The Malware Economy

Note

This analysis synthesizes findings across all research documents to trace the commercialization of the malware ecosystem. It examines how hobbyist code-sharing evolved into a professional criminal supply chain with distinct roles, business models, and revenue streams. All specimens referenced are from the archived collection.

From Hobby to Industry

The collection documents a complete economic transformation spanning roughly 2002–2009. What began as open-source code sharing among hobbyists evolved through several distinct phases into a mature criminal economy with specialized roles, commercial products, and industrial-scale operations.

Phase 1: Gift Economy (2002-2004)
  Free code, reputation-driven, community mods

Phase 2: Commoditization (2004-2006)
  So many variants that the code itself lost value

Phase 3: Specialization (2006-2008)
  Distinct product categories: kits, stealers, crypters, bots

Phase 4: Industrialization (2008-2009)
  Commercial products, affiliate programs, SaaS licensing

---

Phase 1: The Gift Economy (2002–2004)

How It Worked

The earliest specimens - sdBot 0.4b, spyBot, early rBot - operated under a reputation-driven gift economy. Authors released source code freely, gaining status in underground communities through the quality and innovation of their contributions.

Specimen	Author	Distribution Model	Motivation
sdBot 0.4b	[sd]	Free C source release	Community reputation
spyBot 1.1–1.4	Mich	Free source, forked from sdBot	Feature innovation
rBot 0.2	Nils, D3ADLiN3, Edge, bohika, rewe	Free C++ source	Consolidation of exploits
rx_dev	RacerX90	Private development, later leaked	Architectural excellence
rxBot 0.6.6d	RacerX90	GPL-licensed (ironic)	Formalized open-source model

The Open-Source Malware Model

rxBot was explicitly GPL-licensed - a direct borrowing of the legitimate open-source development model. This meant:

• Changelogs: RacerX90's 682-line development log reads like a professional software project
• Code reviews: Community members identified bugs and proposed fixes
• Fork governance: Named variants (EcLiPsE, Xerion, Undertow, Temptation) acknowledged their lineage
• Cross-pollination: Exploits were shared between families - the DCOM exploit was borrowed directly from Agobot's codebase, as documented in source comments

Economic Value

In this phase, the code was free but the botnets had value through:

• DDoS-for-hire: Selling access to botnet firepower
• Spam relay: Renting infected machines to spammers
• Click fraud: The sdBot 0.5b visit command was an early click-fraud mechanism
• CD key theft: Game keys (Half-Life, Counter-Strike, Battlefield 1942, etc.) sold on black markets

---

Phase 2: Commoditization (2004–2006)

The Variant Explosion

By 2005, the rBot/rxBot family alone had generated 121 directory entries in the collection (~93 unique variants). The sdBot family contributed another 73. This proliferation created a paradox: the code itself became worthless because it was everywhere.

Family	Total Directories	Unique Variants	Forks/Mods
rBot/rxBot	121	~93	EcLiPsE, Xerion, Undertow, Temptation, URX, BlowSXT, NZM, 120-Series, CYBERBOT, RxBot-MP...
sdBot/spyBot	73	~42	b0rg, skbot, fake xdcc, getadm, Tesla SYN, SDX, SBX, svBot...
Phatbot/Agobot	12	10	Phatbot-stoney, ForBot variants...

What Retained Value

As source code commoditized, value shifted to:

1. Operational expertise - knowing how to deploy, manage, and monetize a botnet
2. Zero-day exploits - new exploit modules integrated within days of disclosure commanded premium prices
3. Infrastructure - bulletproof hosting, proxy networks, money laundering channels
4. Reputation - established operators with proven track records could charge for services

The Bot-Killer Economy

The 120-Series bot-killer module - maintaining a whitelist of 300+ legitimate Windows executables and killing everything else - reveals an economic dynamic: botnet operators were actively competing for the same infected machines. Rival bots were economic competitors to be eliminated, not just technical threats.

The packet sniffer described as a "Scaled down Carnivore" served dual purposes: stealing data from victims and stealing control of rival botnets by intercepting their C2 traffic.

---

Phase 3: Specialization (2006–2008)

The Emergence of Product Categories

By 2006–2007, the ecosystem had segmented into distinct product categories, each with its own development community, pricing, and business model:

Product Category	Specimens in Collection	Function	Business Model
IRC Bots	rBot, rxBot, sdBot families	General-purpose botnet	Free/open-source; value in operation
Exploit Kits	Fragus, IcePack, Fiesta3	Drive-by download delivery	Licensed product; sold per-kit
Stealers	iStealer5, Dwighlight_Stealer, CC.Trojan.EMAIL3	Credential theft	Builder tool; sold or leaked
Crypters	DynastryCrypter, SPKRYPT series	AV evasion (make payloads "FUD")	Subscription/license
RATs	FBIRAT, AryanRat	Full remote access	Sold on forums
DDoS Tools	hydra-2008.1, Darkness	Focused denial of service	DDoS-for-hire services
Worms	wworm2, ogw0rm, T_Worm	Self-propagation	Free tools; spread other payloads

The Supply Chain

These categories formed a criminal supply chain where each product fed into the next:

1. EXPLOIT KIT (Fragus/IcePack/Fiesta)
   Delivers payload to victim via drive-by download
        │
        ▼
2. CRYPTER (DynastryCrypter)
   Makes the payload undetectable by AV
        │
        ▼
3. BOT or STEALER (rBot, iStealer, Zeus)
   Executes on victim machine, steals data or joins botnet
        │
        ▼
4. MONETIZATION
   Stolen credentials sold, DDoS rented, spam relayed

Each link in this chain could be operated by a different criminal actor, none of whom needed to understand the full pipeline.

---

Phase 4: Industrialization (2008–2009)

Fragus: Exploit Kit as SaaS

Fragus exemplifies the affiliate-based Software-as-a-Service model that became standard for exploit kits. Analysis of its PHP source and sql.sql database schema reveals a structure directly analogous to a legitimate SaaS business:

Fragus Feature	SaaS Equivalent	Implementation
Affiliate management	Partner portal	sellers table - each affiliate gets unique ID, custom exe, exploit config
Per-install tracking	Conversion analytics	donkeys table - logs victim IP, OS, browser, country, referring seller ID
Revenue attribution	Affiliate commission tracking	Seller ID on every infection enables precise PPI payout calculation
Exploit configuration	Feature toggles	Per-seller exploit activation - premium affiliates get more exploits
Statistics dashboard	Analytics dashboard	Infection rates by country, browser, OS, seller performance

Pay-Per-Install (PPI) Economics: The database meticulously logged each victim (referred to as a "donkey") with the responsible seller's ID. This enabled precise revenue distribution - sellers were paid per successful installation, creating a measurable, scalable income model.

Separation of Concerns: This model separated three distinct roles:

1. Kit developers - wrote and maintained the exploit code
2. Kit administrators (renters) - operated the infrastructure
3. Traffic suppliers (affiliates) - compromised websites or bought traffic to feed victims to the kit

Each group focused on their core competency, dramatically increasing efficiency and scale.

IcePack: Targeted Exploit Delivery

IcePack demonstrates the technical sophistication required to maximize "conversion rates" (infections per visitor):

• GeoIP targeting (geoip.inc, GeoIP.dat) - restrict delivery to high-value regions or avoid researcher IP ranges
• Browser/OS fingerprinting - parse User-Agent to serve the correct exploit for each victim's environment
• Modular exploit delivery - separate PHP files for each exploit, dynamically included based on fingerprinting
• A/B testing equivalent - operators could configure which exploits were active, testing effectiveness

Fiesta3: Document-Based Exploitation

Fiesta specialized in exploiting legitimate file formats - a market differentiator:

• Dynamic PDF generation (pdf.php) - constructs malicious PDFs on-the-fly
• Heap spray + CVE-2007-5659 - JavaScript within PDFs exploits Adobe Reader vulnerabilities
• Format diversity - PDF and Flash (SWF) exploits extended attack surface beyond browsers

iStealer5: The Builder-Stub Model

iStealer pioneered the point-and-click malware generation model that lowered the barrier to entry to near-zero:

Component	Purpose	Technology
Builder (GUI)	Configuration interface for "customers"	Visual Basic 6 (frmMain.frm)
Stub (payload)	Pre-compiled generic malware template	C (main.c)
Configuration	User's settings injected into stub resources	PHP logger URL, bound file, custom icon

How it worked:

1. Operator opens the GUI builder
2. Enters their PHP logger URL (where stolen data will be sent)
3. Optionally binds a legitimate file (game installer, image) as camouflage
4. Optionally sets a custom icon to match the bound file
5. Builder injects configuration into the stub's PE resource section
6. Output: ready-to-deploy stealer executable - no coding required

Polymorphic by design: Each generated executable had a unique hash (different config data, bound file, icon), defeating simple hash-based blacklisting while the core code remained identical.

Targets: MSN, Google Talk, Firefox, FileZilla, and many more credential stores.

DynastryCrypter: Enterprise-Grade Malware Tooling

DynastryCrypter represents the apex of malware commercialization in this collection - a crypter with a production-grade PHP licensing backend:

Component	Purpose	Analogy
Crypter binary	Encrypts malware payloads to bypass AV	The "product"
PHP licensing server	Validates customer licenses before allowing encryption	License server (like FlexLM)
login.php	Customer authentication portal	SaaS login page
config.php	Database credentials + XOR keys for client-server auth	API key management
Customer database	Tracks paid users, license status, expiration	CRM/billing system

Techniques employed by the crypter itself:

• XOR encryption of payload
• Code virtualization
• Process injection (CreateProcess, Virtual​Alloc​Ex, Write​Process​Memory, Create​Remote​Thread)

Business model: Subscription-based - customers paid for continued access, ensuring recurring revenue. The XOR keys in config.php prevented unauthorized use of the crypter even if the binary was pirated.

---

Economic Roles in the Mature Ecosystem

By 2009, the malware economy had developed clearly defined professional roles:

Role	Description	Specimens/Evidence
Exploit Developer	Writes exploits for new CVEs	Exploit modules in rBot, exploit kit PHP files
Kit Developer	Builds and maintains exploit kits	Fragus, IcePack, Fiesta source code
Kit Operator	Rents/purchases kits, runs infrastructure	Fragus admin panel, IcePack config
Traffic Supplier	Drives victims to exploit kit landing pages	Fragus affiliate/seller system
Bot Herder	Manages botnet operations	rBot/rxBot operators, Zeus panel users
Stealer Operator	Deploys credential theft tools	iStealer builder users
Crypter Developer	Creates AV evasion tools	DynastryCrypter source
Crypter Service Provider	Runs FUD-as-a-Service	DynastryCrypter PHP licensing backend
Money Mule Manager	Launders stolen funds	Zeus web inject targets (banks) imply this role
Bulletproof Hoster	Provides takedown-resistant infrastructure	Zeus redir.php proxy chains

Revenue Streams

Revenue Model	Example	Estimated Market
Pay-Per-Install (PPI)	Fragus affiliates paid per infection	$0.01–$1.00 per install depending on country
Kit licensing	IcePack, Fiesta sold on forums	$300–$3,000 per kit
Crypter subscription	DynastryCrypter monthly license	$15–$50/month for "FUD" service
DDoS-for-hire	Botnet access rented hourly/daily	$10–$200 per attack
Credential sales	Stolen banking logins sold in bulk	$1–$50 per account depending on balance
Crimeware kit	Zeus sold commercially	$3,000–$10,000 for full kit
Spam relay	Botnet rented to spammers	$100–$500 per million messages
Click fraud	sdBot visit command	Revenue per click via ad networks

---

Key Economic Insights

1. Commoditization Drives Specialization

When rBot/rxBot source code became universally available, the code itself lost market value. This forced economic actors to specialize - some became expert operators, others built tools (stealers, crypters, kits) that added value on top of commoditized bot code.

2. Lower Barriers Expand the Market

The builder-stub model (iStealer) and point-and-click exploit kits (Fragus) meant that technical skill was no longer required to participate in cybercrime. This expanded the criminal market from hundreds of skilled developers to thousands of low-skill operators, dramatically increasing the threat volume.

3. The AV Arms Race as Market Driver

Commercial crypters existed solely because of antivirus detection. Each AV signature update created demand for fresh "FUD" crypting, ensuring recurring revenue for crypter operators. DynastryCrypter's subscription model explicitly monetized this arms race cycle.

4. Metrics-Driven Optimization

Fragus's per-seller tracking and per-country statistics show that criminal operations adopted the same data-driven optimization practices as legitimate businesses. Conversion rates, geographic targeting, and A/B testing of exploits were standard operational practices.

5. The Zeus Inflection Point

Zeus represented the first fully integrated commercial crimeware product - combining bot, builder, panel, and inject system in a single purchased kit. Its $100M+ damage estimate demonstrates the economic scale that the industrialized model enabled. The 2011 source leak then commoditized Zeus itself, spawning Citadel, ICE IX, GameOver Zeus, KINS/ZeusVM, and Sphinx - repeating the same commoditization cycle that the IRC bots had undergone years earlier.

---

Defensive Implications

Understanding the economic model reveals defensive opportunities:

Economic Pressure Point	Defensive Action
PPI revenue depends on install success	Patch management reduces exploit kit conversion rates
Crypter subscriptions require fresh evasion	Behavioral detection makes re-crypting less effective
Affiliate tracking requires infrastructure	Take down C2 panels and PPI tracking servers
Commercial kits need payment processing	Follow the money - cryptocurrency analysis, money mule prosecution
Specialization creates dependencies	Disrupting one supply chain link (e.g., crypter service) cascades to all downstream actors
Low-skill operators are error-prone	OPSEC failures in kit deployment provide attribution opportunities

The most important lesson: malware is not just a technical problem - it is an economic system. Effective defense requires disrupting the economics, not just blocking the code.