Detecting A Botnet By Reverse Engineering
Abstract— Botnet malware is a malicious program. Botnet that infects computers, called bots, will be controlled by a botmaster to do various things such as: spamming, phishing, keylogging Distributed Denial of Service (DDoS) and other activities that are generally profitable to the owner of the bot...
| Main Authors: | , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Universitas Gadjah Mada
2013-06-01
|
| Series: | IJCCS (Indonesian Journal of Computing and Cybernetics Systems) |
| Online Access: | https://jurnal.ugm.ac.id/ijccs/article/view/2008 |
| _version_ | 1818293282885599232 |
|---|---|
| author | Oesman Hendra Kelana Khabib Mustofa |
| author_facet | Oesman Hendra Kelana Khabib Mustofa |
| author_sort | Oesman Hendra Kelana |
| collection | DOAJ |
| description | Abstract— Botnet malware is a malicious program. Botnet that infects computers, called bots, will be controlled by a botmaster to do various things such as: spamming, phishing, keylogging Distributed Denial of Service (DDoS) and other activities that are generally profitable to the owner of the bot (botmaster) or those who use botnet services. The problem is that many computers have been controlled by botnets without the knowledge of the computer owner. There are many ways to examine botnets, for example by studying the traffic from the botnet network, studying how botnets communicate to each, studying how each robot receives orders to do something, and so forth. Of the many methods, the most frequently and commonly used is the reverse engineering, where researchers study how a botnet works by botnet debugging.
In this study the author tries to understand or research botnets by taking a type of botnet, namely Agobot, using reverse engineering. One of the result of the research is that malware program files in general and in particular botnet has a technique to obscure the way that research using reverse engineering.
Another result also shows that the botnet Agobot runs on computers by using the Windows service, and by changing the Windows registry so that every time the computer starts, Agobot always actively works in the computer memory.
Keywords— Malware, Bot, Botnet, Botmaster, Agobot, Spam, Distributed Denial of Services, Identity Theft, Computer Security, Reverse Engineering, Debug, Windows Service, the Registry. |
| first_indexed | 2024-12-13T03:13:23Z |
| format | Article |
| id | doaj.art-ffc07cd95ce3444bb51dd704602e52e1 |
| institution | Directory Open Access Journal |
| issn | 1978-1520 2460-7258 |
| language | English |
| last_indexed | 2024-12-13T03:13:23Z |
| publishDate | 2013-06-01 |
| publisher | Universitas Gadjah Mada |
| record_format | Article |
| series | IJCCS (Indonesian Journal of Computing and Cybernetics Systems) |
| spelling | doaj.art-ffc07cd95ce3444bb51dd704602e52e12022-12-22T00:01:33ZengUniversitas Gadjah MadaIJCCS (Indonesian Journal of Computing and Cybernetics Systems)1978-15202460-72582013-06-015110.22146/ijccs.20081856Detecting A Botnet By Reverse EngineeringOesman Hendra KelanaKhabib MustofaAbstract— Botnet malware is a malicious program. Botnet that infects computers, called bots, will be controlled by a botmaster to do various things such as: spamming, phishing, keylogging Distributed Denial of Service (DDoS) and other activities that are generally profitable to the owner of the bot (botmaster) or those who use botnet services. The problem is that many computers have been controlled by botnets without the knowledge of the computer owner. There are many ways to examine botnets, for example by studying the traffic from the botnet network, studying how botnets communicate to each, studying how each robot receives orders to do something, and so forth. Of the many methods, the most frequently and commonly used is the reverse engineering, where researchers study how a botnet works by botnet debugging. In this study the author tries to understand or research botnets by taking a type of botnet, namely Agobot, using reverse engineering. One of the result of the research is that malware program files in general and in particular botnet has a technique to obscure the way that research using reverse engineering. Another result also shows that the botnet Agobot runs on computers by using the Windows service, and by changing the Windows registry so that every time the computer starts, Agobot always actively works in the computer memory. Keywords— Malware, Bot, Botnet, Botmaster, Agobot, Spam, Distributed Denial of Services, Identity Theft, Computer Security, Reverse Engineering, Debug, Windows Service, the Registry.https://jurnal.ugm.ac.id/ijccs/article/view/2008 |
| spellingShingle | Oesman Hendra Kelana Khabib Mustofa Detecting A Botnet By Reverse Engineering IJCCS (Indonesian Journal of Computing and Cybernetics Systems) |
| title | Detecting A Botnet By Reverse Engineering |
| title_full | Detecting A Botnet By Reverse Engineering |
| title_fullStr | Detecting A Botnet By Reverse Engineering |
| title_full_unstemmed | Detecting A Botnet By Reverse Engineering |
| title_short | Detecting A Botnet By Reverse Engineering |
| title_sort | detecting a botnet by reverse engineering |
| url | https://jurnal.ugm.ac.id/ijccs/article/view/2008 |
| work_keys_str_mv | AT oesmanhendrakelana detectingabotnetbyreverseengineering AT khabibmustofa detectingabotnetbyreverseengineering |