white-papers-avar-2012-festi-botnet-analysis-investigation.pdf

**Executive summary:** This technical analysis of the Win32/Festi botnet (Matrosov & Rodionov) details a kernel-mode rootkit-based botnet used extensively for spam distribution and targeted DDoS attacks, describing its dropper/driver/plugin architecture, C&C protocol and domain/IP migrations, and advanced evasion techniques (kernel-mode TCP/UDP use to bypass HIPS/firewalls, VM detection, anti-debugging, in-memory plugins).