Necurs.P2P - A New Hybrid Peer-to-Peer Botnet

This C&C structure is something referred to as "hybrid P2P" because commands are sent from centralized C&C servers just like in a regular botnet; however, because new C&C server addresses can be pushed to all bots via the peer-to-peer network at any time, the botnet maintains the usability of a traditional botnet, but with the resilience of a peer-to-peer one.

In order to enable P2P communication a random port number is generated and stored into the registry; this port is then bound on both the UDP and TCP protocol allowing P2P communication to work over either, though udp is the most dominant. The bot has over 1000 IP and port combinations stored within the initial config which will be contacted one by one at a rate of one per second until a reply is received, after that the rate is adjusted to one per minute. Strangely before every request a random number from 0 to 4 is chosen: if the number is 0 the bot will attempt to connect to the remote host over TCP, otherwise it will fire off a UDP packet, resulting in a UDP:TCP ratio of around 4:1 (I'm unsure as to what the purpose of this is).

Files are encrypted with RC4 using a key derived with the same function as above, except a randomly generated variables is hashed alongside the data and then stored at the end of the file, making generating file signatures impossible. 

That's all for the analysis, but once I and the guys over at Kryptos Logic have finished gathering data, we should have a much better insight into the botnet, so make sure to keep checking the KryptosLogic Blog for updates.