Blue Botnet - HTTP Botnet

Found a sample in the wild .



the sample was uncrypted as well and its coded in .NET C# also .



also lets take a look inside ( .NET )



Traced bot back and found the host , hacked it , got his panel.rar lol so following pictures are just a demo
on my local net ..

// index.php 
?php
error_reporting(E_ERROR | E_PARSE);
if (file_exists("phash") == false){
 header("Location: register.php");
} else {
 $filename = "phash";
 $fp = fopen($filename, "r");
 $content = fread($fp, filesize($filename));
 fclose($fp);
 $storedPassHash = $content;
 $passHash = $_COOKIE['phash'];
 if (md5("randomsalt".$passHash) != $storedPassHash){
  header("Location: login.php");

Diferent ddos methods uses HTTP Proxy flood , Wordpres Pingback (xmlrpc) , TCP etc ...
looks like HyperBeamEngine



a demo of TCP flood , it requests
botserver/panel/target.ip
botserver/panel/target.method
botserver/panel/target.port





HTTP Flood , http proxys of setting are saved here " botserver/panel/proxy " thats how the bot reads it
if the target.method is HTTPFLOOD







Wordpress Pingback or how he calls it PRESS same as at the HTTPFLOD but here is the file savend uder
botserver/panel/blog thats the file which we add hosts at setting



an online running botnet i found is here :

hxxp://burimche.net/help/login.php
// all online ip's of bots
hxxp://burimche.net/help/visitors.txt
hxxp://burimche.net/help/target.ip
hxxp://burimche.net/help/target.method
hxxp://burimche.net/help/target.port
// online bots
hxx://burimche.net/help/botlogger.php

Want Sample and Panel ? conntact me at email , for research purposes only !!