蜜罐捕获
恶意软件样本库
Kinryū Labs 蜜罐网络捕获的恶意软件，已隔离并计算哈希。哈希值完整列出，因为防御者比对的正是哈希；攻击者基础设施已做无害化处理。大多数家族会共享给提出请求的研究人员与防御者。其中一个家族已镜像至一个公开仓库，该仓库附带可用的本地 root 提权漏洞利用程序。每个捕获样本都有独立页面，分析较深入的样本会链接至完整报告。
分析记录
24
11 个家族
附完整剖析
5
已关联报告
捕获样本
828
345 个不同的 SHA-256
新型样本（VT = 0）
130+
含 godhive 框架
投递途径
8
Docker、Jenkins、Redis……
mozi 4
- mozi C2 verifiedProtocol documented
2e4506802aedea2e…Runs as a ddos-bot/worm; the entry vector is not established by static analysis October 24, 2026 - mozi (botv2) C2 verifiedProtocol documented
12013662c71da69d…Runs as a ddos-bot/worm; the entry vector is not established by static analysis September 30, 2026 - mozi C2 verifiedProtocol documented
f6c97b1e2ed02578…Runs as a ddos-bot/worm; the entry vector is not established by static analysis September 13, 2026 - mozi C2 verifiedProtocol documented
4293c1d8574dc87c…Runs as a ddos-bot/worm; the entry vector is not established by static analysis September 9, 2026
unclassified 10
- X86 PE32 executable for MS Windows 4.00 (GUI) worm (807126cbae47) C2 verifiedProtocol documented
807126cbae47c03c…Runs as a worm/cryptominer; the entry vector is not established by static analysis October 24, 2026 - X86_64 ELF 64-bit LSB pie executable ddos-bot (ada33a0316d3) C2 verifiedProtocol documented
ada33a0316d364d1…Runs as a ddos-bot/worm; the entry vector is not established by static analysis October 12, 2026 - Arm ELF 32-bit LSB executable ddos-bot (1fc37d38754d) C2 verifiedProtocol documented
1fc37d38754d3991…Runs as a ddos-bot/worm; the entry vector is not established by static analysis October 11, 2026 - Mips ELF 32-bit MSB executable ddos-bot (9200aac4a356) C2 verifiedProtocol documented
9200aac4a3561902…Runs as a ddos-bot/worm; the entry vector is not established by static analysis September 30, 2026 - Arm ELF 32-bit LSB executable ddos-bot (9e6da804ae9c) C2 verifiedProtocol documented
9e6da804ae9ca0a0…Runs as a ddos-bot/worm; the entry vector is not established by static analysis September 29, 2026 - Arm ELF 32-bit LSB executable ddos-bot (34186fba4b5a) C2 verifiedProtocol documented
34186fba4b5a9c64…Runs as a ddos-bot/worm; the entry vector is not established by static analysis September 28, 2026 - X86_64 ELF 64-bit LSB pie executable ddos-bot (3261921456e3) C2 verifiedProtocol documented
3261921456e347fb…Runs as a ddos-bot/worm; the entry vector is not established by static analysis September 27, 2026 - X86_64 ELF 64-bit LSB pie executable ddos-bot (7d7210719451) C2 verifiedProtocol documented
7d7210719451068d…Runs as a ddos-bot/worm; the entry vector is not established by static analysis September 27, 2026 - X86 ELF 32-bit LSB executable ddos-bot (59bdafde8769) C2 verifiedProtocol documented
59bdafde87693987…Runs as a ddos-bot/worm; the entry vector is not established by static analysis September 22, 2026 - POSIX shell script loader (42f1363b2247) C2 recovered
42f1363b224766f6…Runs as a loader/dropper; the entry vector is not established by static analysis September 20, 2026
redtail 1
- redtail C2 verified
7c6c19b6e9343c77…Runs as a dropper/loader; the entry vector is not established by static analysis September 20, 2026
nsminer 1
- nsminer C2 recoveredProtocol documented
7126b9932dc0cdfe…Runs as a cryptominer/dropper; the entry vector is not established by static analysis September 18, 2026
mirai 2
- mirai C2 verifiedProtocol documented
d8712c619b951fc2…Runs as a ddos-bot; the entry vector is not established by static analysis September 14, 2026 - mirai (pboc) C2 verifiedProtocol documented
c9727a1237b59d53…Runs as a ddos-bot/worm; the entry vector is not established by static analysis September 10, 2026
atomic-mirai 1
- atomic-mirai C2 recovered
42f1363b224766f6…Runs as a loader/dropper; the entry vector is not established by static analysis September 7, 2026
godhive 1
- godhive Novel, not on VTC2 live
4194f2337c2b261e…Exposed Docker API July 15, 2026
Go DDoS botnet 1
- Go DDoS botnet VT 40/74C2 live
6da756970a411dad…Jenkins Script Console RCE July 1, 2026
rootpacket 1
- rootpacket VT 29/74CVE-2026-31431
e2d0dab6b29df89d…Docker API → privileged-container host escape June 15, 2026
kworker 1
- kworker VT 37/74
7420e819e6cf6d76…Exposed Redis (cron injection) June 10, 2026
RedTail 1
- RedTail Known family
59c29436755b0778…Exposed Docker API June 5, 2026
没有符合该筛选条件的捕获样本。
商品化恶意软件捕获
蜜罐网络还会持续捕获一定数量的商品化恶意软件，捕获时即隔离并计算哈希。这些样本仅编目留存；其中没有一个新颖到值得做一次完整剖析。
- Mirai / Gafgyt 变种. 通过 Telnet 暴力破解投递的多架构 ELF 文件，占比最大。每一波攻击活动投递 11–14 种架构的二进制文件。
- Jenkins DDoS 投放器. 通过 Script Console 实现 Groovy RCE；一个 bins.sh 加载器加上按架构区分的 ELF/PE 载荷。与上文的 Go DDoS 僵尸网络有重叠。
- ESXi OpenSLP 载荷. 经 UDP/TCP 427 发起的 CVE-2021-21974 漏洞利用尝试；大多是体积很小的协议载荷。
- 恶意 Redis 模块. 通过 MODULE LOAD 加载的后门 / 加载器 .so 模块。
申请样本
少数家族已镜像至我们的公开 GitHub，并直接链接到那里。其余样本请发邮件至 [email protected]，说明您的身份和用途。本页面上的所有内容都是可运行的恶意软件，其中一个仓库还附带可用的本地 root 提权漏洞利用程序，因此请在一次性 VM 中运行，且该 VM 不得连通您所使用的任何网络。