Need help with billgates-botnet-tracker?
Click the “chat” button below for chat support from the developer who created it, or find similar developers for support.

About the developer

131 Stars 45 Forks MIT License 6 Commits 0 Opened issues


Some tools to monitor BillGates CnC servers

Services available


Need anything else?

Contributors list

# 5,462
5 commits

What's this?

Here are some tools written in Python to monitor BillGates Linux Botnet activity (DDoS commands, update commands, etc).

What's BillGates?

Well, that's a Linux botnet I've found in February, 2014. It it splitted in modules usually called atddd, cupsdd, cupsddh, ksapdd, kysapdd, sksapdd, skysapdd.

cupsdd is the main module which I call "Gates" (because it locks /tmp/gates.lock). It unpacks cupsddh ("Bill") module (the last character depends on configuration) to the directory where the cupsdd is stored (usually /etc), creates

and makes symlinks to it in
, establishes connection to "Gates" CnC server on IP Newer version of "Gates" module also includes Monitor module "moni". It copies itself to /usr/bin/pojie and acts as "moni" only if ran as /usr/bin/pojie. "Bill" can perform simple DDoS.

atddd, ksapdd, kysapdd, sksapdd, skysapdd is an advanced DDoS module which I call "Melinda" (it doesn't have this name and I thought I can give it). It can perform TCP, UDP, ICMP and DNS DDoS with packet forgery. The only difference between these files is the CnC server IP address.

atddd =
ksapdd =
kysapdd =
skysapdd =
sksapdd =

How can I get this botnet?

That's pretty easy, just set your root password to "1" or something and make sure you have openssh running. You'll definitely get it in some time. It seems like the installation process is performed by an individual and not automatically.

How can I delete this botnet from my PC?

Well, I have successfully deleted this botnet by cleaning root crontab file,

, all the botnet files from /etc (they all have SUID bit and some of them have Immunitable bit),
. But beware, "Bill" module has some code to execute
insmod /usr/lib/xpacket.ko
and write something to
so your PC could be easily infected by rootkit (although I haven't seen any).

More information

You can read my writeup in Russian (or Google-translated)

We use cookies. If you continue to browse the site, you agree to the use of cookies. For more information on our use of cookies please see our Privacy Policy.