Zemra is a DDoS Bot which was first discovered in underground forums in May 2012.
Zemra is capable of HTTP and SYN Flood flooding and also has a simple Command & Control panel that is protected with 256-bit DES encryption for communicating with its command and control (C&C) server. Zemra also sends information such as Computer name, Language settings, and Windows version. It will send this data to a remote location on a specific date and time. It also opens a backdoor on TCP port 7710 to receive commands from a remote command-and-control server, and it is able to monitor devices, collect system information, execute files, and even update or uninstall itself if necessary.
See also
- Denial-of-service attack
- Dendroid (malware)
- High Orbit Ion Cannon
- Xor DDoS
- SYN flood
- Tribe Flood Network
- Trinoo
- Stacheldraht
- Low Orbit Ion Cannon
References
- Kumar, Mohit (2012-06-27). "Zemra Botnet Leaked, Cyber Criminals performing DDoS Attacks". The Hacker News.
- Neville, Alan (27 June 2012). "DDoS Attacks: The Zemra Bot". Symantec. Retrieved 23 October 2016.
- ^ Kovacs, Eduard (2012-06-28). "Zemra DDOS Crimeware Kit Used to Extort Organizations". Softpedia.
- "Backdoor.Zemra". Precise Security. 2012-06-27. Archived from the original on July 2, 2012.
- "Backdoor.Zemra". Naked Security. 2012-06-26. Archived from the original on 2015-03-25.
- Goldman, Jeff (2012-06-29). "Symantec Warns of New Zemra Bot". eSecurity Planet.