Investigation of Linux.Mirai Trojan family

22
22
.text:0804B4F6 push eax ; a1
.text:0804B4F7 call process
.text:0804B4FC add esp, 0Ch
.text:0804B4FF push 0FFFFFFFFh
.text:0804B501 push ebx
.text:0804B502 lea ebx, [edi+ebx]
.text:0804B505 push ebx
.text:0804B506 call shiftBuffer
.text:0804B50B add esp, 10h
.text:0804B50E cmp si, 1
.text:0804B512 jbe entry_point_of_payload_execution
process
The function receives a pointer to the third byte of the command and its length. Then it starts parsing
the command’s arguments and filling the respective structures:
// structures representing data received from the server
struct target{
uint32_t ip; //target IP
uint8_t maskbits; // if the specified number is less than 31, the
Trojan will attack random hosts obtained from IP by randomly generating
lowest bits maskbits
}
struct param{
uint8_t id;
uint8_t len;
uint8_t data[len];
}
//structures that are displayed in the Trojan
struct target_parsed {
uint32 target_ip;
uint8 maskbits;
sockaddr_in sockaddr;
}
struct param_parsed {
uint8
id;