View source for Trojan Nap aka Kelihos/Hlux - Feb. 2013 status update

{{Publication
|Type=Blogpost
|Link=http://www.deependresearch.org/2013/02/trojan-nap-aka-kelihoshlux-feb-2013.html
|Author=Mila Parkour
|NomRevue=DeepEnd Research
|Date=2013-02-10
|Editor=DeepEnd Research
|Year=2013
|Botnet=Nap, Kelihos, Hlux
|Abstract=FireEye posted details about the sleep function found in Kelihos/Hlux (An encounter with Trojan Nap), which is interesting, and indeed is present in some of the samples we saw. The trojan, of course, has many more features, and most of them were documented in previous publications online. This post is a quick update on the state of Kelihos/Hlux botnet, along with  the list of known fast flux domains (1500+) associated with with Kelihos distribution or Command&Control. (current > 2012).  The current and most active name servers are pointing to the ns[1-6].boomsco.com, ns[1-6].larstor.com, and ns[1-6].zempakiv.ru which are also fast flux domains. The double fast flux nature of the botnet makes it very difficult to take down, and sinkholing is a temporary measure. Despite the two large attempts to take it down (Sep.2011 and Mar. 2012), the botnet is definitely on the rise again.
}}