Case study of the Miner botnet

Jump to navigation Jump to search

(Publication) Google search: [1]

Case study of the Miner botnet
Botnet/malware group
Exploit kits
Distribution vector
Operation/Working group
Date 2012 / 2012-06-05
Editor/Conference 4th International Conference on Cyber Con ict
Link 7 PlohmannGerhards-Padilla ACaseStudyOnTheMinerBotnet.pdf (Archive copy)
Author Daniel Plohmann, Elmar Gerhards-Padilla
Type Conference paper or presentation


Malware and botnets are one of the most serious threats to today’s Internet security.

In this paper, we characterise the so-called “Miner Botnet”. It received major media attention after massive distributed denial of service attacks against a wide range of German and Russian websites, mainly during August and September 2011. We use our insights on this botnet to outline current botnet-related money-making concepts and to show that multiple activities of this botnet are actually centred on the virtual anonymised currency Bitcoin, thus justifying the name. Furthermore, we provide a binary-level analysis of the malware’s design and components to illustrate the modularity of the previously mentioned concepts. We give an overview of the structure of the command-and-control protocol as well as of the botnet’s architecture. Both centralised as well as distributed infrastructure aspects realised through peer-to-peer are present to run the botnet, the latter for increasing its resiliency. Finally, we provide the results of our ongoing tracking efforts that started in September 2011, focusing on the development of the botnet’s size and geographic distribution. In addition we point out the challenge that is generally connected with size measurements of botnets due to the reachability of individual nodes and the persistence of IP addresses over time.


 @misc{Lua error: Cannot create process: proc_open(/dev/null): failed to open stream: Operation not permitted2012BFR4665,
   editor = {4th International Conference on Cyber Con􀃀 ict},
   author = {Daniel Plohmann, Elmar Gerhards-Padilla},
   title = {Case study of the Miner botnet},
   date = {05},
   month = Jun,
   year = {2012},
   howpublished = {\url{}},