Propagation

The bot scans IP addresses, which are selected pseudo-randomly with certain ranges excluded, asynchronously using TCP SYN packets in order to find target candidates with open default Telnet ports first:

Figure 8: Mirai malware excluding several IP ranges from scanning

Then, malware brute forces access to the found candidate machines using pairs of hardcoded credentials. The successful results are passed to the server to balance the load, and all data is stored in a database. The server then activates a loader module that verifies the system and delivers the bot payload using either the wget or tftp tool, if available; otherwise, it uses a tiny embedded downloader. Malware has several pre-compiled binary payloads for several different architectures (ARM, MIPS, SPARC, SuperH, PowerPC, and m68k). After this, the cycle repeats and the just-deployed bots continue searching for new victims.