W32 AGOBOT GH FULL
W32 AGOBOT GH SOFTWARE
W32 AGOBOT GH CODE
W32 AGOBOT GH DOWNLOAD
W32 AGOBOT GH WINDOWS

W32 AGOBOT GH WINDOWS

The majority of the development force behind Agobot is targeting the Microsoft Windows platform as a result the vast majority of the variants are not Linux compatible. Agobot now has several thousand variants. Other bots in the Agobot family are: Forbot, Phatbot, Urxbot, Rxbot, Rbot. New versions, or variants, of the worm appeared so rapidly that the Agobot family quickly grew larger than other bot families. Agobot is an example of a Botnet that requires little or no programming knowledge to use. Agobot is a multi-threaded and mostly object oriented program written in C++ as well as a small amount of assembly. Agobot was released under version 2 of the GNU General Public License.

W32 AGOBOT GH CODE

The Agobot source code describes it as: “a modular IRC bot for Win32 / Linux”. A German named Axel Gembe was responsible for writing the first version. Terminating ProcessesĪgobot.FO has a huge list of process file names hardcoded in its body.Agobot, also frequently known as Gaobot, is a family of computer worms.

W32 AGOBOT GH FULL

Information obtained from the Registry can give a hacker a full overview of an infected system. This is a new feature for Agobot backdoor. The backdoor has the functionality to obtain System Registry info from an infected computer. It has the functionality to read user's Address Book and send the list of email addresses to the bot operator. The backdoor sends 256000 bytes of random data to the following websites and checks the response times: When performing a DDoS attack, the backdoor uses 33 unique client identifiers including Mozilla, Wget, Scooter, Webcrawler and Google bot. The backdoor can perform the following types of DDoS attacks:

W32 AGOBOT GH SOFTWARE

The backdoor can also scan for computers infected with MyDoom worm (port 3127), Bagle worm (port 2745) and also for computers where DameWare remote system management software is installed (port 6129). The scan is performed on ports 80, 135 and 445 for RPC/DCOM (MS03-026), RPC/Locator (MS03-001) and WebDAV (MS03-007) vulnerabilities.

The backdoor can scan subnets for exploitable computers and send a list of their IPs to the bot operator. Scanning for Vulnerabilities & Infections

W32 AGOBOT GH DOWNLOAD

download and execute a file from an ftp server.execute command if certain conditions are met.adds/deletes autostart key in the Registry.accesses certain variables in configuration file.

save/load configuration settings to a file.change IRC server that the bot connects to.load a plugin (unloading is not supported yet).remove bot if it doesn't match certain criteria.The following oprerations can be performed via tbe bot: The backdoor is controlled via an IRC bot that is created on a certain IRC server in a specific channel when the the backdoor's file is active. The alternative way of infecting a remote host is to create a scheduled task on a remote computer that will start the backdoor's file. If the worm succeeds in connecting to the above listed shares, it copies itself to a remote share and attempts to start that file as a service. When connecting, Agobot.FO uses the following passwords: It tries to connect using the following account names: When spreading over the local network, Agobot.FO probes the following shares: The scan must be initiated by a remote attacker. Propagation (Network Shares)Īgobot.FO can scan for computers connected to the infected machine over a local network and copy itself to other accessible machines. On Windows NT-based systems the backdoor can start as a service. This allows the backdoor's file to start with every Windows session. Installationĭuring installation, Agobot.FO copies itself as NVCHIP4.EXE file to the Windows System folder and creates startup keys for this file in System Registry: The unpacked file's size is over 245 kilobytes.Īgobot.FO was found in March, 2004 and has become relatively widespread. The backdoor's file is a PE executable 115738 bytes long compressed with PE-Diminisher file compressor. As the original Agobot author is known as TheAgo, its possible the identifier indicates that this variant is made by a different person or group. Agobot.FO propagates over network shares.Īgobot.FO's code has a 'Phatbot3' identifier and there are a few 'phat' text strings in its body. This backdoor has functionality similar to previous-released variants, but is more powerful, being able to harvest email addresses, launch Distributed Denial of Service (DDoS) attacks and more. Backdoor:W32/Agobot.FO is a variant from the Agobot backdoor family.

W32 agobot gh