Investigation of Linux.Mirai Trojan family

48
48
.rodata:080510BC
.rodata:080510C0
dd offset runkiller
dd offset change_host
Then the name of the current process is checked. If it is “./dvrHelper”, the SIGTRAP signal is created.
This signal is responsible for changing the C&C server.
Each configuration is filled in the following way:
v2 = (char *)malloc(0xFu);
memcpy(v2, (char *)&unk_8051259, 15);
conf_entries[3].data = v2;
conf_entries[3].length = 15;
v3 = (char *)malloc(4u);
memcpy(v3, "'ь+B", 4);
conf_entries[4].data = v3;
conf_entries[4].length = 4;
v4 = (char *)malloc(2u);
memcpy(v4, "\"5", 2);
conf_entries[5].data = v4;
conf_entries[5].length = 2;
v5 = (char *)malloc(7u);
The configuration for this sample looks as follows:
Number
Decrypted value
Purpose
1 "DROPOUTJEEP"
2 "wiretap -report='tcp://65.222.202.53:80'" this string is appended as a Trojan’s name and is displayed
in a process list
3 "listening tun0" output to stdin when launched
4 C&C server’s address
5 C&C server’s port
6 "/proc/" runkiller
7 "/exe" runkiller
8 "REPORT %s:%s" runkiller
9 "HTTPFLOOD" runkiller