The waledac protocol: The how and why

Greg Sinclair, Chris Nunnery, Brent ByungHoon Kang

Abstract: Peer to peer (P2P) botnets are a growing occurrence in the malware community. The Waledac botnet represents a new, more challenging trend in the P2P botnet evolution. The Waledac infrastructure has evolved key aspects of the P2P architecture and devolved others. This evolution/devolution has resulted in a more formidable botnet. As a result, the Waledac botnet is harder to infiltrate and harder to enumerate. This paper explains the various aspects of the Waledac botnet infrastructures to give defenders a better understanding of the botnet in order to protect themselves and others.