Last-minute paper reserve: The Waledac botnet: understanding it and breaking it

Pierre-Marc Bureau ESET
Joan Calvet Ecole Polytechnique de Montreal

The Waledac malware family clearly is Storm Worm 2.0: The code for both families is completely different but their functionalities and modus operandi are exactly the same. Waledac, just like Storm, uses a layered peer-to-peer network to communicate, propagates through malicious links, and is used to send huge amounts of spam. A bit like Web 2.0, Waledac introduces new vulnerabilities that were avoided by its predecessor.

In this presentation, we give an in-depth description of the Waledac malware family and its evolution. We explain the behaviour of its custom protection layer, its information-stealing capabilities and its business model. We also discuss the inner workings of its peer-to-peer network, how new peers connect to the network and how they send information back to the operators. Finally, we expose weaknesses that could be exploited to disrupt the botnet's activity and how Waledac's operators are working toward fixing them.


We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.