Bashlite (Qbot) Debunk

[BotMaster]
          \
           \
           ----
           |  |
           |  | [Botnet Server]
           ----
             \
              \
                ----|
                    |
                  [Bot]----[Bot]----[Bot]
                                      |        P2P NETWORK
                                      |
                  [Bot]----[Bot]----[Bot]



Username: Flux
Password: *******
Loading Banner

`7MMF'  `7MMF'               `7MM                      OO
  MM      MM                   MM                      88
  MM      MM   ,6"Yb.  ,p6"bo  MM  ,MP'.gP"Ya `7Mb,od8 ||
  MMmmmmmmMM  8)   MM 6M'  OO  MM ;Y  ,M'   Yb  MM' "' ||
  MM      MM   ,pm9MM 8M       MM;Mm  8M""""""  MM     `'
  MM      MM  8M   MM YM.    , MM `Mb.YM.    ,  MM     ,,
.JMML.  .JMML.`Moo9^Yo.YMbmd'.JMML. YA.`Mbmmd'.JMML.   db
        [+] Welcom Flux to the Hacker Net [+]
~> Debunk

OK so BASHLITE, or more know as qbot, is a botnet that has been used in large ddos attacks. Bashlite was originally was created by Lizard Squad. Although The Malware hasn't been recreated (I don't think), many files have been created for it. Let's talk about the malware. Now the malware would exploit a bash bug in many devices. This bug was a shellshock software bug. This allows many devices to be exploited that run a busybox. Although this exploit was the largest, many variants have been created. Over 1 million devices were infected. From research and infection graphs, 90-96% of devices were IoTs (telnet devices). About only 4-10% were routers and a small handful were Linux Servers. Although most devices were IoTs, this botnet was NOT an IoT botnet (Mirai is An IoT botnet). The bots were connected to a c&c (command and control server via p2p). These bots would communicate one by one, like a game of PASS IT ON. Now these bots are permanently connected to the c&c. If one botnet doesn't respond in the given time, the session between the bots and the servers will close, causing the bot to "die". Now let's talk about what the botnet consists of. It consists of a server side (the connection handler) and a client side(the commander, more known as the bot, not be confused with the infected devices bots). Both of these files are .c file. The client is compiled into multiple Archs (not going into detail) and the server is compiled with a gnu compiler (gcc). If I'm wrong on this article feel free to correct it. Later on I will be explaining what "attack methods" this botnet consists of. (From experience and research, I was able to put this together)