Ngrbot

Overview

Worm:Win32/Ngrbot (widely known as Dorkbot) is a massive, highly resilient IRC-controlled botnet agent and worm historically responsible for massive DDoS attacks, widespread credential theft, and the aggressive distribution of secondary malware payloads.

Understanding Ngrbot (Dorkbot)
To the end-user, a Dorkbot infection might result in a slightly sluggish PC or the sudden hijacking of their social media accounts. For incident responders, it is a severe, multi-faceted threat. Operating at its peak in the mid-2010s, Dorkbot infected millions of machines globally. It is designed to be highly modular, allowing its operators (the 'Dorkbot crew') to dynamically update its capabilities, launch massive DDoS attacks, or lease access to the botnet to other cybercriminals.

Execution and Evasion Strategies
Dorkbot primarily propagates via social engineering on messaging platforms (Skype, Facebook Messenger) by sending malicious links to the victim's contacts, or via infected USB drives (exploiting the Windows AutoRun feature). Upon execution, it injects its core payload into legitimate processes (like <code>explorer.exe or cmd.exe) to evade detection. It establishes a covert connection to an IRC (Internet Relay Chat) server to receive commands. Crucially, Dorkbot employs API hooking to steal passwords from a massive list of applications (browsers, FTP clients, gaming platforms) and intercepts DNS requests to block access to security vendor websites.

Indicators of Compromise & Impact
The impact is total endpoint compromise and participation in global cybercrime. Threat hunters should look for anomalous outbound IRC traffic (TCP port 6667 or custom ports) originating from injected system processes. The presence of hidden files on USB drives and unexpected modifications to the Windows HOSTS file are classic Dorkbot IoCs. EDR platforms frequently flag Dorkbot for its aggressive API hooking.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1056.004: Monitor for unauthorized keylogging, screen capturing, or web browser API hooking. Deploy EDR to detect API hooking.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_NGRBOT {
    meta:
        description = "Detects Ngrbot (advanced_threat)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "ngrbot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Ngrbot Activity
id: 84c93d1de9b7a8f1f5e2050616a53ab1
status: experimental
description: Detects generic indicators of the ngrbot malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*ngrbot*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately isolate the endpoint to sever the connection to the IRC C2 server, halting DDoS participation and data exfiltration.
2. Force a global password reset for all user accounts, as Dorkbot systematically harvests credentials from all installed applications.
3. Capture a full memory image to extract the injected Dorkbot payload and identify the specific IRC server and channel it was joined to.
4. Assume total endpoint compromise; perform a clean OS rebuild, as Dorkbot frequently downloads other severe malware families.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not insert any USB drives into the infected machine during triage; Dorkbot will immediately infect the drive to spread laterally.
2. Avoid relying solely on manual file deletion; the injected processes will instantly recreate the persistence mechanisms.

References & External Analysis

• Search "ngrbot" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: advanced_threat)

Explore other malware families in the same category:

• Bruteforce
• Mypcbackup
• Wsgame
• Cnbtech
• Wpakill

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/ngrbot.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.