Eric.freyssinet: 1 revision imported

2015-02-07T14:23:40Z

1 revision imported

New page

{{Publication
|Image=
|Legend=
|Document=
|Licence=
|Video=
|Link=http://ddos.arbornetworks.com/uploads/2012/03/Crypto-Armageddon-Blog.pdf arbornetworks.com (pdf)
|Author=Jeff Edwards,
|NomRevue=
|Date=March 6th 2012
|Editor=Arbor SERT
|Year=2012
|ISBN=
|Page=
|Abstract=Jeff Edwards, Research Analyst, Arbor Networks ASERT
Armageddon is one of several notable Russian malware families that are designed exclusively for DDoS attacks; it has
been on our radar screens for some time now. Its primary competitors within the market of Russian DDoS vendors are Dirt
Jumper (a.k.a. RussKill), Darkness/Optima (a.k.a. Votwup), and ofcourse BlackEnergy.
We've noticed that the Armageddon code base has undergone some relatively rapid evolution lately, and the purpose of this
blog post is to report on some of the new functionality we have observed. With this latest release, the bot uses some new
crypto protection to hide its features from casual observers; breaking this encryption revealed some interesting goodies...Arbor Networks | 2
This paper is also intended to be the first in an upcoming series of articles that will provide a guided tour of the inner
workings of various crypto systems that are used by contemporary DDoS malware families in order to hide their
communications and sensitive data - and how to go about breaking them.
Breaking Armageddon's Crypto
We use IDA Pro as our primary reversing tool, but since Armageddon is written in Delphi, we supplement IDA with the
excellent Interactive Delphi Reconstructor (IDR) tool. IDR often does a pretty good job at automatically detecting
many/most of the classes, properties, and methods included in the various versions of the Delphi application framework. It
also tends to work well for common third-party libraries such as the Synapse package that is often used by Delphi-based
malware to perform network operations, such as phoning home to command & control (C&C) servers, generating DDoS
flood traffic, etc. One can often minimize the amount of time wasted digging through layer upon layer of Delphi function
calls by simultaneously opening the malware in both IDA and IDR, and using IDR as a reference to identify Delphi
functions, while doing the bulk of the analysis in IDA.
The sample bot that we will analyze in this post is 45,056 bytes in size with MD5 hash of
5ae3451b76c76c20e6fe58289bb8302c. As usual, a great place to start the reversing of a bot is to run a strings
dump on the executable and identify any interesting clues therein. Applying this approach to our Armageddon sample does
not yield much at first glance, except for about 45 strings that appear to be encrypted in some fashion; here are some
examples:
70D997203F8AD33CE175FA6CF7D5396A0739D0E8487BCE4568B40BAC92A1BE
A405ED14624D0D3258D403EC8ABD56B548961379C7
9B7AEB04381B284D43CF45B5
Earlier versions of Armageddon bots stored most of their sensitive strings in plain ASCII; this encryption is a new
development. So it seems we must first reverse this crypto before the inner workings of the bot are revealed.
|Botnet=,
|Malware=Armageddon, Dirt Jumper, Darkness, BlackEnergy,
|CCProtocol=,
|Operation=,
|Keyword=Ddos, Reverse Engineering,
}}

It’s 2012 and Armageddon has arrived - Revision history

Eric.freyssinet: 1 revision imported