{
  "family": "ircbot",
  "sample_count": 348,
  "category": "rat",
  "description": "Backdoor:Win32/Ircbot is a generic classification for a vast family of backdoor trojans that utilize Internet Relay Chat (IRC) channels for Command and Control (C2) communication.<br><br><b>What is Ircbot?</b><br>To the average user, an Ircbot infection might manifest as sudden spikes in network usage or unexplained sluggishness. For cybersecurity experts and threat hunters, Ircbot represents a classic botnet architecture. Once an endpoint is compromised, the malware silently connects to a predefined IRC server and joins a hidden channel, waiting for commands broadcasted by the botmaster.<br><br><b>Infection Vectors & Threat Hunting</b><br>Ircbot variants are typically delivered via malicious email attachments, drive-by downloads, or dropped by primary initial access brokers. Upon execution, the malware establishes persistence by copying itself into the Windows system folder and modifying the <code>HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run</code> registry key. Threat hunters should actively monitor network traffic for anomalous outbound connections on standard IRC ports (6667, 6668) or unexpected HTTP traffic mimicking IRC protocols. <br><br><b>Forensic Analysis & Impact</b><br>From an incident response perspective, the impact of an Ircbot infection is severe. The botmaster can command the infected host to participate in Distributed Denial of Service (DDoS) attacks, download and execute secondary payloads (such as ransomware or infostealers), or exfiltrate sensitive local data. Forensic analysts should look for dropped executable files in the <code>%SystemRoot%</code> directory and analyze network captures (PCAPs) to extract the C2 server addresses and IRC channel passwords.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1498",
    "T1105",
    "T1547.001",
    "T1071.002",
    "T1059.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1071.002",
      "name": "Application Layer Protocol: File Transfer Protocols",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1498",
      "name": "Network Denial of Service",
      "tactic": "Impact"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint at the network level to prevent it from receiving commands or participating in outbound DDoS attacks.",
    "Implement perimeter blocks on known IRC ports (6667-6669) if they are not required for legitimate business operations.",
    "Perform a deep forensic scan of the Windows Registry to identify and remove the autostart keys created by the bot.",
    "Capture volatile memory to extract potential IRC server IP addresses, channel names, and authentication credentials."
  ],
  "what_to_avoid": [
    "Do not allow the infected endpoint to remain on the corporate network, as it can be used to pivot and scan internal subnets.",
    "Avoid deleting the malicious binary before capturing its hash (SHA-256) for enterprise-wide threat hunting."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}