Found a sample in the wild .
the sample was
uncrypted as well and its coded in .
NET C# also .
also lets take a look inside ( .NET )
Traced bot back and found the host , hacked it , got his
panel.rar lol so following pictures are just a demo
on my local net ..
// index.php
?php
error_reporting(E_ERROR | E_PARSE);
if (file_exists("phash") == false){
header("Location: register.php");
} else {
$filename = "phash";
$fp = fopen($filename, "r");
$content = fread($fp, filesize($filename));
fclose($fp);
$storedPassHash = $content;
$passHash = $_COOKIE['phash'];
if (md5("randomsalt".$passHash) != $storedPassHash){
header("Location: login.php");
Diferent ddos methods uses HTTP Proxy flood , Wordpres Pingback (xmlrpc) , TCP etc ...
looks like
HyperBeamEngine
a demo of
TCP flood , it requests
botserver/panel
/target.ip
botserver/panel
/target.method
botserver/panel
/target.port
HTTP Flood , http proxys of setting are saved here " botserver/panel/
proxy " thats how the bot reads it
if the target.method is HTTPFLOOD
Wordpress Pingback or how he calls it
PRESS same as at the HTTPFLOD but here is the file savend uder
botserver/panel/
blog thats the file which we add hosts at setting
an
online running botnet i found is here :
hxxp://burimche.net/help/login.php
// all online ip's of bots
hxxp://burimche.net/help/visitors.txt
hxxp://burimche.net/help/target.ip
hxxp://burimche.net/help/target.method
hxxp://burimche.net/help/target.port
// online bots
hxx://burimche.net/help/botlogger.php
Want Sample and Panel ? conntact me at email , for research purposes only !!
