The Agobot.FO variant was found in March 2004 and became
relatively widespread. This backdoor has functionality similar to
its previous variants, but this variant is more powerful than
earlier versions. Generic description of Agobot and information
on previous Agobot variants can be found here:
The neccessary patches can be downloaded from the pages above
under the "Patch availability" section.
F-Secure Anti-Virus can detect and disable (rename or delete)
Agobot backdoor files, however if a system is already infected,
the special disinfection tool is required to get rid of
infection.
F-Secure provides the special disinfection utility for all known
by March 2004 versions of Agobot backdoor. You can download the
disinfection tool from our ftp site:
First of all, this new variant has 'Phatbot3' identifier and
there are a few 'phat' string in its body. This may indicate that
this version was not made by the original Agobot backdoor author,
who calls himself TheAgo, but by a different person/group who got
the source code of this backdoor.
The backdoor's file is a PE executable 115738 bytes long
compressed with PE-Diminisher file compressor. The unpacked
file's size is over 245 kilobytes.
Installation to system
The Agobot.FO backdoor copies itself as NVCHIP4.EXE file to
Windows System folder and creates startup keys for this file in
System Registry:
This allows the backdoor's file to start with every Windows
session. On Windows NT-based systems the backdoor can start as a
service.
Creating an IRC bot
The backdoor is controlled via an IRC bot, that is created on a
certain IRC server in a specific channel when the backdoor's file
is active. The following oprerations can be performed with via a
bot:
* display bot info
* terminate bot
* resolve host/ip by DNS
* start an executable file
* display current bot ID
* change a nickname of a bot
* open any file
* remove bot
* remove bot if it doesn't match certain criteria
* generate random name for a bot
* get bot status
* display system info
* check bot's uptime
* quit the bot
* flush bot's DNS cache
* delete shares and disable DCOM
* re-create shares and enable DCOM
* run a command on a system
* repeat the last action
* enable or disable shell handler
* list all available commands
* redirect HTTPS traffic
* redirect HTTP traffic
* redirect traffic on certian sockets
* load a plugin (unloading is not supported yet)
* change IRC server that the bot connects to
* reconned to IRC server
* send a raw message to IRC server
* send a private message
* part a channel
* print network info
* change channel mode
* gets host info
* join a specified channel
* checks if working from .edu domain
* disconnect from IRC
* enable sniffers (http, ftp, irc, bot)
* spam AOL channel
* enable IdentD server
* save/load configuration settings to a file
* accesses certain variables in configuration file
* enable/disable starting as a service
* adds/deletes autostart key in the Registry
* execute command if certain conditions are met
* download and execute a file from an ftp server
* update the bot from an ftp server
* download a file from ftp server
* update the bot from http server
* download a file from http server
* visit a specified URL
* log off current user
* shutdown a computer
* reboot a computer
* kill specified process
* list all processes
Scanning for vulnerable computers
The backdoor can scan subnets for exploitable computers and send
a list of their IPs to the bot operator. The scan is performed on
ports 80, 135 and 445 for RPC/DCOM (MS03-026), RPC/Locator
(MS03-001) and WebDAV (MS03-007) vulnerabilities. The backdoor
can also scan for computers infected with MyDoom worm (port
3127), Bagle worm (port 2745) and also for computers where
DameWare remote system management software is installed (port
6129).
Performing a DDoS attack
The backdoor can perform the following types of DDoS (Distributed
Denial of Service) attacks:
* HTTP flood
* SYN flood
* UDP flood
* ICMP flood
When performing a DDoS attack, the backdoor uses 33 unique client
identifiers including Mozilla, Wget, Scooter, Webcrawler and
Google bot.
The backdoor sends 256000 bytes of random data to the following
websites and checks the response times:
The bot can harvest e-mail addresses. It has the functionality to
read user's Address Book and send the list of e-mail addresses to
the bot operator.
Obtainint Registry info
The backdoor has the functionality to obtain System Registry info
from an infected computer. This is a new feature for Agobot
backdoor. Information obtained from the Registry can give a
hacker a full overview of an infected system.
Spreading to local network
Agobot backdoor can scan computers on local network and copy
itself there. The scan is initiated by a remote hacker. When
spreading to local network, Agobot.FO probes the following
shares:
admin$
c$
d$
e$
print$
c
Agobot.FO tries to connect using the following account names:
Administrator
Administrateur
Coordinatore
Administrador
Verwalter
Ospite
kanri
kanri-sha
admin
administrator
Default
Convidado
mgmt
Standard
User
Administrator
administrador
Owner
user
server
Test
Guest
Gast
Inviter
a
aaa
abc
x
xyz
Dell
home
pc
test
temp
win
asdf
qwer
OEM
root
wwwadmin
login
owner
mary
admins
computer
xp
OWNER
mysql
database
teacher
student
When connecting, Agobot.FO uses the following passwords:
103015
admin
Admin
password
Password
1
12
123
1234
!@#$
asdfgh
!@#$%
!@#$%^
!@#$%^&
!@#$%^&*
WindowsXP
windows2k
windowsME
windows98
windoze
hax
dude
owned
lol
ADMINISTRATOR
rooted
noob
TEMP
share
r00t
ROOT
TEST
SYSTEM
LOCAL
SERVER
ACCESS
BACKUP
computer
fucked
gay
idiot
Internet
test
2003
2004
backdoor
whore
wh0re
CNN
pwned
own
crash
passwd
PASSWD
devil
linux
UNIX
feds
fish
changeme
ASP
PHP
666
BOX
Box
box
12345
123456
1234567
12345678
123456789
654321
54321
111
000000
00000000
11111111
88888888
pass
passwd
database
abcd
oracle
sybase
123qwe
server
computer
Internet
super
123asd
ihavenopass
godblessyou
enable
xp
2002
2003
2600
0
110
111111
121212
123123
1234qwer
123abc
007
alpha
patrick
pat
administrator
root
sex
god
foobar
a
aaa
abc
test
temp
win
pc
asdf
secret
qwer
yxcv
zxcv
home
xxx
owner
login
Login
Coordinatore
Administrador
Verwalter
Ospite
administrator
Default
administrador
admins
teacher
student
superman
supersecret
kids
penis
wwwadmin
database
changeme
test123
user
private
69
root
654321
xxyyzz
asdfghjkl
mybaby
vagina
pussy
leet
metal
work
school
mybox
box
werty
baby
porn
homework
secrets
x
z
qwertyuiop
secret
Administrateur
abc123
password123
red123
qwerty
admin123
zxcvbnm
poiuytrewq
pwd
pass
love
mypc
mypass
pw
If the worm succeeds connecting to the above listed shares, it
copies itself to a remote share and attempts to start that file
as a service. The alternative way of infecting a remote host is
to create a scheduled task on a remote computer that will start
the backdoor's file.
Teminating processes of security and anti-virus programs
Agobot.FO has a huge list of process file names hardcoded in its
body. The backdoor tries to terminate processes that have the
following names:
This functionality allows the backdoor to successfully disable
anti-virus and security software that can not detect this
backdoor before it's file is started. In most cases special tools
are required to clean a computer infected with this backdoor.
Additionally the backdoor tries to terminate processes that
belong to different malware:
Agobot.FO has the functionality to steal CD keys from the
following games:
Unreal Tournament 2003
The Gladiators
Soldiers Of Anarchy
Shogun Total War: Warlord Edition
Need For Speed: Underground
Need For Speed: Hot Pursuit 2
NHL 2003
NHL 2002
Nascar Racing 2003
Nascar Racing 2002
Medal of Honor Allied Assault: Spearhead
Medal of Honor Allied Assault: Breakthrough
Medal of Honor Allied Assault
James Bond 007: Nightfire
Industry Giant 2
IGI2: Covert Strike
Hidden And Dangerous 2
Half-Life
Gunman Chronicles
Global Operations
Freedom Force
FIFA 2003
FIFA 2002
Counter-Strike
Command and Conquer: Tiberian Sun
Command and Conquer: Red Alert2
Command and Conquer: Generals: Zero Hour
Command and Conquer: Generals
Black and White
Battlefield 1942: The Road To Rome
Battlefield 1942: Secret Weapons Of WWII
Battlefield 1942
This variant of Agobot also has the functionality to steal
Windows Product ID.
![](/images/pixel.gif"){kind=tracking}
