dorkbot-hunting-zombies-in-latin-america.pdf

This ESET Latin America report analyzes Win32/Dorkbot (Ngrbot), an IRC-controlled worm/botnet that propagated via LNK/USB autorun and social engineering to steal credentials and spread phishing campaigns across Latin America in 2011–2012; it details variants, distribution (up to ~80,000 unique connections tracked), technical capabilities (API hooks, process injection, IRC C2, update and phishing lists), sample IOCs, and region-specific social-engineering campaigns.