Backdoor:Linux/Mirai.A

Installation

This threat includes the spreading mechanism which allows it to gain unauthorized access on devices with weak or default username and password.

This threat uses an advance SYN scanner to perform dictionary attack to 'brute-force' its way in using Telnet on port 2323/TCP or 23/TCP.  The dictionary refers to 62 common list of user name and passwords. When successful, it will scan for remote servers listening on port 48101, which then serves the loader.

The malware author refers to this method as "real time loading".  The loader component is a tiny piece of malicious binary code (often 1KB in size) reponsible for download and installation of the backdoor. It may use either WGET or TFTP in this case.

Payload

Hacks infected devices

This threat  enables the remote attacker to take over and control all infected device, thus creating an IoT botnet that can be directed to execute a distributed denial-of-service (DDoS) attack.