View source for It’s 2012 and Armageddon has arrived

{{Publication
|Image=
|Legend=
|Document=
|Licence=
|Video=
|Link=http://ddos.arbornetworks.com/uploads/2012/03/Crypto-Armageddon-Blog.pdf arbornetworks.com (pdf)
|Author=Jeff Edwards, 
|NomRevue=
|Date=March 6th 2012
|Editor=Arbor SERT
|Year=2012
|ISBN=
|Page=
|Abstract=Jeff Edwards, Research Analyst, Arbor Networks ASERT
Armageddon is one of several notable Russian malware families that are designed exclusively for DDoS attacks; it has 
been on our radar screens for some time now.  Its primary competitors within the market of Russian DDoS vendors are Dirt 
Jumper (a.k.a. RussKill), Darkness/Optima (a.k.a. Votwup), and ofcourse BlackEnergy.
We've noticed that the Armageddon code base has undergone some relatively rapid evolution lately, and the purpose of this 
blog post is to report on some of the new functionality we have observed.  With this latest release, the bot uses some new 
crypto protection to hide its features from casual observers; breaking this encryption revealed some interesting goodies...Arbor Networks  |  2
This paper is also intended to be the first in an upcoming series of articles that will provide a guided tour of the inner 
workings of various crypto systems that are used by contemporary DDoS malware families in order to hide their 
communications and sensitive data - and how to go about breaking them.
Breaking Armageddon's Crypto
We use IDA Pro as our primary reversing tool, but since Armageddon is written in Delphi, we supplement IDA with the 
excellent Interactive Delphi Reconstructor (IDR) tool.  IDR often does a pretty good job at automatically detecting 
many/most of the classes, properties, and methods included in the various versions of the Delphi application framework.  It 
also tends to work well for common third-party libraries such as the Synapse package that is often used by Delphi-based 
malware to perform network operations, such as phoning home to command & control (C&C) servers, generating DDoS 
flood traffic, etc.  One can often minimize the amount of time wasted digging through layer upon layer of Delphi function 
calls by simultaneously opening the malware in both IDA and IDR, and using IDR as a reference to identify Delphi 
functions, while doing the bulk of the analysis in IDA.
The sample bot that we will analyze in this post is 45,056 bytes in size with MD5 hash of 
5ae3451b76c76c20e6fe58289bb8302c.  As usual, a great place to start the reversing of a bot is to run a strings
dump on the executable and identify any interesting clues therein.  Applying this approach to our Armageddon sample does 
not yield much at first glance, except for about 45 strings that appear to be encrypted in some fashion; here are some 
examples:
70D997203F8AD33CE175FA6CF7D5396A0739D0E8487BCE4568B40BAC92A1BE
A405ED14624D0D3258D403EC8ABD56B548961379C7
9B7AEB04381B284D43CF45B5
Earlier versions of Armageddon bots stored most of their sensitive strings in plain ASCII; this encryption is a new 
development.  So it seems we must first reverse this crypto before the inner workings of the bot are revealed.
|Botnet=, 
|Malware=Armageddon, Dirt Jumper, Darkness, BlackEnergy, 
|CCProtocol=, 
|Operation=, 
|Keyword=Ddos, Reverse Engineering, 
}}