Sample analysis of a smart device

A sample found on a smart device that was previously received was very difficult to capture because the sample was recorded in the SH4 instruction set.

After the sample is run, some initialization begins,

Main function

First call GetIP, complete the network test in the function, get the local ip,mac, and the routing table, as follows:

Obtain the IP through the function getsockname.

Gets the local routing table by reading the/proc/net/route file.

Get the local Mac through the function ioctl.

You will then attempt to connect to the server through the function initconnection, where if the connection is unsuccessful, you will always try.

This is the remote server address 104.255.65.207 and the port is 42.

Here is a US IP.

Try to log in and discover that FTP can log in.

This PHP implements the control of the sample feedback, such as the following DUP,LOLNOGTFO instruction processing.

The return value from the server is then accepted.

Part of the instruction Ping,pong (see instructions in processcmd) is processed in the main function, where the instructions specific to main are described here.

DUP

When the command is for, the sample exits.

Processcmd

The function processcmd is then called to process commands from the server.

Ping

The ping command returns a packet with Pong through the function sockprintf, if included, by resolving whether the data returned by the server contains a ping.

Getlocalip

When the command is included in the data returned by the server, the sample returns to the local IP.

SCANNER

The command is a command with parameters and contains two parameters off| On, the function can be turned on and off.

When the additional parameter is off, the sample is closed.

When the additional parameter is on, the function Startthelelz is called, which is a large loop (the function is more complex), guessing is a scan of the intranet (combined with a large number of weak passwords resolved).

Commands for DDoS series

The HOLD,JUNK,TCP,UDP implements four different DDoS attacks. As in the hold of DDoS.

Killattack

This directive is used to stop a DDoS attack, which is simply the process of stop DDoS.

Lolnogtfo

Used to stop the sample.

Sample analysis of a smart device