Investigation of Linux.Mirai Trojan family

7
7
Number
Data type Value Purpose
23 string "Connection: keep-alive" cmd14 generating requests
24 string "User-Agent: " cmd14 generating requests
25 string "Accept: text/html,application/xhtml
+xml,application/xml;q=0.9,image/webp,*/
*;q=0.8"
cmd14 generating requests
26 string "Accept-Encoding: gzip, deflate, sdch" cmd14 generating requests
27 string "Accept-Language: en-US,en;q=0.8" cmd14 generating requests
28 string "Cookie: " not used
29 string "/proc/" used by runKiller function
30 string "/exe" used by runKiller function
31 string "/cwd/" used by runKiller function
33 string ".shinigami" used by runKiller and main functions
100 string "gayfgt" used by runKiller function
101 string "REPORT %s:%s" used by runKiller function
102 string "hello friend :)" used by runKiller function
103 string "[KTN]" used by runKiller function
The following functions are then used to get the configuration values:
Function
char *get_data_from_config(int number)
uint32 get_conf_uint32(int number)
uint16 get_conf_uint16(int number)
uint8 get_conf_uint8(int number)
Purpose
returns the data pointer for conf_entry with the number value
returns unit32 stored under the data pointer for conf_entry with the
number value
returns unit16 stored under the data pointer for conf_entry with the
number value
returns unit8 stored under the data pointer for conf_entry with the
number value