Executive Summary
The analysis describes a fully-featured Mirai botnet variant targeting embedded Linux and IoT devices, such as IP cameras and DVRs. The infection begins with a shell-based dropper (l.sh) that profiles the target device's CPU architecture (ARM, MIPS, x86, etc.) and downloads a corresponding binary from an open directory at 77.239.124[.]141. Once executed, the bot establishes communication with a C2 server on port 18129 to receive flooding commands.
Technically, the malware exhibits sophisticated evasion and persistence behaviors, including process masquerading by mimicking kernel threads like [kswapd0] and [kthreadd]. It establishes multi-layered persistence by hooking into Linux init scripts, cron jobs, and non-volatile MTD partitions. The malware also features a 'killer' module designed to terminate competing botnets and diagnostic tools (e.g., netstat, lsof) to maintain exclusive control over the host.
The urgency of this threat is high for organizations managing large IoT deployments or industrial systems. The bot's primary objective is Distributed Denial of Service (DDoS), utilizing diverse flooding techniques including UDP, TCP SYN/ACK, and GRE Ethernet floods, which can significantly impact business continuity if the infrastructure is weaponized.