IRC Botnet Reverse Engineering Part 3 - How To Sinkhole A Botnet

This is the final part or our in-depth malware reverse engineering series analyzing an IRC worm from 2010. In this part we perform a final high level analysis of the malware then then use our analysis to build a sinkhole for the botnet!

-----
OALABS DISCORD
  / discord  

OALABS PATREON
  / oalabs  

OALABS TIP JAR
https://ko-fi.com/oalabs

OALABS GITHUB
https://github.com/OALabs

UNPACME - AUTOMATED MALWARE UNPACKING
https://www.unpac.me/#/

-----
Automated Malware Unpacking
https://www.unpac.me/

IRC Botnet Reverse Engineering Part 1
   • IRC Botnet Reverse Engineering Part 1 - Pr...  

IRC Botnet Reverse Engineering Part 2
   • IRC Botnet Reverse Engineering Part 2 - An...  

Unpacked binary (malshare)
https://malshare.com/sample.php?actio...

SHA256 hash:
4eb33ce768def8f7db79ef935aabf1c712f78974237e96889e1be3ced0d7e619

MalwareAnalysisForHedgehogs - Network Worm Basics
   • Malware Theory - Network Worm Basics  

ShadowServer Foundation
https://www.shadowserver.org/

Fakenet-NG
https://github.com/fireeye/flare-fake...

Feedback, questions, and suggestions are always welcome : )

Sergei   / herrcore  
Sean   / seanmw  

As always check out our tools, tutorials, and more content over at https://www.openanalysis.net

#Botnet #MalwareAnalysis #Sinkhole