Researchers at SRI International updated their Conficker paper. They have provided a very useful analysis of the Conficker malware.
The last variant of Conficker, referred to as Conficker C leaves as little as 15% of the original B code base untouched the main purpose of the Conficker is to provide the authors with a secure binary updating service that effectively allows them instant control of millions of PCs worldwide.
Through the use of these binary encryption methods, Conficker’s authors have taken care to ensure that other groups cannot upload arbitrary binaries to their infected drone population, and these protections cover all Conficker updating services: Internet rendezvous point downloads, buffer overflow re-exploitation, and the latest P2P control protocol.
Conficker authors have devised a sophisticated encryption protocol that is generally robust to direct attack. All three crypto-systems employed by Conficker’s authors (RC4, RSA, and MD-6) also have one underlying commonality and the discovery of MD-6 in Conficker B is indeed highly unusual given Conficker’s own development time line.
Source: [SRI International]