Investigation of Linux.Mirai Trojan family

38
38
.text:08049666 lea ebx, [esi+2Ch]
.text:08049669 call rand_cmwc
.text:0804966E mov [esi+2Ch], eax
.text:08049671 call rand_cmwc
.text:08049676 mov [ebx+4], eax
cmd7 – TCP flood simple
In contrast to the previous methods, when this command is executed, only the port and the size of the
transmitted data are defined. To carry out an attack, sockets are used to establish a TCP connection:
port = getNumberOrDefault(params_count, params, 7, 80);
size = getNumberOrDefault(params_count, params, 0, 1024);
useRandom = getNumberOrDefault(params_count, params, 1, 1);
cmd8 UDP flood over GRE
The command sends UDP packets over the GRE protocol and uses the following parameters:
TOS = getNumberOrDefault(params_count, param, 2, 0);
ident = getNumberOrDefault(params_count, param, 3, 0xFFFF);
TTL = getNumberOrDefault(params_count, param, 4, 64);
frag = getNumberOrDefault(params_count, param, 5, 1);
sport = getNumberOrDefault(params_count, param, 6, 0xFFFF);
dport = getNumberOrDefault(params_count, param, 7, 0xFFFF);
payloadLength = getNumberOrDefault(params_count, param, 0, 512);
fillRandom = getNumberOrDefault(params_count, param, 1, 1);
useSameAddr = getNumberOrDefault(params_count, param, 19, 0); //inner
ip.dstAddr == outer ip.dstAddr
The GRE packet is generated as follows:
; CODE XREF: cm-
.text:08048F57 loc_8048F57:
d8_GRE_udp_random+1EFj
.text:08048F57 mov [ebx+ipgre8._ip.protocol],
IPPROTO_GRE
.text:08048F5B mov [edx+gre_packet.protocolType], 8 ;
IP protocol
.text:08048F61 mov eax, ds:selfaddr
.text:08048F66 mov ecx, [esp+5Ch+arg_4]
.text:08048F6A mov [ebx+ipgre8._ip.src_addr], eax