Investigation of Linux.Mirai Trojan family

16
16
if(child3>0){
v28 = __GI___libc_open(".shinigami", O_CREAT, v30);
if (v28 >= 0)
close(v28);
sleep(...) // one week
kill(child3);
exit();
}
payload;
The .shinigami file is created in the Trojan’s folder to protect the Trojan from removing itself. The maximum
uptime of Linux.DDoS.87 on an infected computer is one week, after which the Trojan terminates
its operation.
The cycle for receiving and executing commands
After that, the malicious process tries to connect to the C&C server to get instructions:
.text:0804B44E call ___libc_fork
.text:0804B453 mov ebx, eax
.text:0804B455 test eax, eax
.text:0804B457 jg loc_804B84E
.text:0804B45D call ___GI_setsid
.text:0804B462 sub esp, 0Ch
.text:0804B465 push 0 ; fd
.text:0804B467 call ___libc_close
.text:0804B46C mov dword ptr [esp+0], 1 ; fd
.text:0804B473 call ___libc_close
.text:0804B478 mov dword ptr [esp+0], 2 ; fd
.text:0804B47F call ___libc_close
.text:0804B484 add esp, 10h
.text:0804B487 lea eax, [edi+2]
.text:0804B48A xor esi, esi
.text:0804B48C mov [esp+48Ch+ptr_to_third_comm_byte],
eax
.text:0804B490 entry_point_of_payload_execution:
+167j
; CODE XREF: main
.text:0804B490 ; main+17Aj ...
.text:0804B490 mov edx, esi
.text:0804B492 mov eax, 1000h
.text:0804B497 and edx, 0FFFFh
.text:0804B49D push 4000h ; int
.text:0804B4A2 sub eax, edx