DonBot analysis by FireEye

[SysAdMini]

http://blog.fireeye.com/research/2009/10/a-little_more_on_donbot.html

Donbot is primarily a spam bot, one of the few spam botnets whose growth was not hampered by the McColo shutdown earlier this year.  As a matter of fact, the sudden shut down of big spammers like Srizbi and Rustock helped Donbot climb the spam botnet rankings.  In this article I am going discuss different aspects of Donbot, first as a malware and then in the later half I will try to shed some light on its command and control architecture.