How are Mirai variants infecting the IoT landscape?

That malware evolves is nothing new, but some evolve more than others. Particularly Mirai.

We’ve previously looked at how Mirai, an IoT botnet has changed since its source code became public, and recent analysis of IoT attacks and malware trends show that Mirai has continued it evolution. The result is an increase in attacks, using Mirai variants, as unskilled attackers create malicious botnets with relative ease.

The Avira IoT honeypot recently captured samples that are modified variants of Mirai. Our initial analysis found that these malware samples were similar to Mirai with a small, obvious change: using “CORONA” as a string in “/bin/busybox CORONA” command. Therefore, the IoT researchers at Avira named this new Mirai variant as ‘Mirai Corona‘.

In the screenshot below, you can see the attacker links this Mirai variant with the Corona pandemic, suggesting that “Total lockdown is the solution”. Under the hood, it is still Mirai, just a new variant that targets NAS devices (ZyXEL NAS exploiting CVE-2020-9054).

This blog will present a detailed analysis on how this new variant of Mirai is exploiting the vulnerabilities found in the IoT landscape, along with new C&C servers.

Analysis of the Mirai variant

The core functionality of Mirai do not change in this version. However, we observed few changes that are worth mentioning:

Notable features:

• Different Control Flow Obfuscation
• Custom encryption/decryption technique
• Packets construction via C&C servers info and anti DDOS capabilities

Different control flow obfuscation

Instead of using simple fork technique, the new Mirai variant uses very different kind of Control Flow Obfuscation. The main section of the code calling encryptionhandle is entirely different code block. rt_sigaction is used to control flow obfuscation. This system call is used to change the action taken after receipt of a specific signal.

Custom encryption/decryption technique

In the image below, the Mirai variant can be seen communicating with C&C, but prior communicating with C&C, it decrypts some strings (commands and credentials). Instead of using simple xor, it uses a custom routine.

After initialization and string decryption, the variant starts communicating with its C&C server.

Anti DDOS capabilities and packet construction

The botnet has attack_parsing() function that sets DDoS attack mechanics such as, UDP, TCP, UDPbypass and TCPbypass along with C&C command strings information sent by a C&C server (SYN flag, ACK flag, URG flag, RST flag, time, destination port, header length) for packet construction.

Further, it can be seen that this botnet has anti DDOS defense capabilities through TCPbypass and UDPbypass attack routines which is different from other normal sample.

Below are the images of call graph for TCPbypass and UDPbypass and packet construction in attack_parsing() function :

On the other side, the usual activities that we see is that it communicates with /dev/watchdog to prevent watchdog from rebooting the device.

The Mirai variant uses cleaner_get_name(), killer_kill_by_cmdline and killer_kill_by_permission functions that allows the botnet to kill processes by specific strings, process command line and permission respectively. Furthermore, it binds to the TCP port 28341 to ensure single instance running on an infected device. The botnet scans the TCP port 23 of random hosts for brute-forcing and phone back to its C&C server once login attempt becomes successful.

Once the malware is up, it sends a beacon to a C&C server at a specific port, notifying the C&C that it is now ready for command to execute on the device. During our analysis, we found the following C&C servers:

• 104[.]218.50.89
• 167[.]86.126.28
• 185[.]125.230.11
• 84[.]196.75
• 148[.]120.105

Conclusion

It is important to safeguard IoT endpoints installed in consumer environments. it is the industry’s responsibility, and the the responsibility of the consumer, to ensure that their IoT devices are reliable products, have strong authentication credentials and they are regularly patched.

the Avira IoT Research team monitors such new malware families or variants and provide detections for them. Integrating Avira SafeThings and anti-malware technologies can help protect customers from such attacks.

IoCs

List of different Mirai variants: