CPanel Setup

CPanel setup process is very simple.
You copy/move the content of PHP folder to the root of the HTTP service and then modify the following:

Must change ones

1. connect.php file: You only have to edit the password variable to set your own and MD5 it, then set it in the bot and compile.
2. config.php file: You'll need to change the following:

• dbhost: This is the host for MySQL service.
• dbuser: Database username.
• dbpass: Database password.
• dbname: Database name.
• logins: now careful with this one. It's an array containing login credentials, and it can be multi user login. There's no reason or a different between any of the logins, but might make one or two :|
  Setting this with empty username or password disables it, so careful not to forbid yourself from login-in.

Optional ones

These optional ones are two types, more security and less security. They're as follows:

1. date_default_timezone_set: This one tells the PHP script which timezone to work as. Set it to your timezone to understand more about the last seen tag in the bot.
2. useragent: We highly recommend setting this to a user-agent that you only use when access the CPanel.
   If you set this to a specific user-agent and navigate all the web with it, you'll just hand everyone your user-agnet! So make sure you use a unique one for this.
3. loginneed: This tells the CPanel that you need login or you don't, depending on the value (True or False).
   We don't recommend setting this to False even when using user-agent strict.
4. cookiename: This variable is set for the cookie name that the browser uses to identify you to the CPanel. You're free to change this one, but not to empty :|
5. cookietimeout: This variable is by default set to 3 days (86400 * 3). To adjust timeout, just change (3) to how many days you'd like to stay logged-in. We only recommend adjusting!

Other files

The CPanel is not only PHP files, it contains tor files, version file and extras.

Tor files

Tor files are files to be uploaded on some not-on-tor website for the bot to download files from, therefor to connect to TOR.
Those are only useful when setting the onTor to True/1.
You can find them in the extras folder in the CPanel named extras.rar. Decompress them, and upload them.

How does Tor files work?

You decompress the file extras.rar and you'll find three new things, unrar.exe, unrar3.dll and tor folder.
The tor folder is the one needs explaining. This folder has all Tor.part*.rar files and the files.txt file in it.
Directory listing for this directory is not needed. The bot downloads the files.txt file and reads how many parts are there. And then automatically downloads all parts and unrar them using unrar.exe.

Tor files updating

In case we release Tor files update, you just need to upload the new files (if there aren't any changes).

Version file

The version.txt file is used to automatically update the bots when ever there is a new release.
Using this file is easy, and yet complicated. When an update is released, you'll need to change few things:

1. The version of the type updated: This file has a list of all released versions. If a bot is connected, the connect.php file checks if the bot's version is out-dated one. Therefor sends it an update command with the updated version.
   To change this one you only have to open the version.txt file with any text editor, find the version updated and set the update version (and you might need to change the URL if you need to).
   [Ex: 0.3 - VB|http(s)://host/alma.pro.spy/extras/Updated.exe ==> becomes 0.4 - VB|http(s)://host/alma.pro.spy/extras/Updated.exe]
2. You'll need to update the EXE file in the pointed URL. If you keep the older version one, it'll keep updating forever.
   This can be set to your host on TOR.

Extras

Those files are not literally extras! They are files the botnet uses to accomplish some tasks.
These files are more like add-ons, they do functions that the bot basically doesn't.
Here's what they are and what they do:

1. cc.png: This is CommandCam. An open-source Web-Cam capturing program (here).
2. kl.png: This is a keylogger that doesn't connect to the internet (FUD technique). It only logs keys in a file in the current working directory.
3. nircmd: This is screen-shot taker (here).
4. rcmd.png: This is a remote CMD. No internet connection makes it FUD, but recently some AV detected it as a malaware for some reason! We'll FUD it again.
5. wfmf.png: Now this one is really extras, and yet needed. Wait For My Files.
   This program waits for a specific hard drive or USB to connect, and then steal files from it which you tell it to steal, and then just shutdown.
   We find this useful when the victim keeps important, yet secret, data on an external hard drive. Here comes this program to wait for them even when offline, and saves them in the current working directory.