Agobot (computer worm)
From Wikipedia, the free encyclopedia
Agobot, also frequently known as Gaobot, is a family of computer worms. The Agobot source code describes its self as: “a modular IRC bot for Win32 / Linux”. Agobot was released under version 2 of the Gnu General Public License. Agobot is multi-threaded and mostly object oriented program written in C/C++ as well as a small amount of assembler. Agobot is a example of a [Botnet] that requires little or no programming knowledge to use.
New versions, or variants, of the worm appeared so rapidly that the Agobot family quickly grew larger than other bot families. Other bots in the Agobot family are: Forbot, Phatbot, Urxbot, Rxbot, Rbot. Agobot now has several thousand variants. The majority of the development force behind Agobot is targeting the Microsoft Windows platform, as a result the vast majority of the variants are not Linux compatible. In fact the majority of modern Agobot strains must be built with Visual Studio due to its reliance on Visual Studio's SDK and Processor Pack. An infectious Agobot can vary in size from ~500kbyte to ~12kbyte depending on features, compiler optimizations and binary modifications.
Due to Agobots modularity and popularity it has turned into a kitchen sink platform of attack and control. A module written for one member in the Agobot family can usually be ported with ease to another bot. This mix-matching of modules to suit the owners needs has resulted in many of the variants.
All Agobots should contain the following features:
-Password Protected IRC Client control interface -Remotely update and remove the installed bot -Execute programs and commands using cmd.exe -A Port Scanner used by modules to find and infect other hosts -DDoS Attacks
The epitome of a feature rich bot is the Phatbot family which contains such features as:
-network traffic sniffer
-a key stroke logger
-Polymorphic engine in an attempt to evade Anti-virus detection
-Rootkit installer
-information harvest
-Email Addresses
-Software Product Keys
-passwords
-SMTP Client
-Spam
-Spreading copies of its self
-HTTP client
-Click Fraud
-DDoS Attacks
All of these common spreading methods of spreading are sub modules to the port scanning engine:
-MS03-026 RPC DCOM remote buffer overflow -MS04-011 LSASS remote buffer -MS05-039 Plug and Play Remote buffer overflow. -Attempting to hijack common backdoor Trojan horses which accept incoming connections via an open port. -The ability to spread to systems by brute forcing a login. A good example is Telnet or Microsoft's Server Message Block
Because there is no standard of detection nor classification for the Agobot family, there is also no standard naming convention. Most Anti-Virus programs detect variants generically (e.g. W32/Agobot.worm), and identifying what specific Agobot variant is indicated is next to impossible except with the earliest or most common versions.
