Eric.freyssinet: 1 revision imported

2015-02-07T14:24:34Z

1 revision imported

← Older revision		Revision as of 14:24, 7 February 2015
(No difference)

Eric.freyssinet: Remplacement du texte — « Eset » par « ESET »

2012-08-19T17:46:50Z

Remplacement du texte — « Eset » par « ESET »

New page

{{Publication
|Image=Festi botnet analysis.png
|Legend=
|Document=
|Licence=
|Video=
|Link=http://blog.eset.com/wp-content/media_files/king-of-spam-festi-botnet-analysis.pdf blog.eset.com (PDF)
|Author=Eugene Rodionov, Aleksandr Matrosov ,
|NomRevue=ESET Threat Blog
|Date=May 11, 2012
|Editor=ESET
|Year=2012
|ISBN=
|Page=
|Abstract=The botnet Win32/Festi has been in business since the autumn of 2009 and is currently one of the most
powerful and active botnets for sending spam and performing DDoS attacks. The bot consists of two
parts: the dropper and the main module, the kernel‐mode driver, which is detected by ESET as
Win32/Rootki.Festi.
In 2009 and early 2010 the bot was
leased out for spam sending but was
then restricted to major spam
partners. According to statistics from
M86 Security Labs, shown on the right,
Win32/Festi is one of the three most
active spam botnets in the world.
In the autumn of 2011 the botnet
migrated its C&C (Command & Control) servers to new domain names. All the previously‐used domains
are still alive and are kept in reserve in case the primary domain/servers don’t respond.
The botnet periodically migrates to new hosting and domain names in order to decrease the rate at
which it is detected using C&C URLs and corresponding IP addresses. There are only C&C domain names
inside the bot’s binary with no IP addresses.
The previous versions of the bot communicated with C&C servers over HTTP (Hypertext Transfer
Protocol) by encrypting POST requests. At the beginning of 2012 an updated version of the bot
employed a new communication protocol which is capable of bypassing IPS and IDS systems operating
at the network layer. In this report we analyze the latest version of the bot which appeared in February,
and is detected by ESET products as Win32/Rootkit.Agent.NVG.
|Botnet=Festi,
|Malware=Festi_(bot),
|CCProtocol=,
|Operation=,
|Keyword=,
}}

King of spam:Festi botnet analysis - Revision history

Eric.freyssinet: 1 revision imported

Eric.freyssinet: Remplacement du texte — « Eset » par « ESET »