The original Mirai doesn't survive the reboot. Instead, malware kills software associated with telnet, ssh, and http ports in order to prevent other malware entering the same way, as well as to block legitimate remote administration activity. By doing this, it complicates the remediation procedure. It also tries to kill rival bots such as Qbot and Wifatch if found on the same device.
Apart from this, the malware hides its process name using the prctl system call with the PR_SET_NAME argument and uses chroot to change the root directory and avoid detection by this artefact. Both hardcoded credentials and the actual C&C address are encrypted, so they won't appear in plain text among the strings that were used.
