca0a0…Runs as a ddos-bot/worm; the entry vector is not established by static analysis September 29, 2026 - Arm ELF 32-bit LSB executable ddos-bot (34186fba4b5a) C2 verifiedProtocol documented
34186fba4b5a9c64…Runs as a ddos-bot/worm; the entry vector is not established by static analysis September 28, 2026 - X86_64 ELF 64-bit LSB pie executable ddos-bot (3261921456e3) C2 verifiedProtocol documented
3261921456e347fb…Runs as a ddos-bot/worm; the entry vector is not established by static analysis September 27, 2026 - X86_64 ELF 64-bit LSB pie executable ddos-bot (7d7210719451) C2 verifiedProtocol documented
7d7210719451068d…Runs as a ddos-bot/worm; the entry vector is not established by static analysis September 27, 2026 - X86 ELF 32-bit LSB executable ddos-bot (59bdafde8769) C2 verifiedProtocol documented
59bdafde87693987…Runs as a ddos-bot/worm; the entry vector is not established by static analysis September 22, 2026 - POSIX shell script loader (42f1363b2247) C2 recovered
42f1363b224766f6…Runs as a loader/dropper; the entry vector is not established by static analysis September 20, 2026
redtail 1
- redtail C2 verified
7c6c19b6e9343c77…Runs as a dropper/loader; the entry vector is not established by static analysis September 20, 2026
nsminer 1
- nsminer C2 recoveredProtocol documented
7126b9932dc0cdfe…Runs as a cryptominer/dropper; the entry vector is not established by static analysis September 18, 2026
mirai 2
- mirai C2 verifiedProtocol documented
d8712c619b951fc2…Runs as a ddos-bot; the entry vector is not established by static analysis September 14, 2026 - mirai (pboc) C2 verifiedProtocol documented
c9727a1237b59d53…Runs as a ddos-bot/worm; the entry vector is not established by static analysis September 10, 2026
atomic-mirai 1
- atomic-mirai C2 recovered
42f1363b224766f6…Runs as a loader/dropper; the entry vector is not established by static analysis September 7, 2026
godhive 1
- godhive Novel, not on VTC2 live
4194f2337c2b261e…Exposed Docker API July 15, 2026
Go DDoS botnet 1
- Go DDoS botnet VT 40/74C2 live
6da756970a411dad…Jenkins Script Console RCE July 1, 2026
rootpacket 1
- rootpacket VT 29/74CVE-2026-31431
e2d0dab6b29df89d…Docker API → privileged-container host escape June 15, 2026
kworker 1
- kworker VT 37/74
7420e819e6cf6d76…Exposed Redis (cron injection) June 10, 2026
RedTail 1
- RedTail Known family
59c29436755b0778…Exposed Docker API June 5, 2026
필터에 해당하는 포착 샘플이 없습니다.
범용 악성코드 포착 샘플
네트워크에는 범용 악성코드도 꾸준히 유입되며, 포착 시점에 격리하고 해시를 산출합니다. 목록에 기록한 뒤 그대로 두며, 상세 분석을 할 만큼 새로운 것은 없습니다.
- Mirai / Gafgyt 변종. Telnet 무차별 대입으로 투하되는 다중 아키텍처 ELF로, 물량이 가장 많습니다. 캠페인 한 차례마다 11~14개 아키텍처의 바이너리가 투하됩니다.
- Jenkins DDoS 드로퍼. Script Console을 통한 Groovy RCE로, bins.sh 로더와 아키텍처별 ELF/PE 페이로드로 구성됩니다. 위의 Go DDoS 봇넷과 겹칩니다.
- ESXi OpenSLP 페이로드. UDP/TCP 427을 통한 CVE-2021-21974 익스플로잇 시도로, 대부분 소규모 프로토콜 페이로드입니다.
- 악성 Redis 모듈. MODULE LOAD로 적재되는 백도어 / 로더 .so 모듈입니다.
샘플 요청
일부 패밀리는 공개 GitHub에 미러링되어 있으며 바로 연결됩니다. 나머지는 [email protected]로 이메일을 보내 본인이 누구이고 어떤 용도로 필요한지 밝혀 주세요. 이 페이지의 모든 샘플은 실제 작동하는 악성코드이고, 저장소 하나에는 실제 작동하는 로컬 루트 익스플로잇이 포함되어 있으므로, 사용 중인 네트워크와 연결되지 않은 일회용 VM에서만 실행하세요.