Jan 22, 2013 06:58 PM
(This post was last modified: Jan 30, 2013 01:48 PM by Break.)
Information:
Apollo is a Windows IRC bot Written in C++. It uses IRC with the option of SSL to communicate with the C&C (command-and-control server). As a self-defense, Apollo also has rootkit to hide its presence on the created files and registry entries by intercepting Win32 API calls. Apollo performs a system wide hook to inject itself into the whole process. It installs to the users computer with a randomly generated filename and runs the file at startup.
Features:
User-Mode Rootkit
-Hooks NtQueryDirectoryFile, NtEnumerateValueKey, and others to keep Apollo's file and registry entries hidden from users and other malware.
Ruskill
-Downloads and runs file of the masters choice and removes it when rebooted.
Proactive Defense
-Monitors APIs to stop the installtion of other malware on the system.
DNS Redirector
-Blocks AV update sites and other domains of your choice.
DDoS
-Slowloris (Apache flood), UDP Flood (Rapidly sends UDP packets to specific IP), and SYN Flood (Rapidly sends SYN requests to specific IP) good for webservers.
Form Grabber
-Monitors POST requestes from web browsers capturing emails and passwords.
FTP Grabber
-Captures FTP details inputed by the user.
USB Spread
-Infects USB drives using .lnk and autorun.
Skype Spread
-Sends messages to infected users skype contacts. MSN is being ported to skype for those who didn't know.
MSN Spread
-Sends Messages to infected users msn contacts without the infected user knowing. Msn Will still be working in China after the msn to skype mitigation.
HTTP Spread
-Replaces status updates, chat messages, and private messages on Twitter and Facebook.
Project Status
Spoiler (Click to View)
Apollo is a Windows IRC bot Written in C++. It uses IRC with the option of SSL to communicate with the C&C (command-and-control server). As a self-defense, Apollo also has rootkit to hide its presence on the created files and registry entries by intercepting Win32 API calls. Apollo performs a system wide hook to inject itself into the whole process. It installs to the users computer with a randomly generated filename and runs the file at startup.
Features:
User-Mode Rootkit
-Hooks NtQueryDirectoryFile, NtEnumerateValueKey, and others to keep Apollo's file and registry entries hidden from users and other malware.
Ruskill
-Downloads and runs file of the masters choice and removes it when rebooted.
Proactive Defense
-Monitors APIs to stop the installtion of other malware on the system.
DNS Redirector
-Blocks AV update sites and other domains of your choice.
DDoS
-Slowloris (Apache flood), UDP Flood (Rapidly sends UDP packets to specific IP), and SYN Flood (Rapidly sends SYN requests to specific IP) good for webservers.
Form Grabber
-Monitors POST requestes from web browsers capturing emails and passwords.
FTP Grabber
-Captures FTP details inputed by the user.
USB Spread
-Infects USB drives using .lnk and autorun.
Skype Spread
-Sends messages to infected users skype contacts. MSN is being ported to skype for those who didn't know.
MSN Spread
-Sends Messages to infected users msn contacts without the infected user knowing. Msn Will still be working in China after the msn to skype mitigation.
HTTP Spread
-Replaces status updates, chat messages, and private messages on Twitter and Facebook.
Project Status
Spoiler (Click to View)
![[Image: 0aWhiLm.png]](https://i.imgur.com/0aWhiLm.png)



