{
  "family": "wootbot",
  "sample_count": 2,
  "category": "advanced_threat",
  "description": "Worm:Win32/Wootbot (also known as W32.Wootbot) is a classic, historically significant network worm and IRC botnet agent that was highly prevalent in the mid-2000s. It was designed to rapidly self-propagate across networks by exploiting known Windows vulnerabilities and weak network shares, subsequently connecting the infected machines to an attacker-controlled IRC (Internet Relay Chat) server to receive commands for DDoS attacks or further malware distribution.<br><br><b>Understanding Wootbot (Classic IRC Botnets)</b><br>To an end-user, a Wootbot infection might cause system slowdowns or network latency. For a security operations center, Wootbot represents the architecture of early, noisy botnets. Unlike modern, stealthy botnets using custom protocols or Tor, Wootbot relied on standard IRC channels (`T1071.001`), making its command-and-control traffic relatively easy to spot but incredibly disruptive due to its aggressive worm-like spreading.<br><br><b>Execution and Propagation Mechanics</b><br>Wootbot spreads aggressively. Once executed, it copies itself to the Windows System directory and establishes persistence via the `Run` registry keys (`T1547.001`). It then scans the local subnet and the broader internet for machines vulnerable to specific exploits (e.g., LSASS or DCOM vulnerabilities, prominent in Windows XP/2000) or open network shares (`T1210`, `T1105`). It uses a hardcoded list of weak passwords to attempt brute-force access to IPC$ and admin shares (`T1110.001`). Once successfully copied to a new machine, it connects to a predefined IRC server, joins a specific channel, and waits for commands from the botmaster, which often included launching UDP/TCP flood attacks (`T1498`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the rapid spread of the infection across an enterprise network and participation in DDoS attacks. Network IoCs are highly distinct: excessive, aggressive port scanning (e.g., TCP 135, 139, 445) originating from infected hosts, and persistent outbound TCP connections to external IRC servers (typically on port 6667). Host-based IoCs include the presence of unexpectedly named executables in the System32 directory and corresponding Registry Run key entries.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1210",
    "T1498",
    "T1071.001",
    "T1110.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1210",
      "name": "Exploitation of Remote Services (Spreading via known Windows vulnerabilities)",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols (Using IRC for Command and Control)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1498",
      "name": "Network Denial of Service (Executing DDoS commands received via IRC)",
      "tactic": "Impact"
    },
    {
      "id": "T1110.001",
      "name": "Brute Force: Password Guessing (Brute-forcing network shares for lateral movement)",
      "tactic": "Credential Access"
    }
  ],
  "containment_steps": [
    "Immediately segment infected VLANs to halt the aggressive lateral spreading of the worm.",
    "Block outbound IRC traffic (TCP port 6667 and known alternative IRC ports) at the perimeter firewall to sever the C2 connection.",
    "Ensure all systems are fully patched against the specific vulnerabilities (e.g., MS04-011, MS03-026) the worm is actively exploiting.",
    "Disable unnecessary administrative network shares and enforce strong password policies to defeat the brute-force propagation."
  ],
  "what_to_avoid": [
    "Do not attempt to clean one machine at a time on an unsegmented network; the worm will continually re-infect cleaned machines.",
    "Avoid relying solely on signature-based AV for cleanup, as the botmaster may update the payload via the IRC channel."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}