Skip to content
Botnet Research Archive

Botnet Research Archive

University-level academic analysis of 369 historical malware specimens. Defensive research only - zero malicious code hosted.
Start Reading Original Source Repo

// ARCHIVE_OVERVIEW

Section titled “// ARCHIVE_OVERVIEW”

This project provides comprehensive educational documentation of a publicly available collection of historical botnet source code spanning 2002 to 2009. All analysis is conducted for academic purposes with a focus on defensive cybersecurity and MITRE ATT&CK mapping.

// COLLECTION_STATS

Section titled “// COLLECTION_STATS”

369 Specimens

Total directories in the VirusPack collection spanning 7+ years of malware development

9 Major Families

rBot/rxBot, sdBot/spyBot, Phatbot/Agobot, Zeus, NZM, AkBot, Darkness, CYBERBOT, Reptile

~250 Unique Samples

After removing ~110 confirmed duplicates and revision copies

8+ Languages

C, C++, Java, PHP, Delphi, VB6, Perl, Assembly - across Windows, Linux, and embedded platforms

// QUICK_NAV

Section titled “// QUICK_NAV”
rBot/rxBot Family The largest family - 121 specimens tracing IRC bot evolution from 2004-2008
Zeus Banking Trojan The paradigm shift from IRC to HTTP - commercial crimeware that changed everything
Evolution Timeline From sdBot (2002) to Zeus (2009) - how malware evolved over 7 years
Defensive Lessons What the security industry learned from each generation of threats

// METHODOLOGY

Section titled “// METHODOLOGY”

All analysis was performed through source-level code inspection of the archived specimens. Techniques are mapped to the MITRE ATT&CK Framework throughout. No code was compiled or executed during research.

$ cat /proc/research/approach
METHOD: Static source analysis
TARGET: github.com/maestron/botnets
SCOPE:  369 directories, ~250 unique specimens
OUTPUT: Academic documentation with defensive focus
STATUS: ACTIVE