Reversing a Mirai Malware Variant: UPX Unpacking & IoT Command Infrastructure

Executive Summary

This malware is a Mirai-based sample designed to infect IoT devices like routers and cameras. It is initially packed and obfuscated to hide its behavior, but once unpacked, its real functionality becomes clear.

The malware is built to spread aggressively by exploiting known vulnerabilities in different devices. It connects to a command-and-control server (31.220.3.125) and downloads additional malicious files from z.hxhk.cc, allowing it to work across multiple device types.

After infection, it takes full control of the system by disabling firewalls, stopping services, and setting up multiple persistence methods to ensure it keeps running even after a reboot. It also scans networks to find and infect more devices.

In simple terms, this malware acts like a self-spreading botnet agent, turning compromised devices into part of a larger controlled network.

Mirai Sample Metadata

ELF Header

Hxd

There’s a lot of compress data.

Figure: Screenshot 2026-05-01 at 4.26.56 PM.png Click to zoom ↗

Figure: Screenshot 2026-05-01 at 4.27.17 PM.png Click to zoom ↗

There’s UPX also.

Figure: Screenshot 2026-05-01 at 4.28.10 PM.png Click to zoom ↗

DIE

Figure: Screenshot 2026-05-01 at 4.29.40 PM.png Click to zoom ↗

Entropy:

It’s heavily packed.

Figure: Screenshot 2026-05-01 at 4.30.17 PM.png Click to zoom ↗

Unpacking

The binary was successfully unpacked using the UPX utility. Although the packer reported minor header inconsistencies (bad b_info), a valid ELF executable was recovered.

Figure: Screenshot 2026-05-01 at 4.32.46 PM.png Click to zoom ↗

Post-Unpacking Observations

Following the decompression, the binary size increased by approximately 3.1x. Preliminary inspection of the unpacked file (out) confirms the presence of the following indicators:

Unpacked Sample Analysis

DIE

Figure: Screenshot 2026-05-01 at 4.37.26 PM.png Click to zoom ↗

Now the entropy is we see is not packed.

Figure: Screenshot 2026-05-01 at 4.38.34 PM.png Click to zoom ↗

Hxd

Now we’ll see that those compressed high entropy data is now decompressed.

Figure: Screenshot 2026-05-01 at 4.40.24 PM.png Click to zoom ↗

We can see bash commands, wget commands stuff like this.

Figure: Screenshot 2026-05-01 at 4.43.05 PM.png Click to zoom ↗

Unpacked String Analysis

After successful decompression of the UPX layer, a static analysis of the recovered strings was performed. The results reveal a highly aggressive Mirai variant targeting diverse IoT architectures.

Remote Code Execution (RCE) Payloads

Figure: Screenshot 2026-05-01 at 4.52.41 PM.png Click to zoom ↗

Network Infrastructure & C2

The following network indicators were identified within the binary:

Figure: Screenshot 2026-05-01 at 4.53.20 PM.png Click to zoom ↗

Figure: Screenshot 2026-05-01 at 4.59.53 PM.png Click to zoom ↗

Figure: Screenshot 2026-05-01 at 5.00.21 PM.png Click to zoom ↗

Persistence & System Sabotage ([dars.sh](http://dars.sh))

The binary contains an embedded shell script (/etc/dars.sh) designed to neutralize the host device's security and ensure persistence. Key actions include:

Obfuscated Configuration Table

A block of XOR-obfuscated uppercase strings was identified (e.g., TKXZT, RCQQUMPF). These likely contain the bot's internal configuration, including default login credentials and internal command aliases, which are decrypted at runtime using a single-byte XOR key (common in Mirai forks).

Exploitation and Lateral Movement

The unpacked binary contains hardcoded exploit strings designed to weaponized known vulnerabilities in IoT firmware. These strings demonstrate a "worm-like" capability to spread across a network by injecting commands into vulnerable web interfaces.

Targeted Exploit: Huawei Home Gateway (CVE-2017-17215)

The malware targets the TR-064 UPnP service on Huawei HG532 routers. It uses a specific SOAP request to trigger a Remote Code Execution (RCE) vulnerability.

Targeted Exploit: JAWS Web Server

The sample also attempts to infect DVRs and IP cameras running the JAWS web server.

Figure: Screenshot 2026-05-01 at 5.03.58 PM.png Click to zoom ↗

IDA Analysis

(main @ 0x1ADD4)

main()
  ├─ flush_iptables_and_disable_firewall()  [0x1AD20]
  │    └─ iptables -F/-X all chains, stop firewalld, ufw disable
  ├─ signal(SIGCHLD, SIG_IGN)
  ├─ signal(SIGTRAP, signal_handler_reinit_cnc)
  ├─ table_init_decode_strings()            [0x21E90]  ← XOR-0x22 decode
  ├─ resolve_cnc_address()                  [0x1A908]  ← DNS + fallback
  ├─ scanner_main_telnet_worker()           [0x16654]  ← 424 BB scanner
  ├─ table_unlock_decode_constants()        [0xCC70]   ← 2nd decode pass
  ├─ setup_raw_cnc_socket()                 [0x1A9A8]  ← raw socket/ioctl
  └─ register_all_exploit_modules()         [0x1AA94]
       └─ write_dropper_scripts_and_persist() [0x1AAF8]

Figure: Screenshot 2026-05-01 at 5.44.30 PM.png Click to zoom ↗

Direct System Call Analysis

The use of SVC instructions is a classic anti-analysis and portability technique. By bypassing libc, the malware becomes harder to trace using standard user-land hooks.

The malware uses the ARM EABI syscall convention, where the syscall number is encoded within the SVC instruction or loaded into R7.

Logic Flow: Error Handling & Persistence

The subroutines sub_28534 and sub_2855C implement a robust error-checking mechanism common in malicious binaries:

Technical Significance

By utilizing direct SVC instructions, the botnet achieves two goals:

Figure: Screenshot 2026-05-01 at 5.25.26 PM.png Click to zoom ↗

Security Infrastructure Sabotage

The function sub_1AD20 is a dedicated routine designed to completely disable the host's network defenses. It executes a sequence of system commands via a wrapper function (sub_27728), which likely invokes system() or execve().

Firewall Deactivation Table

The malware systematically flushes all rules and deletes all custom chains within the Linux iptables framework, effectively leaving the system wide open.

All the bash commands.

Figure: Screenshot 2026-05-01 at 5.32.05 PM.png Click to zoom ↗

Service-Level Neutralization

Beyond modifying rules, the malware attempts to shut down the firewall services entirely to prevent them from restarting or being reconfigured.

Technical Impact

Process Stabilization & Shell Execution

The code sequence leading up to sub_27AA0 reveals how the malware prepares the environment for its background operations and ensures it remains active on the host.

File Descriptor Redirection (Standard I/O)

The repeated calls to sub_269BC (likely a wrapper for dup2) suggest the malware is redirecting its standard streams. This is a common step in daemonization.

Execution of Persistent Payloads

The malware utilizes a wrapper function (sub_27AA0, likely a variant of execl or system) to execute a new shell process.

Figure: Screenshot 2026-05-01 at 5.35.37 PM.png Click to zoom ↗

Post-Execution Termination

Immediately following the shell execution, the malware calls sub_28534 with R0 = #0x7F (127).

Figure: Screenshot 2026-05-01 at 5.41.09 PM.png Click to zoom ↗

Pseudo Code.

// Dropper/persistence writer: creates .daemonx86 watchdog script, copies self to .configs, sets up systemd service, cron job, rc.local
int __fastcall write_dropper_scripts_and_persist(int a1)
{
  int result; // r0
  BOOL v2; // r6
  int v3; // r0
  int v4; // r8
  int v5; // r4
  int v6; // r0
  int v7; // r4
  int v8; // r4
  int v9; // r4
  int v10; // r0
  _BYTE v11[2048]; // [sp+0h] [bp-C80h] BYREF
  char v12[1024]; // [sp+800h] [bp-480h] BYREF
  _BYTE v13[128]; // [sp+C00h] [bp-80h] BYREF

  result = sub_23D10(a1);
  v2 = result > 0 || result == -1;
  dword_39580 = result;
  if ( !v2 )
  {
    v3 = sub_26310(dword_3B71C);
    v4 = sub_26AE0(v3 + 145);
    sub_244FC(
      v4,
      "#!/bin/bash\n"
      "while true; do\n"
      "    if ! pgrep -x '.configs' > /dev/null; then\n"
      "        pkill sys64. \n"
      "        ./.configs %s &\n"
      "    fi\n"
      "    sleep 1\n"
      "done\n",
      (const char *)dword_3B71C);
    v5 = sub_24448(".daemonx86", "w");
    v6 = sub_26310(v4);
    sub_25D18(v4, 1, v6, v5);
    sub_242C8(v5);
    system_cmd_exec("chmod +x .daemonx86");
    v7 = sub_23EA8("/proc/self/exe", v12, 1023);
    if ( v7 == -1 )
      sub_24454("readlink");
    v12[v7] = 0;
    while ( 1 )
    {
      if ( !sub_24448(".configs", "r") )
      {
        sub_244CC(v11, 2048, "cp '%s' '.configs'", v12);
        system_cmd_exec(v11);
        system_cmd_exec("chmod 777 .configs");
      }
      if ( sub_2646C(v12, ".configs") && !sub_24448(".daemonx86", "r") )
      {
        v9 = sub_24448(".daemonx86", "w");
        v10 = sub_26310(v4);
        sub_25D18(v4, 1, v10, v9);
        sub_242C8(v9);
        system_cmd_exec("chmod +x .daemonx86");
      }
      v8 = sub_246E0("pgrep -x .daemonx86", "r");
      if ( sub_25C84(v13, 128, v8) )
      {
        sub_245E0(v8);
      }
      else
      {
        sub_245E0(v8);
        sub_244CC(v11, 2048, "./.daemonx86 &");
        system_cmd_exec(v11);
        sub_27B34(1);
      }
      sub_27B34(1);
      sub_27B34(2);
    }
  }
  return result;
}

Persistence (writedropperscriptsandpersist @ 0x1AAF8)

Four overlapping persistence mechanisms:

a) Dropper files

b) rc.local — appends echo '%s &' >> /etc/rc.local

c) systemd service — writes /etc/systemd/system/<name>.service, runs systemctl daemon-reload && systemctl enable

d) cron job — writes /etc/cron.d/systam → * * * * * root /etc/systam.sh &

IoT Exploit Arsenal (registerallexploitmodules chain)

All exploits download payloads from z.hxhk.cc:

Multi-architecture payloads: .mips, .mpsl, .arm7, .x86, .adb — targeting the full IoT spectrum.

IOCs