Mirai & Variants: Forensic Reverse-Engineering & Architectural Dossier

{
  "compiler": "GNU C Compiler (GCC) with uClibc / Musl toolchains",
  "runtime": "Native POSIX / Linux System Call Interface (libc-free or uClibc)",
  "binary_footprint": "Ultra-lightweight Linux ELF binary (typ. 55 KB - 110 KB statically linked)",
  "stub_size": "65,536 bytes typical compiled MIPS/ARM ELF footprint",
  "packer_obfuscation": "Statically stripped ELF symbols; configuration table encrypted with 4-byte or 1-byte XOR keys",
  "subsystem": "Linux POSIX Console / Background Daemon",
  "entry_point_flow": "_start -> main() -> Single-instance port binding (0xC0CA / 48101) -> Delete own binary from disk (unlink) -> table_init() -> Ping watchdog (/dev/watchdog) -> killer_init() (kill competing bots) -> scanner_init() (Telnet scanner loop) -> Connect to C2 and enter attack command listener loop",
  "technical_summary": "Mirai is the foundational archetype for modern Linux IoT botnets. Engineered in pure modular C, it executes internet-scale IPv4 scanning to compromise exposed Telnet and embedded management services using hardcoded default credential dictionaries. Upon compromising a device, Mirai terminates competing bot processes, hooks the hardware watchdog to inhibit reboots, and registers with a centralized C2 server to execute high-volume multi-vector DDoS attacks (TCP SYN/ACK, UDP, GRE, DNS, and HTTP floods)."
}

{
  "interface_type": "Go-based Administrative Telnet Management CLI",
  "builder_tabs_options": [],
  "config_struct_layout": [
    {
      "offset": "TABLE_CNC_PORT",
      "field": "c2_port",
      "type": "uint16_t",
      "description": "Port number for command and control connection"
    },
    {
      "offset": "TABLE_CNC_DOMAIN",
      "field": "c2_domain",
      "type": "XOR-Encrypted String",
      "description": "Primary domain name or IP of the Mirai CNC server"
    },
    {
      "offset": "TABLE_KILLER_PROC",
      "field": "process_names",
      "type": "XOR-Encrypted String Array",
      "description": "Array of rival botnet process strings targeted for termination"
    },
    {
      "offset": "TABLE_SCAN_CB_PORT",
      "field": "report_port",
      "type": "uint16_t",
      "description": "Port of the Mirai scan receiver/loader server"
    }
  ],
  "payload_generation_flags": [
    "Compiler Flag: -static -Os -fomit-frame-pointer",
    "Target Architectures: armv4l, armv5l, mips, mipsel, x86, x64, ppc, sh4",
    "XOR Key: 0xDEADBEEF (32-bit rolling) or 0x22 (single-byte)",
    "Single Instance Port: 48101 (0xC0CA)"
  ],
  "operator_commands": [
    "!udp <target> <duration> dport=<port> len=<len>: Volumetric UDP packet flood",
    "!syn <target> <duration> dport=<port>: High-frequency TCP SYN state exhaustion flood",
    "!ack <target> <duration> dport=<port>: TCP ACK bypass flood targeting stateful inspection",
    "!greip <target> <duration>: Generic Routing Encapsulation (GRE) protocol 47 flood",
    "!dns <target> <domain> <duration>: Recursive DNS amplification and server flood",
    "!http <method> <target> <duration>: Layer 7 HTTP STOMP flood using randomized headers"
  ],
  "interface_telemetry_analysis": "The operator interface is an administrative Telnet console hosted by the Go-based CNC server. Operators connect via Telnet, authenticate with username and password credentials, view real-time counts of connected bots broken down by CPU architecture (ARM, MIPS, x86), and broadcast coordinated DDoS attack commands."
}

struct Mirai_&_Variants_Config {
    uint32_t magic;
    char c2_host[128];
    uint16_t port;
    char install_path[260];
    char mutex[64];
    uint8_t aes_key[32];
};

{
  "injection_chain": "Execution via Telnet brute force or vulnerability exploit: Scanner identifies open Telnet port 23/2323 -> Iterates 60+ default credentials (e.g., root:xc3511, admin:admin) -> Upon success, transmits IP:Port:Creds to central report server -> Report server triggers loader server -> Loader logs in via Telnet and issues /bin/busybox wget or tftp command to fetch architecture-specific ELF -> Executes binary -> Process deletes own binary from disk via unlink() to hinder post-mortem analysis.",
  "ntapi_functions": [
    "sys_socket (0x66 / SYS_SOCKET)",
    "sys_connect",
    "sys_sendto",
    "sys_recvfrom",
    "sys_bind",
    "sys_fork",
    "sys_kill",
    "sys_unlink",
    "sys_open",
    "sys_read",
    "sys_write"
  ],
  "process_hollowing_target": "None (Linux native daemon; unlinks own executable from filesystem via unlink(\"/proc/self/exe\") while maintaining resident execution)",
  "persistence_mechanics": [
    "Process Watchdog: Opens /dev/watchdog, /dev/misc/watchdog to send WDIOC_KEEPALIVE ioctl calls preventing automatic device hardware reboot",
    "Single-Instance Lock: Binds local TCP port 48101 (0xC0CA); exits if bind fails indicating existing instance",
    "Reboot Persistence: Typically lacks non-volatile disk persistence; relies on rapid re-infection across device reboots"
  ],
  "evasion_hooks": [
    "Binary Self-Deletion: Immediately unlinks own binary from filesystem (/proc/$$/exe) upon initial execution to prevent offline forensics.",
    "Process Disguise: Overwrites argv[0] with benign process names (e.g., /bin/busybox, sshd) to evade basic ps command detection.",
    "Killer Subroutine: Periodically inspects /proc/[pid]/exe and /proc/[pid]/maps, sending SIGKILL to rival botnets (Qbot/Gafgyt, Hajime) and administrative Telnet/SSH shells."
  ],
  "anti_analysis": [
    "XOR String Encryption: Table configuration strings stored in XOR-obfuscated format, decrypted strictly on-demand in memory.",
    "Anti-GDB / Anti-Trace: Checks ptrace return status and terminates if being debugged."
  ]
}

Concrete technical breakdown of functional modules implemented in the Mirai & Variants binary:

{
  "framing": "Custom binary protocol over raw TCP; packets structured with 2-byte duration, 1-byte attack vector ID, and target address structures",
  "serialization": "Raw Big-Endian network byte order structs",
  "handshake": "Bot connects to C2 TCP port -> Sends 4-byte null byte sequence (\\x00\\x00\\x00\\x00) -> Sends architecture string (e.g., 'arm', 'mips') -> C2 acknowledges and enters command wait state",
  "cryptography": "Configuration table obfuscated with 4-byte rolling XOR (0xDEADBEEF); network command streams operate in raw binary framing",
  "packet_types": [
    {
      "header": "0x00 [Bot Check-In]",
      "payload": "\\x00\\x00\\x00\\x00 followed by architecture string",
      "direction": "Bot -> CNC Server"
    },
    {
      "header": "0x01 [Ping / Heartbeat]",
      "payload": "\\x00 (Single null byte keep-alive)",
      "direction": "Bot -> CNC Server"
    },
    {
      "header": "0x02 [Attack Broadcast]",
      "payload": "Duration [2B], Attack Vector [1B], Target Count [1B], Target IP/Mask [5B], Options [Var]",
      "direction": "CNC Server -> Bot"
    }
  ],
  "traffic_signature": "High-volume outbound SYN packets across port 23 and 2323 generated by scanner threads; coordinated volumetric traffic bursts (SYN flood, UDP flood, GRE flood) during active DDoS commands."
}

Indicators of compromise and forensic patterns recorded across laboratory triage: