Technical Details
New versions, or variants, of the worm appeared so rapidly that the Agobot family quickly grew larger than other bot families. Other bots in the Agobot family are Phatbot and Forbot. Agobot now has several thousand variants. The majority of the development force behind Agobot is targeting the Microsoft Windows platform; as a result the vast majority of the variants are not Linux compatible. In fact the majority of modern Agobot strains must be built with Visual Studio due to its reliance on Visual Studio's SDK and Processor Pack. An infectious Agobot can vary in size from ~500kbyte to ~12kbyte depending on features, compiler optimizations and binary modifications.
A module written for one member in the Agobot family can usually be ported with ease to another bot. This mix-matching of modules to suit the owner's needs has inspired many of the worm's variants.
Most Agobots have the following features:
- Password Protected IRC Client control interface
- Remotely update and remove the installed bot
- Execute programs and commands
- Port scanner used to find and infect other hosts
- DDoS attacks used to takedown networks
The Agobot may contain other features such as:
- Packet sniffer
- Keylogger
- Polymorphic code
- Rootkit installer
- Information harvest
- Email Addresses
- Software Product Keys
- Passwords
- SMTP Client
- Spam
- Spreading copies of itself
- HTTP client
- Click Fraud
- DDoS Attacks
Read more about this topic: Ares.exe
Famous quotes containing the words technical and/or details:
“In effect, to follow, not to force the public inclination; to give a direction, a form, a technical dress, and a specific sanction, to the general sense of the community, is the true end of legislature.”
—Edmund Burke (1729–1797)
“Then he told the news media
the strange details of his death
and they hammered him up in the marketplace
and sold him and sold him and sold him.
My death the same.”
—Anne Sexton (1928–1974)