Botspy - Efficient Observation of Botnets
With nepenthes and CWSandbox, we have two tools to automatically capture and analyze malware. If we find a botnet, it would be nice to also have an automated way to observe the corresponding botnet. This is where botspy comes into play: this tool is designed to observe botnets by connecting to them, entering the channel used for command & control, and then monitoring what is happening. Currently, the channel can either be IRC or HTTP, but due to the modular architecture, more communication protocols can be added.
Botspy is implemented by Claus Overbeck as part of his thesis and he gave a presentation about the current status today. The thesis is not finished yet, so more features will be integrated and - most important - statistics will be generated.
Botspy is implemented by Claus Overbeck as part of his thesis and he gave a presentation about the current status today. The thesis is not finished yet, so more features will be integrated and - most important - statistics will be generated.
".
