Investigation of Linux.Mirai Trojan family

More documents

Recommendations

Info

52 52 Linux.Mirai SHA1: 7e0e07d19b9c57149e72a7ed266e0c8aa5019a6f A modified version of Linux.DDoS.87 and Linux.DDoS.89. Its main differences from Linux.DDoS.89 are as follows: · Some samples of the Trojan can now delete themselves. · The Trojan can disable the watchdog timer, which prevents system hangs, to make it impossible to reboot the computer. · The process’s name is changed to a random sequence containing the characters [a-z 0-9]. · The configuration structure has been changed. · If a process named “.anime” is found, the Runkiller function not only terminates this process but also deletes the executable file. · Unlike Linux.DDoS.89, this version can execute HTTP Flood attacks. · If the Trojan fails to create a socket and connect to it, the corresponding function searches for the process that owns the socket and kills it. The Trojan’s configuration looks as follows: Number Value Purpose 3 Listening tun0 Main output to stdin 4 Host Command and control server’s IP address 5 Port C&C server’s port 6 "https://youtube.com/watch? v=dQw4w9WgXcQ" 7 "/proc/" runkiller 8 "/exe" runkiller 9 " (deleted)" 10 "/fd" runkiller 11 ".anime" runkiller 12 "REPORT %s:%s" runkiller 13 "HTTPFLOOD" runkiller 14 "LOLNOGTFO" runkiller 15 "\x58\x4D\x4E\x4E\x43\x50\x46\x22" runkiller
53 53 Number Value Purpose 16 "zollard" runkiller 17 "GETLOCALIP" 18 Host 19 Port 20 "shell" 21 "enable" 22 "system" 23 "sh" 24 "/bin/busybox MIRAI" 25 "MIRAI: applet not found" 26 "ncorrect" 27 "/bin/busybox ps" 28 "/bin/busybox kill -9 " 29 "TSource Engine Query" 30 "/etc/resolv.conf" 31 "nameserver" 32 "Connection: keep-alive" 33 "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8" 34 "Accept-Language: en-US,en;q=0.8" 35 "Content-Type: application/x-www-form-urlencoded" 36 "setCookie('" 37 "refresh:" 38 "location:" 39 "set-cookie:" 40 "content-length:"
Page 1 and 2: Investigation of Linux.Mirai Trojan
Page 3 and 4: 3 3 Introduction A Trojan for Linux
Page 5 and 6: 5 5 v1[1] = XX; v1[2] = XX; v1[3] =
Page 7 and 8: 7 7 Number Data type Value Purpose
Page 9 and 10: 9 9 .text:08048206 mov ds:Q[ecx*4],
Page 11 and 12: 11 11 .text:0804B03C mov dword ptr
Page 13 and 14: 13 13 .text:0804B1FB push 0 ; flags
Page 15 and 16: 15 15 .text:0804B3C1 call ___libc_w
Page 17 and 18: 17 17 .text:0804B4A4 push eax ; int
Page 19 and 20: 19 19 .text:0804B674 push offset a2
Page 21 and 22: 21 21 .text:0804B529 push 4000h ; i
Page 23 and 24: 23 23 } char * data; Code to initia
Page 25 and 26: 25 25 .text:0804BB16 test bl, bl .t
Page 27 and 28: 27 27 setsid(); sleep(time); kill(v
Page 29 and 30: 29 29 The getNumberOrDefault functi
Page 31 and 32: 31 31 v9 = __ROR2__(sport, 8); curr
Page 33 and 34: 33 33 .text:0804AD5E add esp, 18h .
Page 35 and 36: 35 35 .text:0804A50F xor ecx, ecx .
Page 37 and 38: 37 37 In addition, TCP parameters w
Page 39 and 40: 39 39 .text:08048F6D mov eax, [esp+
Page 41 and 42: 41 41 Linux.DDoS.89 SHA1: 846b2d1b0
Page 43 and 44: 43 43 } } else { v8 = 0; while ( ++
Page 45 and 46: 45 45 { } decode(4u); decode(5u); c
Page 47 and 48: 47 47 } else { result = __GI_listen
Page 49 and 50: 49 49 Number Decrypted value Purpos
Page 51: 51 51 .text:0804C218 push 9 ; sig .
Page 55 and 56: 55 55 Next, the Trojan calculates a

Investigation of Linux.Mirai Trojan family

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?