A bot is basically the malware itself which usually polls a server (C2, command, & control) for commands and instructions it should do next. The bot usually wants persistence on the system via scheduled tasks, registry keys edits, WMI subscriptions, etc... to survive reboots and have an open connection to the C2 as long as possible, C2 servers usually run over either HTTPS, HTTP or DNS protocols.
Now all of this is pretty simple, I mean the bot itself looks completely harmless until it really gets the real deal instructions from its C2, either being to drop or load some ransomware, DDOS attacks, crypto mining, etc...
- programming languages to use for your bot
- packages and modules:
net, http, windows api retaled wrapper apis in your chosen language, etc... these will allow your bot to actually comunicate to your C2 and do various other modular tasks on a system.
How do we spread it?
I mean we got the dev stack, but we still kind of need some users to spread our bot to. Well, this is ALWAYS complex, patient zero is usually the most complicated stage in botnets, when the botnet first grows big and large it's super easy, but when you're starting out? Not really...
But there are some options here:
- e-mail spam, scrape some initial targets for spam
- exploits (SMBGhost, BlueKeep, EternalBlue) or brute force (via SSH, telnet if Linux plataforms are your target)
- trojanized/pirated software (the most easy, but most risk way to do it above spam.
Now all of this is pretty simple, I mean the bot itself looks completely harmless until it really gets the real deal instructions from its C2, either being to drop or load some ransomware, DDOS attacks, crypto mining, etc...
- programming languages to use for your bot
- packages and modules:
net, http, windows api retaled wrapper apis in your chosen language, etc... these will allow your bot to actually comunicate to your C2 and do various other modular tasks on a system.
How do we spread it?
I mean we got the dev stack, but we still kind of need some users to spread our bot to. Well, this is ALWAYS complex, patient zero is usually the most complicated stage in botnets, when the botnet first grows big and large it's super easy, but when you're starting out? Not really...
But there are some options here:
- e-mail spam, scrape some initial targets for spam
- exploits (SMBGhost, BlueKeep, EternalBlue) or brute force (via SSH, telnet if Linux plataforms are your target)
- trojanized/pirated software (the most easy, but most risk way to do it above spam.
