Cimbot - A technical analysis

From Botnets.fr
Jump to navigation Jump to search

(Publication) Link to the old Wiki page : [1] / Google search: [2]

Cimbot - A technical analysis
Botnet Cimbot
Malware
Botnet/malware group
Exploit kits
Services
Feature
Distribution vector
Target
Origin
Campaign
Operation/Working group
Vulnerability
CCProtocol
Date 2009 / 2009-03-16
Editor/Conference FireEye
Link https://www.fireeye.com/blog/threat-research/2009/03/cimbot-a-technical-analysis.html (Archive copy)
Author Julia Wolf
Type Blogpost

Abstract

I was recently sent a .pcap file of a bot's C&C communications. Every 182 seconds, the bot would download a GIF file from vazasaki-ji.info (91.211.65.180 as of Mar 11, 2009). These GIF files however are not well-formed — that is to say, it's a GIF89a header, followed by a lot of random gibberish.

Bibtex

 @misc{Wolf2009BFR2014,
   editor = {FireEye},
   author = {Julia Wolf},
   title = {Cimbot - A technical analysis},
   date = {16},
   month = Mar,
   year = {2009},
   howpublished = {\url{https://www.fireeye.com/blog/threat-research/2009/03/cimbot-a-technical-analysis.html}},
 }