Investigation of Linux.Mirai Trojan family

13
13
.text:0804B1FB push 0 ; flags
.text:0804B1FD push ebp ; filename
.text:0804B1FE call ___GI___libc_open
.text:0804B203 add esp, 10h
.text:0804B206 test eax, eax
.text:0804B208 js short kill_if_bot
.text:0804B20A sub esp, 0Ch
.text:0804B20D push eax ; fd
.text:0804B20E call ___libc_close
.text:0804B213 add esp, 10h
.text:0804B216 jmp read_next_proc_entry
If the file named .shinigami is absent from the folder, the process’s executable file is read in order to
find strings from a configuration whose numbers are higher than 100. Meanwhile, the Trojan reads file
fragments sequentially. The size of each fragment is 0x800 byte. If the value required is at buffer overflow,
the process is not terminated.
fillCmdHandlers
A function responsible for filling a structure that stores command handlers. The structure looks as follows:
struct cmd {
}
char number;
void *handler;
struct cmd_handlers {
cmd *handlers;
char length;
}
The structure is filled in the following way:
v0 = realloc(handlers.handlers, 8 * handlers.length + 8);
v1 = handlers.length + 1;
handlers.handlers = v0;
v2 = &v0[handlers.length];
v2->number = 0;
v2->func = cmd0_udp_random;
handlers.length = v1;