Agobot
Family of botnet computer worms
- 3 min read
- 3 chapters
Related on Lably
Through Microsoft Windows, Simple Mail Transfer Protocol and HTTP
Technical details
New versions, or variants, of the worm appeared so rapidly that the Agobot family quickly grew larger than other bot families. Other bots in the Agobot family include Phatbot and Forbot. Agobot now has several thousand known variants. The majority of these target the Microsoft Windows platform; as a result the vast majority of the variants are not Linux compatible. Modern Agobot strains were most likely built with Visual Studio due to their reliance on Visual Studio's SDK and Processor Pack. An infectious Agobot can vary in size but is typically around 12 to 500 kilobytes depending on features, compiler optimizations, and binary modifications.
A module written for one member in the Agobot family can usually be ported with ease to another bot. This mix-matching of modules to suit the owner's needs has inspired many of the worm's variants.
Most Agobots have the following features:
- Password Protected IRC Client control interface
- Remotely update and remove the installed bot
- Execute programs and commands
- Port scanner used to find and infect other hosts
- DDoS attacks used to takedown networks
The Agobot may contain other features such as:
Sign in to keep reading
2 more chapters are free with a Lably account.
Spreading
The following propagation methods are sub-modules to the port scanning engine:
- MS03-026 RPC DCOM Remote Buffer Overflow (CVE-2003-0352)
- MS04-011 LSASS Remote Buffer Overflow (CVE-2003-0533)
- MS05-039 Plug and Play Remote Buffer Overflow (CVE-2005-1983)
- Attempts to hijack common Trojan horses that accept incoming connections via an open port.
- The ability to spread to systems by brute forcing a login. A good example is Telnet or Microsoft's Server Message Block
Generally, it has been observed that every custom modified variant of Agobot features a selection of the above methods as well as some "homebrew" modules, which essentially are released exploits ported to its code.
Names and such can be added via the XML files to produce variable shuffle imports.
Variants
Gaobot.ee
Gaobot.ee is a variant of Agobot. It is also known as the W32.HLLW.Gaobot.EE. It is a malicious computer worm that tends to come from the P2P network Ares, installing from its virus form, Ares.exe. It has rather odd characteristics for a virus, with the unique ability to download and install random files (perhaps to create more sharers) from its members, such as music, pornography, and even full games. Gaobot.ee is a worm that sends large numbers of unsolicited e-mails using its own SMTP engine. This worm also opens a backdoor on a random TCP port, notifies attackers through a predetermined IRC channel, and attempts to terminate various security products and system monitoring tools.
Its security level is low, hardly doing any damage to a computer. However, it has been reported to download and install spyware, more viruses, trojans, and worms, although this is not as yet officially been proven.