{
  "family": "agobot",
  "sample_count": 7,
  "category": "backdoor",
  "description": "Backdoor:Win32/Agobot (also famously known as **Gaobot**) is one of the most historically significant and prolific botnets of the early 2000s. Written entirely in C++, Agobot was revolutionary for its time, introducing a highly modular, open-source architecture that allowed thousands of 'script kiddies' and malware authors to easily compile their own customized variants. It popularized the use of Internet Relay Chat (IRC) for Command and Control (C2), creating massive networks of 'zombie' computers used for Distributed Denial of Service (DDoS) attacks, spamming, and credential theft.<br><br><b>Understanding the Agobot (Gaobot) Legacy</b><br>To an infected user, the computer might slow down, or their internet connection would occasionally lag during a DDoS attack. For security analysts, Agobot represents the genesis of modern botnet architecture. Its source code (which leaked publicly in 2003) contained hundreds of modules, including exploit scanners, keyloggers, and packet sniffers. It shifted malware from being mere nuisances (like early worms) to monetized cybercrime platforms controlled by 'Bot Herders'.<br><br><b>Propagation and IRC Botnet Mechanics</b><br>Agobot was highly aggressive in its propagation. It utilized a built-in network scanner to blindly scan the internet for vulnerable machines, exploiting early Windows vulnerabilities like MS03-026 (RPC DCOM) or MS04-011 (LSASS) (`T1190`), or attempting brute-force attacks against administrative network shares (`T1110`). Upon compromising a machine (`T1204`), it installed itself as a hidden Windows Service (`T1543.003`) to ensure persistence. The defining characteristic of Agobot was its C2 mechanism: it silently connected to a predetermined IRC server and joined a hidden channel (`T1071.001`). There, it awaited commands from the Bot Herder, who could instantly command thousands of infected machines to launch SYN floods against a target (`T1498`), download secondary payloads, or steal CD keys and passwords.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact was massive network congestion and the weaponization of the endpoint for DDoS attacks. The most glaring network IoC is persistent, unauthorized outbound TCP traffic on port 6667 (the standard IRC port) or other non-standard ports connecting to unknown external servers. Host-based IoCs include the creation of randomly named Windows Services, aggressive scanning activity originating from the endpoint on ports 135 and 445, and the presence of the Agobot executable (often heavily packed).",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1498",
    "T1190",
    "T1071.001",
    "T1543.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols (IRC for Command and Control)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1498",
      "name": "Network Denial of Service (Coordinated DDoS attacks)",
      "tactic": "Impact"
    },
    {
      "id": "T1190",
      "name": "Exploit Public-Facing Application (Automated vulnerability scanning and exploitation)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service (Persistence)",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint from the network immediately to sever its connection to the IRC botnet controller and stop it from attacking other machines.",
    "Block outbound IRC traffic (TCP port 6667) and any non-standard ports identified in the C2 communication at the enterprise firewall.",
    "Use the Windows Service Manager (services.msc) or EDR to forcefully stop and disable the unauthorized botnet service.",
    "Patch all endpoints against historical vulnerabilities (MS03-026, MS04-011) and disable unnecessary administrative network shares (IPC$)."
  ],
  "what_to_avoid": [
    "Do not assume the threat is minor because it is old; variants of the Agobot source code are still occasionally used in targeted attacks against unpatched legacy systems.",
    "Avoid relying solely on basic antivirus; the polymorphic engines used by modern Agobot variants can easily bypass static signatures."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}