Sality botnet

How can I find the victim ips of a botnet? I would like to see the ips that were victims of the sality botnet, is this possible?

It could be any other botnet.

here's some lists https://iplists.firehol.org/ https://filterlists.com/

>>19488 How would i find the sality in this site?

>>19486 sality was a nasty worm. i don't ever want to see it again. >:(((

>>19516 I would like to study it, do you have any content, website or blog that explains better about this botnet?

>>19525 idk one but it goes like this >nothing suspicious in the process >find the offending exe file and service and delete >it's probably fake/dummy and is useless to delete now as the system has already been infected >get antivirus >reports nothing found since they can't delete or quarantine system files >get another antivirus, does nothing again but sees it and recommends below >try fixing system files using internet, no luck (it's useless regardless) >eventually try soykaf like safe mode while doing above or the stuff that does virus checking and system fixing during boot, forgot what that is >it tells the antivirus to whitelist the virus/worm/botnet (I think it's all, like some stuxnet tier soykaf) don't know the details of the botnet variant (maybe infects many machines on a network) but i'll say sality is cleverly written, it even disabled some antivirus that works in the safe mode and boot and there was not a single working fix for an infected system (maybe aside from literally overhauling the entire system into a new installation), it also self-replicates with just one binary/exe file, like if you had a winrar executable installer that got infected it will start another worm infestation from scratch. don't know how it patched all the files but I think it is bad for the HDD since the worm will patch all exe files or even DLL. then lastly, it's a bad idea to connect the device to the internet (boot and safemode fix). it will even manipulate (theoretically) ALL antivirus to report that the system is no longer infected, don't know how they did it but they sure have studied how antiviruses work and even some lame ass antivirus also got disabled, probably some kind of a smart virus+worm+botnet that also targets antivirus software. the only way to prevent it is if you had a patched system.

>>19548 >infected computer must be running windows xp >no access to physical machines >I only have access to computers with a great security solution

I used to work in malware remediation and threat research for an undisclosed antivirus company, and I would never even try to remove a file infector like Sality from a system. I'd always say you can backup anything that's not a PE file and reinstall the OS, and never touch any PE file connected to an infected machine ever again. You can find samples from theZoo. Be extremely careful executing anything, and if you have to ask how to setup a malware analysis environment then you're not ready for a file infector. https://github.com/ytisf/theZoo/tree/master/malware/Binaries/Win32.Sality