{
  "family": "gobot",
  "sample_count": 3,
  "category": "trojan",
  "description": "Backdoor:Win32/Gobot is an older, but persistent, Remote Access Trojan (RAT) and Botnet agent that relies on the Internet Relay Chat (IRC) protocol for Command and Control (C2). While IRC-based botnets are considered somewhat legacy compared to modern HTTP/S or peer-to-peer (P2P) architectures, Gobot is still utilized by lower-tier threat actors and script kiddies to assemble botnets for Distributed Denial of Service (DDoS) attacks and cryptocurrency mining.<br><br><b>Understanding Gobot (IRC Botnets)</b><br>To an end-user, a Gobot infection might cause unexplained high CPU usage or slow internet speeds. For a security analyst, Gobot represents a noisy, relatively unsophisticated intrusion. Its reliance on IRC (`T1071.002`) makes it highly visible to Network Intrusion Detection Systems (NIDS) and straightforward to block, provided the network boundary is adequately monitored.<br><br><b>Execution and Botnet Mechanics</b><br>Gobot is typically distributed via drive-by downloads or cracked software installers. Upon execution (`T1204.002`), it establishes persistence, often simply by dropping a copy of itself into the Startup folder or modifying the `Run` registry key (`T1547.001`). The malware then connects to a hardcoded IRC server and joins a specific, hidden channel, waiting for commands from the botmaster. It is capable of receiving commands to download and execute secondary payloads (`T1105`), launch volumetric DDoS attacks (like SYN floods or UDP floods) (`T1498.001`), or act as a proxy for the attacker.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the conscription of the endpoint into a criminal botnet and potential network degradation due to DDoS traffic. Host-based IoCs include the presence of anomalous executables in the `Startup` folder and EDR alerts for known Gobot process signatures. Network IoCs are highly distinct: consistent outbound traffic on standard (TCP 6667) or non-standard ports utilizing the cleartext IRC protocol, often directed to dynamic DNS domains or known bulletproof hosting providers.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1105",
    "T1071.002",
    "T1547.001",
    "T1498.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1071.002",
      "name": "Application Layer Protocol: File Transfer Protocols (Use of IRC for C2)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1498.001",
      "name": "Network Denial of Service: Direct Network Flood",
      "tactic": "Impact"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution",
      "tactic": "Persistence"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint to sever its connection to the IRC command server and halt its participation in DDoS attacks.",
    "Review firewall and IDS logs to identify the IRC server IP address and port; block these enterprise-wide.",
    "Scan the network to identify if other internal endpoints are communicating with the same IRC server.",
    "Remove the persistence mechanisms from the Registry `Run` keys and the Windows Startup folder."
  ],
  "what_to_avoid": [
    "Do not allow outbound IRC traffic (TCP 6667, 6697) on corporate networks unless strictly necessary and explicitly proxied/monitored.",
    "Avoid assuming a single isolated infection; botnets spread aggressively, and finding one Gobot often implies others."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}