Malware Analysis Space

  Summary Since 2016, when the Mirai source code was published, similar family botnets have emerged; more and more botnets have appeared. and IoT security has become a big challenge. That makes me care about botnet development and do research. Recently, Mirai attracts me again; I like to do analysis with it in a different way, so here it is.   Analysis   Protect and Disguise Itself Like any other malware that does anti-debug from an analyst, Mirai uses the function anti_gdb_entry with one parameter to monitor gdb debug. If it discovers debugging, it executes the function unlink to delete itself and tries to prevent the watchdog from rebooting the device and keep itself running all the time, not offline. Figure1-anti-debug, delete self and keeping running   Using a random string which the length can be either 12, 16, 20, or 24 as name of processes and execute util_strcpy function for copying string to args[0] and hiding a real name. Figure2-Hide argv0 ...