So if you have been following my posts on this blog, you may have noticed a large number of posts about the “betabot” malware. Betabot is a http bot which is sold on hackforums.net. Despite a number of complaints about serious stability issues, it has become popular with some of the more dedicated script kiddy residents of that board, leading to the botnets posted on this blog.
Today I noticed an interesting feature included in betabot. The coder had apparently seen fit to include the hackforums nickname of the purchaser in each malware file. While the motive appears to be incompetence rather than malice, this has allowed me to link a number of the posted botnets with profiles on hackforums.
These are just the obvious ones. I’ll do a bit of searching and post some more soon.