Dorkbot

(Botnet) Link to the old Wiki page : [1] / Google search: [2]

Dorkbot
Alias	Ngrbot
Group	DDoSing
Parent
Sibling
Family
Relations	Variants: Sibling of: Parent of: Distribution of: Campaigns:
Target	Microsoft Windows
Origin
Distribution vector
UserAgent
CCProtocol	IRC (Centralized)
Activity	2011 /
Status
Language
Programming language
Operation/Working group

Introduction

Dorkbot appelé également Ngrbot représente un réseau de machines zombies infectées par le cheval de Troie du même nom. Il est notamment connu pour ses modes de réplications divers tels que la messagerie instantané, les réseaux sociaux (notamment Facebook) et les périphériques amovibles.

Features

• Bitcoin mining

• USB vector

• Skype vector

• File download

• SYN flood

• UDP flood

• Slowloris

• DNS blocking of AV companies

• Geolocalisation

• Twitter password theft

• Facebook password theft

• Bebo password theft

• Friendster password theft

• Paypal password theft

• Netflix password theft

• Sendspace password theft

• IM password theft

Publications

	Author	Editor	Year
A chat with NGR Bot	Chong Rong Hwa	InfoSec Institude	2012
An analysis of Dorkbot’s infection vectors (part 2)	Horea Coroiu	Microsoft Malware Protection Centre	2012
Analysis of ngrBot	Kimberly	StopMalvertising	2011
Dorkbot: conquistando Latinoamérica	Pablo Ramos	ESET	2012
MSRT March 2012: breaking bad	Rex Plantado	Microsoft	2012
NGRBot spreads via chat	Niranjan Jayanand	McAfee	2012
Ngrbot steals information and mine Bitcoins	SonicWALL UTM research team	SonicWALL	2011
The Dorkbot rises	Bernadette Irinco	Trend Micro	2012