Malware detection has become more difficult with the use of compression,polymorphic methods and techniques to detect and disable security sottware. Those andother obfuscation techniques pose a problem for detection and classification schemes of malwares especially for botnets which are the most complicated forms for intemet crimes.The objective of this research is to detect the existence of botnets in the monitorednetwork by designing and deployment of a distributed low-interaction honeypot, and toprovide clues from the detection for the threat evaluation by botnets propagation estimation. A distributed framework of nepenthes honeypots is built to collect as more aspossible malware samples which are spreading on the network The configuration ofNepenthes is optimized to improve the capture efficiency. The collected malware samplesare analyzed firstly by features via antivirus scan, then by behavior via two onlinesandboxes. All data included in analysis reports is extracted and stored in database for theevaluation ofthe threats on the monitored network, and to study the propagation schema of the analyzed malwares.