  One of the innovations brought by Mirai and its derived malware is the
adoption of self-contained loaders for infecting IoT devices and recruiting
them in botnets. Functionally decoupled from other botnet components and not
embedded in the payload, loaders cannot be analysed using conventional
approaches that rely on honeypots for capturing samples. Different approaches
are necessary for studying the loaders evolution and defining a genealogy. To
address the insufficient knowledge about loaders' lineage in existing studies,
in this paper, we propose a semantic-aware method to measure, categorize, and
compare different loader servers, with the goal of highlighting their
evolution, independent from the payload evolution. Leveraging behavior-based
metrics, we cluster the discovered loaders and define eight families to
determine the genealogy and draw a homology map. Our study shows that the
source code of Mirai is evolving and spawning new botnets with new
capabilities, both on the client side and the server side. In turn, shedding
light on the infection loaders can help the cybersecurity community to improve
detection and prevention tools.

Cryptography and Security