{
  "family": "ngrbot",
  "sample_count": 110,
  "category": "advanced_threat",
  "description": "Worm:Win32/Ngrbot (widely known as Dorkbot) is a massive, highly resilient IRC-controlled botnet agent and worm historically responsible for massive DDoS attacks, widespread credential theft, and the aggressive distribution of secondary malware payloads.<br><br><b>Understanding Ngrbot (Dorkbot)</b><br>To the end-user, a Dorkbot infection might result in a slightly sluggish PC or the sudden hijacking of their social media accounts. For incident responders, it is a severe, multi-faceted threat. Operating at its peak in the mid-2010s, Dorkbot infected millions of machines globally. It is designed to be highly modular, allowing its operators (the 'Dorkbot crew') to dynamically update its capabilities, launch massive DDoS attacks, or lease access to the botnet to other cybercriminals.<br><br><b>Execution and Evasion Strategies</b><br>Dorkbot primarily propagates via social engineering on messaging platforms (Skype, Facebook Messenger) by sending malicious links to the victim's contacts, or via infected USB drives (exploiting the Windows AutoRun feature). Upon execution, it injects its core payload into legitimate processes (like <code>explorer.exe</code> or <code>cmd.exe</code>) to evade detection. It establishes a covert connection to an IRC (Internet Relay Chat) server to receive commands. Crucially, Dorkbot employs API hooking to steal passwords from a massive list of applications (browsers, FTP clients, gaming platforms) and intercepts DNS requests to block access to security vendor websites.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total endpoint compromise and participation in global cybercrime. Threat hunters should look for anomalous outbound IRC traffic (TCP port 6667 or custom ports) originating from injected system processes. The presence of hidden files on USB drives and unexpected modifications to the Windows HOSTS file are classic Dorkbot IoCs. EDR platforms frequently flag Dorkbot for its aggressive API hooking.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1562.001",
    "T1055",
    "T1498",
    "T1091",
    "T1056.004"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1091",
      "name": "Replication Through Removable Media",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1056.004",
      "name": "Input Capture: Credential API Hooking",
      "tactic": "Credential Access"
    },
    {
      "id": "T1498",
      "name": "Network Denial of Service",
      "tactic": "Impact"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint to sever the connection to the IRC C2 server, halting DDoS participation and data exfiltration.",
    "Force a global password reset for all user accounts, as Dorkbot systematically harvests credentials from all installed applications.",
    "Capture a full memory image to extract the injected Dorkbot payload and identify the specific IRC server and channel it was joined to.",
    "Assume total endpoint compromise; perform a clean OS rebuild, as Dorkbot frequently downloads other severe malware families."
  ],
  "what_to_avoid": [
    "Do not insert any USB drives into the infected machine during triage; Dorkbot will immediately infect the drive to spread laterally.",
    "Avoid relying solely on manual file deletion; the injected processes will instantly recreate the persistence mechanisms."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}