Investigation of Linux.Mirai Trojan family

15
15
.text:0804B3C1 call ___libc_write
.text:0804B3C6 add esp, 0Ch
.text:0804B3C9 push 1 ; int
.text:0804B3CB push offset newline ; int
.text:0804B3D0 push 1 ; fd
.text:0804B3D2 call ___libc_write
Then the Trojan removes its name to hide itself:
.text:0804B3D8 mov ebp, [esi] ; esi = argv[0]
.text:0804B3DA push ebp ; a1
.text:0804B3DB call strlen
.text:0804B3E0 add esp, 10h
.text:0804B3E3 mov ecx, eax
.text:0804B3E5 test eax, eax
.text:0804B3E7 jle short loc_804B3F6
.text:0804B3E9 xor edx, edx
.text:0804B3EB
.text:0804B3EB loc_804B3EB:
; CODE XREF: main
+94j
.text:0804B3EB mov eax, [esi]
.text:0804B3ED mov byte ptr [eax+edx], 0
.text:0804B3F1 inc edx
.text:0804B3F2 cmp ecx, edx
.text:0804B3F4 jnz short loc_804B3EB
The child processes are subsequently launched (the code is simplified and contains no requests to the
configuration):
//here is parent
pid_t child = fork();
(child > 0){
}
waitpid(child, &status, 0); //waiting until child die
exit();
if(!child){ //child executing this
}
pid_t child2 = fork();
if(child2 > 0){//we spawn children—time to die
}
exit(); //after this exit() grandpa will die too
pid_t child3 = fork();