[Source Code] Mirai Botnet

[s3cret]

Greetz everybody,

When I first go in DDoS industry, I wasn't planning on staying in it long. I made my money, there's lots of eyes looking at IOT now, so it's time to GTFO. However, I know every skid and their mama, it's their wet dream to have something besides qbot.

So today, I have an amazing release for you. With Mirai, I usually pull max 380k bots from telnet alone. However, after the Kreb DDoS, ISPs been slowly shutting down and cleaning up their act. Today, max pull is about 300k bots, and dropping.

So, I am your senpai, and I will treat you real nice, my hf-chan.

And to everyone that thought they were doing anything by hitting my CNC, I had good laughs, this bot uses domain for CNC. It takes 60 seconds for all bots to reconnect, lol

the infamous Internet-of-Things botnet that temporarily disabled a few high-profile administrations, for example, OVH, Dyn, and Krebs on Security via massive distributed denial-of-service (DDoS) attacks using hundreds of thousands of compromised Internet-Of-Things devices like air-quality monitors, personal surveillance cameras and home routers.

At its peak in September 2016, Mirai attacks have surpassed 1 Tbps by OVH—the largest on the public record and had contaminated more than 600,000 IoT gadgets by November 2016.

Before digging further into Mirai's story, let's take a quick look at how Mirai functions, how it propagates, and its offensive capacities.

Mirai's Structure and Activity​

Mirai spread by first entering a quick scanning stage where it proliferates by haphazardly sending TCP SYN probes to pseudo-random IPv4 addresses, on Telnet TCP ports 23 and 2323.

Once Mirai discovers open Telnet ports, it tries to infect the devices by brute forcing the login credentials. Mirai tries to login using a list of ten username and password combinations. These ten combinations are chosen randomly from a pre-configured list 62 credentials which are frequently used as the default for IoT devices.

After successfully logging in, Mirai sends the victim IP and related credentials to a reporting server. Initially, Mirai tries to assess and identify the environment in which it is running. This information is then used to download second stage payloads and device specific malware. For instance, the payload for a ARM based device will be different than a MIPS one.

After successfully infecting a device, Mirai covers its tracks by deleting the downloaded binary and using a pseudo-random alphanumeric string as its process name. As a result, Mirai infections do not persist after system reboots. So as to strengthen itself, the malware also terminates different services which are bound to TCP/22 or TCP/23, including other Mirai variations. At this point, the bot waits for commands from it’s command and control server (C2) while at the same time looking out for other vulnerable devices.
This wide extent of methodologies allow Mirai to perform DDoS techniques such as UDP flooding, HTTP flooding, and all TCP flooding along with application-layer attacks, volumetric attacks, and TCP state-exhaustion attacks.

Download:

GitHub - jgamblin/Mirai-Source-Code: Leaked Mirai Source Code for Research/IoC Development Purposes

Leaked Mirai Source Code for Research/IoC Development Purposes - jgamblin/Mirai-Source-Code

github.com