The commands That can run this botnet at infected machines are the same as used by the Botnet Herpes:
Commands:
Download/Execute: Download and execute the specified file.
What to put in the variable box = The URL of the file to be
downloaded.
Update: Download and update.
What to put in the variable box = The URL of the file to be
downloaded and updated.
Visit Page [Visible]: Open the default browser and visits
the specified webpage.
What to put in the variable box = The URL of the page to be
visited.
Visit Page [Invisible]: Open Internet Explorer silently and
visits the specified webpage.
What to put in the variable box = The URL of the page to be
visited.
Upload Keylog: Sends the keylogger log to our server and you
will be able to download it
from the Bot Informations page. Attention, every uploaded
file will rest there for 15 minutes, and after will be deleted.
What to put in the variable box = Nothing.
Reset Keylog: Clears the key log.
What to put in the variable box = Nothing.
Upload Screenshot: Take a screenshot and sends to our server
and you will be able to download it
from the Bot Informations page. Attention, every uploaded
file will rest there for 15 minutes, and after will be deleted.
. What to put in the variable box = Nothing.
Upload Error Log: Sends the Error Log to our server and you
will be able to download it
from the Bot Informations page. Attention, every uploaded
file will rest there for 15 minutes, and after will be deleted.
What to put in the variable box = Nothing.
DDoS Webpage: Sends a request to the specified webpage for
60 seconds
(Please note that the bot will not execute commands for 60
seconds because is DDoSing. An high amount of selected online bots will crash
the webserver).
What to put in the variable box = The webpage to be
requested.
Silent CPU&GPU Bitcoin Miner: Start to use your bots to
make a lot of bitcoins.
What to put in the variable box =
http://workerusername:workerpassword@poolhost:poolport
Example: http://lollipop:byebye@pool.bitclockers.com:8332
Tip: For disabling mining just send this command with the
variable box empty.
Torrent Seeder v2.5+: Start to use your bots to seed your
torrent for you.
What to put in the variable box = The url of the .torrent
file to be downloaded
Example: http://www.mywebsite/download.torrent
Open and Close CD Tray v2.5.1+: Just opens or closes the CD
tray.
What to put in the variable box = Nothing.
Message Box v2.5.1+: Spawn a message box on the screen.
What to put in the variable box = The message to send.
Swap and Restore Mouse Buttons v2.5.1+: Swaps or return to
normal the mouse buttons.
What to put in the variable box = Nothing.
Uninstall: Remove Herpes from the system.
What to put in the variable box = Nothing.
In this criminal server infrastructure has been located the control panel "CASHMARKET AFFILIATE" that is the same botnet that the known Blackshades botnet but modified.
This control panel is accessed by malicious URL: hxxp://46.166.163.127/bs/
Criminals have not changed even the installation folder "BS" feature at BlackShade kit
