Festi botnet analysis and investigation
53
Festi Botnet Analysis & Investigation Aleksandr Matrosov Eugene Rodionov
-
Upload
alexander-matrosov -
Category
Technology
-
view
1.140 -
download
0
description
The botnet Festi has been in business since the autumn of 2009 and is currently one of the most powerful and active botnets for sending spam and performing DDoS attacks. Festi is an interesting and untypical malware family implementing rootkit functionality with strong protection against reverse engineering and forensic analysis. It is capable of bypassing sandboxes and automated trackers using some advanced techniques such as inserting timestamps in its communication protocol, detecting virtual machines, and subverting personal firewalls and HIPS systems. The bot consists of two parts: the dropper, and the main module, the kernel‐mode driver, which is detected by ESET as Win32/Rootkit.Festi. The malware's kernel-mode driver implements backdoor functionality and is capable of: - Updating configuration data from the C&C (command and control server); - Downloading additional dedicated plugins. In our presentation we will concentrate on the latest Festi botnet update from June 2012 and offer comprehensive information gleaned from our investigations, furnishing details on developers of the botnet and reverse engineering of the bot’s main components – the kernel-mode driver and the plugins (DDoS, Spam). The presentation starts with a description of our investigation and an account of how the Festi botnet evolved over time. We will present a binary analysis kernel-mode driver and downloaded plugins – volatile kernel-mode modules which aren’t saved on any storage device in the system, but in memory, making forensic analysis of the malware significantly more difficult. The presentation also covers such aspects of Festi as its ability to bypass personal firewalls and HIPS systems that may be installed on the infected machine. We will give details of the Festi network communication protocol architecture, based on using the TCP/IP stack implementation in the Microsoft Windows Operating System to communicate with C&C servers, send spam and perform DDoS attacks. And finally, we will describe several self-protective features and techniques of the botnet communication protocol used to bypass sandboxes and trackers.
Transcript of Festi botnet analysis and investigation
Festi Botnet Analysis & Investigation
Aleksandr Matrosov
Eugene Rodionov
Outline of The Presentation
Investigation The purpose of the botnet
C&C migration
Who is behind the botnet?
Analysis Implementation details
The bot Architecture
components, interfaces, plugins, etc.
Self-defense
The botnet’s activities: Spam, DDoS, Proxy.
Festi: Investigation
Festi: Statistics
Festi: C&C migration
Autumn 2011
vilturt.ru pyatochek.ru valdispit.ru
Beginning 2012
muduck.ru (173.212.248.51) moduck.ru (173.212.248.51) reghostin.ru (178.162.179.47) hostikareg.ru (178.162.179.47)
Autumn 2012
suduck.ru (37.59.50.89) 133import.ru (178.162.179.70) 02school33.ru (178.162.179.70)
C&C migration
Festi: C&C Domain Names
There are two domain names in .config section:
primary C&C server
reserved C&C server
If neither of these are available Festi employs DGA:
DGA takes as input current day/month/year and bot version_info
Date Festi_v1 Festi_v2
07/11/2012 fzcbihskf.com hjbfherjhff.com
08/11/2012 pzcaihszf.com jjbjherchff.com
09/11/2012 dzcxifsff.com xjbnhcrwhff.com
10/11/2012 azcgnfsmf.com ljbnqcrnhff.com
11/11/2012 bzcfnfsif.com fjblqcrmhff.com
Festi: C&C panel (2010)
Who is behind the Festi botnet?
http://krebsonsecurity.com/2012/06/who-is-the-festi-botmaster/
Festi: Analysis
Simple dropper used by third party PPI service
PPI service
Load PPI dropper
Run Festi dropper
Main Festi Functionality store in kernel mode
Win32/FestiDropper
Win32/Festikernel-mode
driver
Win32/FestiPlugin 1
Win32/FestiPlugin 2
Win32/FestiPlugin N...
Install kernel-mode driver
Download plugins
user-mode
kernel-mode
Main Festi Functionality store in kernel mode
Win32/FestiDropper
Win32/Festikernel-mode
driver
Win32/FestiPlugin 1
Win32/FestiPlugin 2
Win32/FestiPlugin N...
Install kernel-mode driver
Download plugins
user-mode
kernel-mode
Festi: Configuration information
The bot’s configuration information is hardcoded into
the driver’s binary:
This section contains encrypted information:
URLs of C&C servers
Key to encrypt data transmitted between the bot and C&C
Bot version information and etc
Festi: Configuration information
The bot’s configuration information is hardcoded into
the driver’s binary:
This section contains encrypted information:
URLs of C&C servers
Key to encrypt data transmitted between the bot and C&C
Bot version information and etc
Festi: Configuration information
The bot’s configuration information is hardcoded into
the driver’s binary:
This section contains encrypted information:
URLs of C&C servers
Key to encrypt data transmitted between the bot and C&C
Bot version information and etc
Festi: Entry Point Call Graph
Festi: Architecture
Win32/FestiC&C Protocol
Parser
Win32/FestiNetwork Socket
Win32/FestiPlugin Manager
Win32/FestiMemory Manager
Festi: Self-Defense
Festi: Self-Defense Features
The bot implements rootkit functionality:
hides its kernel-mode driver
hides its kernel-mode driver registry key
conceals its network communication
The bot protects its kernel-mode driver and corresponding
registry entry from removal
The bot detects VMWare virtual environment and debuggers
Festi: Protecting Kernel-Mode Driver
Hooking \Systemroot
Monitoring IRP_MJ_DIRECTORY_CONTROL request.
\SystemrootAttached device #1
Malicious device
...
IRP ...hook forward dispatch
File systemdriver
Filter driver #1
Festi driver
Festi: Protecting Kernel-Mode Driver
Hooking \Systemroot
Monitoring IRP_MJ_DIRECTORY_CONTROL request.
\SystemrootAttached device #1
Malicious device
...
IRP ...hook forward dispatch
File systemdriver
Filter driver #1
Festi driver
Festi: Protecting Kernel-Mode Driver
Hooking \Systemroot
Monitoring IRP_MJ_DIRECTORY_CONTROL request.
\SystemrootAttached device #1
Malicious device
...
IRP ...hook forward dispatch
File systemdriver
Filter driver #1
Festi driver
Festi: Protecting Registry
Splicing ZwEnumerateKey system routine
Registering for receiving Shutdown notifications to restore the
registry.
Festi: Anti-Debugging & VM
Detecting & counteracting system debuggers:
KdDebuggerEnabled
overwriting debugging registers dr0-dr3
Detecting WinPcap:
looking for driver npf.sys (network packet filter)
Detecting VMWare virtual environment:
using documented feature “get version”
Festi: Anti-Debugging & VM
Detecting & counteracting system debuggers:
KdDebuggerEnabled
overwriting debugging registers dr0-dr3
Detecting WinPcap:
looking for driver npf.sys (network packet filter)
Detecting VMWare virtual environment:
using documented feature “get version”
Festi: Anti-Debugging & VM
Detecting & counteracting system debuggers:
KdDebuggerEnabled
overwriting debugging registers dr0-dr3
Detecting WinPcap:
looking for driver npf.sys (network packet filter)
Detecting VMWare virtual environment:
using documented feature “get version”
Festi: Anti-Debugging & VM
Detecting & counteracting system debuggers:
KdDebuggerEnabled
overwriting debugging registers dr0-dr3
Detecting WinPcap:
looking for driver npf.sys (network packet filter)
Detecting VMWare virtual environment:
using documented feature “get version”
Festi: Network Communication
Festi: Network Interface Architecture
Festi relies on custom implementation of network sockets in
kernel mode:
provides encrypted tunnel with C&C servers
bypasses personal firewalls and HIPS systems
provides unified network interface for the plugins
Bypassing personal firewalls & HIPS:
Employs custom implementation of ZwCreateFile system routine to
access \Device\Tcp and \Device\Udp devices
bypasses device filters in tcpip.sys driver stack
Festi: Custom Implementation of ZwCreateFile
Execute ObCreateObject to create file object
Initialize security attributes of created file object
Execute ObInsertObject to insert created file object into FILE_OBJECT
type list
Create IRP request with MajorFunction code set to
IRP_MJ_CREATE
Send created IRP request directly to tcpip.sys driver
Festi: Bypassing Filters in Tcpip.sys driver stack
\Device\Tcp or
\Device\Udp
Attached device #1
Attached device #N
...
IRP
...
forward
forward
dispatchTcpip.sys
driver
Filter driver #1
Filter driver #N
\Device\Tcp or
\Device\Udp
Attached device #1
Attached device #N
...
IRP
dispatch
Tcpip.sys driver
Filter driver #1
Filter driver #N
original Festi
Festi: C&C Domain Names
There are two domain names in .config section:
primary C&C server
reserved C&C server
If neither of these are available Festi employs DGA:
DGA takes as input current day/month/year and bot version_info
Date Festi_v1 Festi_v2
07/11/2012 fzcbihskf.com hjbfherjhff.com
08/11/2012 pzcaihszf.com jjbjherchff.com
09/11/2012 dzcxifsff.com xjbnhcrwhff.com
10/11/2012 azcgnfsmf.com ljbnqcrnhff.com
11/11/2012 bzcfnfsif.com fjblqcrmhff.com
Festi: C&C Domain Names
There are two domain names in .config section:
primary C&C server
reserved C&C server
If neither of these are available Festi employs DGA:
DGA takes as input current day/month/year and bot version_info
Date Festi_v1 Festi_v2
07/11/2012 fzcbihskf.com hjbfherjhff.com
08/11/2012 pzcaihszf.com jjbjherchff.com
09/11/2012 dzcxifsff.com xjbnhcrwhff.com
10/11/2012 azcgnfsmf.com ljbnqcrnhff.com
11/11/2012 bzcfnfsif.com fjblqcrmhff.com
Festi: Communication Protocol Work Phase
The communication protocol with C&C consists of 2 stages:
initialization – resolving C&C domain name
work phase – downloading plugins & tasks
Initialization stage:
the bot manually resolves C&C domain name using Google DNS
servers: 8.8.8.8 and 8.8.4.4
Festi: Communication Protocol
The message to C&C consists of:
message header
plugin specific data
Message header:
the bot version
presence of debugger
Presence of VMWare
System information
Plugin specific data:
tag – 16 bit integer
value – word, dword, null-
terminated string, etc.
Festi: Plugin Interface
Festi: Plugins
Festi plugins are volatile modules in kernel-mode address space:
downloaded each time the bot is activated
never stored on the hard drive
The plugins are capable of:
sending spam – BotSpam.dll
performing DDoS attacks – BotDoS.dll
providing proxy service – BotSocks.dll
Festi: Plugin Interface
Plugin1Plugin 1
struct PLUGIN_INTERFACE
Plugin 1
struct PLUGIN_INTERFACE
Plugin2
Plugin3
PluginN
Plugin 2
struct PLUGIN_INTERFACE
Plugin 3
struct PLUGIN_INTERFACE
Plugin N
struct PLUGIN_INTERFACE
...
Array of pointers to plugins
Festi: Loading of Plugins
Decompress plugin
Map plugin image into system address space
Initialize IAT and apply relocations to mapped image
Get exported routines: CreateModule & DeleteModule
Unmap plugin image Get plugin ID & version info
Register plugin by ID
Execute CreateModule
routine
Festi: Plugin Activities
Festi: DDoS Plugin (BotDos.dll)
Supports four types of DDoS attacks:
TCP flood
UDP flood
DNS flood
HTTP flood
Festi: SOCKS Plugin (BotSocks.dll)
Support two types of proxy service:
SOCKS over TCP
SOCKS over UDP
Festi: Spam Plugin
Festi: Spam Plugin (BotSpam.dll)
Festi: Spam Plugin (BotSpam.dll)
Festi: Spam Plugin (BotSpam.dll)
Festi: Obtaining Spam Information
Festi bot
spam-templates
email-list
smpt-list
sender-parameters
Festi C&C
initiate encrypted connection
update-list
1
2
3
start spam send 4
5
Festi: Obtaining Spam Information
Festi bot
spam-templates
email-list
smpt-list
sender-parameters
Festi C&C
initiate encrypted connection
update-list
1
2
3
start spam send 4
5
Festi: Obtaining Spam Information
Festi bot
spam-templates
email-list
smpt-list
sender-parameters
Festi C&C
initiate encrypted connection
update-list
1
2
3
start spam send 4
5
Conclusion
Festi is one of the most powerful botnets for sending spam and
performing DDoS attacks
Design principles and implementation features of the bot:
allow it to counteract security software
harden tracking of the botnet
make it relatively easy to derive the bot implementations for other
platforms
Thank you for your attention!
Aleksandr Matrosov [email protected] @matrosov
Eugene Rodionov [email protected] @vxradius
