Investigation of Linux.Mirai Trojan family

47
47
}
else
{
result = __GI_listen(server_socket, 1);
}
}
return result;
If the Trojan fails to use the bind system call, it connects to the corresponding port because it is assumed
that the port is already busy running a previously launched Linux.DDoS.89 process. In this case,
the previously launched process terminates itself. Once the server is launched, the C&C server address
information stored in the executable file is added to the sockaddr_in structure:
.text:0804BBEF mov ds:cnc.sin_family, 2
.text:0804BBF8 add esp, 10h
.text:0804BBFB mov ds:cnc.sin_addr.s_addr, XXXXXXXXh
.text:0804BC05 mov ds:cnc.sin_port, 5000h
Then the following function obtained from the process is calculated:
def check(name):
print name
a = [ord(x) for x in name]
sum = (0 - 0x51) & 0xff
for i in [2,4,6,8,10,12]:
z = (~a[i % len(a)] & 0xff)
sum = (sum + z)&0xff
return sum % 9
The result returned by the function is an index in a function array. The function with the corresponding
index will be performed. The list of functions looks as follows:
.rodata:080510A0 off_80510A0
main+4Do
.rodata:080510A4
.rodata:080510A8
.rodata:080510AC
.rodata:080510B0
.rodata:080510B4
.rodata:080510B8
dd offset start_server ; DATA XREF:
dd offset decode
dd offset get_config_entry
dd offset fill_config
dd offset encode
dd offset memncpy
dd offset strcmp