This is an old revision of the document!
Table of Contents
Bot Search
What is a bot or a botnet?
Malware bots and Internet bots can be programmed or reprogrammed to hack into user accounts, search the Internet for contact information, send spam, or develop other malicious activities.
To disguise the origin of such attacks, attackers can also distribute malicious bots through a botnet - that is, a bot network. A botnet consists of a number of devices connected to the Internet and running one or more bots without the knowledge of the respective device owner. Because each device has its own IP address, botnet traffic originates from a variety of IP addresses, making it harder to spot and block its point of origin. Botnets also self-propagate to more devices, which can then send out spam and in turn infect more machines.
If an IP, host name oder username pops up in the Kaduu logs, it means it has been infected with a malicious bot.
Where is the menu?
There are two search pages:
- Bot Record Search: On the bot records search page you can search in a database of indexed stealer bot records. The information is collected from stealer (trojan) logs distributed on hacker forums and marketplaces. This index is different from bot search, as it indexes separate records.
- Bot Search: On this page you can search in a database of indexed stealer bot records. The information is collected from stealer (trojan) logs distributed on hacker forums and marketplaces. This index is different from bot record search, as it indexes bots and not separate records.
Bot Record Search
The syntax for the bot search needs to use our special operators. Lets say you want to find all bots that connect to a URL that contains "sbb", you need to search for url:sbb*. If you only search for sbb, you will get 0 results!
Search Syntax
| Field | Details |
|---|---|
| createdAt | Creation date & time. |
| collectedAt | Collection date & time.. |
| botId | Bot ID |
| botName | Software name |
| botVersion | Version number |
| ip | IP address |
| asn | Autonomous system number |
| asnText | ASN description (default field) |
| country | Country of bot location |
| os | Computer operating system |
| timeZone | Computer time zone |
| computerName | Computer name (default field). |
| userName | Computer user name (default field) |
| location | Computer location |
| type | Record type. |
| url | URL (default field) |
| name | Record name (default field) |
| value | Record value |
| time | Record time |
Bot Record Details
If you want to see the details of the bot records, please click on the IP address. You will the see the path of the file, that lead to the malware infection. More details about the user, the internet history and web calls will be also visible:
