NTRG_ElasticBotnetReport_06102015

The CStatBase class captures information about the victim machine including:
1) system version via uname(). This includes the system name and the release info
(from CStatBase::GetSysVersion).
2) the CPU speed via /proc/cpuinfo parsing (from CStatBase::GetCpuSpd)
3) the number of user mode, niced and kernel processes via /proc/stat parsing
(from CStatBase::InitGetCPUUse and CStatBase::GetCPUUse)
4) network statistics via parsing /proc/net/dev (from CStatBase::InitGetNetUse and
CStatBase::GetNetUse)
The CServerIP class encapsulates the information about a group of C2 servers using an STL map. The
CServerIP class appears to only use one hardcoded IP. The IP address and port are encrypted in the
same manner as found in the dropper (though the dropper never actually decrypts the information).
The encoding scheme is a simple increment or decrement of each byte based on the position of
the byte relative to the starting position. Simply put, starting at byte 0, if the position of the byte
being decrypted is even, the byte is decremented by one; otherwise the byte is incremented by one.
For example, if the encrypted string is “:2/024/77-3/:”, the algorithm translates the string into
93.115.86.209.
After initializing the CStatBase and CServerIP objects, the main loop begins when
CManager::StartNetProcess is invoked. CManager is the encapsulating object for the bulk
of the malware’s operation. Given that the object is static and global, it is initialized by calling
CManager::CManager as part of the __libc_csu_init startup function. As part of the initialization
of the CManager object, various additional classes are instantiated and initialized. Notably, the
CThreadAttack class is instantiated 20 times, but left in an idle state; this object will be further
examined later in this report.
CManager::StartNetProcess begins by calling CFake::Initialize. CFake::Initialize looks for a
file called fake.cfg within the same directory as the malware on the victim’s machine. The fake.cfg
file is a text file containing state information in the following structure:
{decimal number}
{IP Address}:{IP Address}
{Port Number}:{Port Number}
{Remarks}
The CFake object, as seen in memory, takes the following form:
struct CFake
{
std::string strSaveFileName;
CSubTask cLastTaskInfo;
CThreadMutex cAccessLock;
}
The CFake object, at its core, revolves around the CSubTask object. The CSubTask object defines a
specific task (attack) that Elknot is to perform. CSubTask, as will be explained later, is heavily used by
CThreadAttack for directing any given operation defined by the C2 server. The CSubTask object, as
seen in memory, takes the following form:
THE ELASTIC BOTNET REPORT
9