So recently I started to study how botnets work. But recently I stumbled onto a problem. I even tried brain storming how it would do it, but I couldn't think how a bot would update its code. I also tried researching it on google, but I got nothing. If someone could provide me with some sort of software updating algorithm, or a documentation on how a bot would update then that then that would be nice.

  • Download and replace executable with new one. Googling for "restart process from within" yields some interesting results. May 28, 2017 at 22:50
  • Thank you. But what exactly was the need to down vote my post? May 28, 2017 at 22:57
  • 3
    Why would updating a botnet be so much different than updating ordinary software?
    – Arminius
    May 28, 2017 at 23:26
  • 1. The creator of the botnet might want to implement a method that will protect against any botnet take down attempt of just replacing the exe with code that renders every bot useless. Basically making the whole botnet also use less. 2. I was just curios. I didn't know what methods ordinary software used to update its self. May 29, 2017 at 3:45
  • Your requirement 1. would also apply to regular software.
    – Arminius
    May 29, 2017 at 3:55

1 Answer 1


Botnets reach out to a Command and Control (C2) server - typically a range of servers to help mitigate server takedown issues.

When they connect to a C2 server, the server may chose to initiate a function in the bot - for example to take part in a DDOS attack - or may chose to update code within the bot.

Clever bots will have the ability to rewrite themselves (or part of themselves) in memory as well as being able to update whatever file(s) the bot uses. Some bots only exist in memory and are lost on reboot.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .