Investigation of Linux.Mirai Trojan family

25
25
.text:0804BB16 test bl, bl
.text:0804BB18 jnz start_parse_params
.text:0804BB1E mov [esp+4Ch+var_20], 0
.text:0804BB26 start_command_execution:
; CODE XREF: process+198j
.text:0804BB26
; process+27Aj
.text:0804BB26 push ebp
.text:0804BB27 push ebp
.text:0804BB28 mov esi, [esp+54h+params_buffer]
.text:0804BB2C xor eax, eax
.text:0804BB2E push esi
.text:0804BB2F mov ebx, [esp+58h+param_count]
.text:0804BB33 push ebx
.text:0804BB34 mov ecx, [esp+5Ch+targets]
.text:0804BB38 push ecx
.text:0804BB39 mov edx, [esp+60h+targets_count]
.text:0804BB3D push edx
.text:0804BB3E mov al, [esp+64h+params]
.text:0804BB42 push eax
.text:0804BB43 push edi
.text:0804BB44 call run_command
run_command
The function receives a time value, a command number, a quantity and array of targets, and a quantity
and array of parameters. First, the handler needed is searched for:
.text:0804B937 mov bl, ds:handlers.length
.text:0804B93D mov al, [esp+2Ch+number]
.text:0804B941 test bl, bl
.text:0804B943 mov [esp+2Ch+local_saved_number], al
.text:0804B947 movzx ebp, [esp+2Ch+target_count]
.text:0804B94C movzx edi, [esp+2Ch+params_count]
.text:0804B951 jz short return ; empty handlers
.text:0804B953 mov ecx, ds:handlers.handlers
.text:0804B959 xor esi, esi
.text:0804B95B cmp al, [ecx+cmd.number]
.text:0804B95D jz short handler_found