Investigation of Linux.Mirai Trojan family

44
44
}
if ( (signed int)malware_conf.size > 0 )
{
v8 = 0;
v9 = *malware_conf.entries;
if ( a2 == (*malware_conf.entries)->number_ )
{
LABEL_10:
v9->func(a3, a4, a5, a6);
}
else
{
while ( ++v8 != malware_conf.size )
{
v9 = malware_conf.entries[v8];
if ( v9->number_ == a2 )
goto LABEL_10;
}
}
}
}
}
The main differences from Linux.DDoS.87
The pseudo-random sequence generator has been changed, as has the order in which the Trojan performs
its actions once it has been launched. First, it starts operating with signals, ignoring SIGINT:
__GI_sigemptyset(&v43);
__GI_sigaddset(&v43, SIGINT);
__GI_sigprocmask(SIG_BLOCK, &v43, 0)
Then other signal handlers are installed:
__bsd_signal(SIGCHLD, SIGEV_NONE);
__bsd_signal(SIGTRAP, change_host);
//change_host:
void __cdecl change_host()