Darkshell DDOS Botnet Evolves With Variants

Darkshell is a distributed denial of service (DDoS) botnet targeting Chinese websites. It was found in 2011 and was www.mcafee.com/activate  first analyzed by Arbor Networks. McAfee Labs recently analyzed a few new www.mcafee.com/activate download samples that turned www.mcafee/activate out to be variants of Darkshell, and we found extensive variations www.mcafee.com/activate product key in network traffic and control commands mcafee.com/activate product key.

The Darkshell bot follows a fairly www.mcafee.com/activate product key standard installation process by copying itself into the System32 directory with a name that appears to be www.mcafee.com/activate legitimate, for example, C:\WINDOWS\system32\WinHe803.exe. It then sends the  mcafee.com/activate product key system information of the infected machine to its control server in encrypted format. Once the control server receives the information, it responds www.mcafee.com/activate download with the victim’s www.mcafee/activate address and the type of DDoS attack to perform.

The binaries we analyzed were compiled in a way that it makes them hard to reverse engineer (and ease our analysis). Each binary www.mcafee.com/activate contained  www.mcafee.com/activate download a lot of junk code and made multiple calls between the www.mcafee.com/activate product key junk codes to complete a single task www.mcafee/activate. We also found that the binaries mcafee.com/activate product key used antidebugging and antidisassembly techniques to evade disassembly and reversing. The code was written in C++.

Let’s dig into some detailed analysis of the new variant of Darkshell. The binary executed fake code along with a debugger detection check www.mcafee.com/activate, and exited www.mcafee/activate the process while debugging. The binary accessed heap flags from the Process Environment Block (PEB) structure www.mcafee.com/activate product key to detect our debugger www.mcafee.com/activate download. (Heap flags are set to “0x50000062” when a process is being debugged.) The following figure shows mcafee.com/activate product key the actual code from the botnet binary

First, the binary decrypted 1917 (hex) bytes of the code with the preceding XOR key, starting at the address 0x00401000. Next, it decrypted all the strings using the same XOR key. Following that, the bot built its import address table using the “LoadLibrary()” and “GetProcAddress()” functions. We found it www.mcafee.com/activate interesting www.mcafee/activate that the bot mcafee.com/activate product key did not call LoadLibrary() and GetProcAddress() in the usual way. In this sample, it first pushed www.mcafee.com/activate product key the www.mcafee.com/activate download address of the LoadLibrary() function on the stack and then returned to it, as shown in the next image: