INSOMNIA IRC Bot v1.1.3 Manual

Insomnia is another irc bot sold in hecking forums coded in .NET
I m posting the manual here so u can see what it does

INSOMNIA v1.1.3

Table of Contents

1. Summary
2. Core Features
3. Malware Removal
4. SOCKS5
5. DDoS
6. Spreading Modules
7. Topic Generator Explained
8. Complete command list

Summary

Insomnia was developed in Visual Studio 2010 using the C# language. The binary is
compiled under the 2.0 distribution of the .NET Framework. Insomnia was primarily
designed for the botmaster who plans to build a network with machines that have the
.NET framework installed. During development, the infection of newer operating
systems was considered, and Insomnia is fully compatible with Windows 8 Development
Preview at this time, and should work fine on the release builds.

Insomnia has been tested to function on Windows NT based operating systems,
specifically the following:

Windows XP
Windows Server 2003 / R2
Windows Vista
Windows Server 2008 / R2
Windows 7
Windows 8 Development Preview

If Insomnia acquires administrative rights on the target machine, it will install to
HKLM rather than HKCU, allowing it to be executed under all user accounts on the
machine. It will also make use of specific Windows API calls that only function under
elevated permissions, improving the functionality of some malware removal features
such as Ruskill.

Upon execution, Insomnia gathers it’s country location from http://api.wipmania.com.
If for some reason this website can’t be accessed, Insomnia will default to system
locale information.

Insomnia’s nick generation pattern is based on a series of information. Here is a
breakdown:

n{US|XP-32a}dnskifj

The lowercase ‘n’ in the nick signifies that Insomnia has recently been
installed within the past hour, implying that it is most likely a new
installation.
The next part is the GeoIP location of the PC Insomnia is running on. US being
United States.
This is followed by the version of windows (Windows XP 32 bit), and the
lowercase ‘a’ signifies that the bot is running with administrative
privileges. If the bot is only running as a standard user, it will show a
lowercase ‘u’ instead.
The rest of the nick is made up of seven randomly generated characters to
avoid nick collision.

Core Features

Connection Information

Insomnia supports the IRC protocol along with SSL (Secure-Socket-Layer) connections.
SSL is recommended, as the downside to normal IRC connections is that they are easily
recognized. Using normal connections can put Insomnia at risk of detection, while
exposing information that is exchanged on your network.

Insomnia may be compiled to support connections to multiple servers at request. There
is no limit at this time.

Quit Messages

IRC quit messages are decided by listening to WM_QUERYENDSESSION. This lets insomnia
include the reason the process is terminating, if it is related to a Windows session
attempting to close. If the bot process is terminated abnormally or fails to acquire
a reason, it will be the standard ‚Connection reset by peer‛. Currently Insomnia
detects and outputs three types of quit messages:

Windows is shutting down…
Windows is logging off…
Windows is going to sleep…

Registry Persistence

Insomnia actively monitors the registry for changes, by pinvoking a series of Windows
API functions such as RegNotifyKeyChangeValue. If it finds out that its registry key
was modified or deleted, it will fix it immediately.

Core command list

These commands signify features that are found in the basic compile of Insomnia, and
are included in every binary available for purchase, without the addition of separate
modules.

Command
.v
.m on/off
.avinfo
.j #channel
.p #channel
.sort
.unsort
.permsort
.rm
.rc
.ftp
.im
.read URL
.open FILE/URL
.open FILE/URL –h
.dl URL
.dl URL –m
.dl URL –t X

The rest of the commands are discussed in their appropriate sections below. You can find a
complete command list on the very last page of this document.

Description
Outputs version, MD5 hash, process path, registry location.
Toggles mute (blocks all output).
Display current Antivirus/Firewall programs installed. (Vista+)
Joins a channel.
Parts a channel.
Sorts bots into channels based on their country. (#US, #RU, etc).
Parts the sorted channels.
Sorts the bots based on privileges. (#users/#admins).
Completely removes Insomnia from the machine.
Reconnects to IRC after waiting 10 seconds.
Outputs saved FTP credentials on the machine.
Outputs saved IM credentials on the machine.
Reads encrypted topic commands from a remote URL
Opens a URL or file on machine.
Opens a URL or file on the machine but hides the window.
Downloads a file and executes it.
Downloads a file and executes it in memory (.NET files only)
Downloads a file and terminates after X seconds have passed.

Malware Removal

Botkiller

Insomnia includes two types of malware removal commands. Those are as follows:

Description
Runs the standard botkiller module.
Runs the botkiller module that terminates injected bots.

The standard botkiller module works around a counter system. It first scans temporary
folders, including %APPDATA% for any executable files that are currently running. It
then checks if the files have a ‚hidden‛ attribute or not. Other checks are then
performed including checking the registry startup locations. If an executable program
violates a certain number of these checks, it’s safe to consider it ‚possibly
malicious‛, and Insomnia will then terminate it, delete the registry key, and output
and TCP connections associated with that process.

The botkiller module that terminates injected bots uses a series of techniques to
remove nearly all bots that inject into explorer/iexplore.

Both of these commands perform different actions. If you want to give the best effort
to clean a system from other common malware, it’s recommended you run both of these
commands.

Command
.dl URL -r

Description
Starts the download and initiates the Ruskill module on the file.

Ruskill is initiated by calling the download function with the ‘r’ parameter.

Files downloaded with Ruskill enabled will be monitored and information will be
outputted to the Ruskill channel.

Ruskill attempts to discover all files dropped by that malware along with all
registry keys created, and then reverse those changes the next time the PC reboots.
It uses a set of Windows API calls to make this possible, deleting target files after
AUTOCHK but before Windows creates any page files. Administrative rights can affect
how well this feature works.

Ruskill uses API calls similar to those in ngrBot/Autumn/Other Antivirus/File
Assassin software.

DDoS Functionality

Insomnia includes five different methods to initiate distributed denial of service
attacks. Two methods are primarily aimed at exploiting vulnerabilities in the Apache
web server, by consuming all sockets and resources.

While initiating a DDoS command, insomnia will stop all other active DDoS threads
before starting. This helps allocate threads for the new DDoS command while not
consuming too many resources client-side, and saturating the upstream (which may
cause the bot to disconnect temporarily).

Command
.arme HOST TIME
.slow HOST TIME
.layer4 HOST PORT TIME
.layer7 HOST PORT TIME
.udp HOST PORT TIME

Description
Multithreaded
Multithreaded
Multithreaded
Multithreaded
Multithreaded

Apache Remote Memory Exhaustion flood.
Slowloris Flood
Layer4 (SYN) Flood
Layer7 (HTTP GET) Flood
UDP Flood

ARME (Apache Remote Memory Exhaustion)

This method was discovered in late 2011 and is a modified port of the perl script by
Kingcope. Running this with enough connections can actually cause Apache to swap
memory to file system after RAM is consumed, and may result in the process being
terminated as the host system becomes unstable. Higher-end servers or properly
modified/configured Apache installations may not be vulnerable.

Slowloris

This method was developed by RSNAKE and made popular in 2009. This C# port works in
the exact same way but with random user agents, random content length, and random
header data so it's even harder to block from the host machine. It also uses GET and
POST to do the attack which seems to have better results than sticking with just one
method. Slowloris can take a while to consume all the sockets on the host machine,
but it always wins in the end.

This method simply does an HTTP GET request on the index page, and downloads the page
data. Works good in high numbers. If you are focusing attacks on Apache webservers
with small numbers, then the methods above are recommended.

This method uses SynSockets to flood the server with TCP connections. It's not too
hard to block server-side and is an older method, but if a server is vulnerable then
it's highly effective.

This flood is ideal for neighborhood connections or larger servers if you have the
manpower to do it, flooding with UDP packets containing random data.

SOCKS5 Module

Description
Attempts to start the SOCKS5 server and report back with results.

This command will signal Insomnia to start the SOCKS5 server and attempt to test it’s
connection. If everything worked out with no errors, it will output the IP:PORT
USER:PASS to IRC so you are able to use them. It also attempts to map ports with the
included uPnP library. If it succeeds it will signify it in the output.

<n{US|W7-64u}dnsmdks> [SOCKS]: Attempting to start SOCKS server…
<n{US|W7-64u}dnsmdks> [SOCKS]: Listening on [127.0.0.1:9001] [user:pass] [uPnP=yes]

Spreaders

USB .LNK Spread

This module runs automatically. Upon initial bot execution it scans for USB Removable
Media. When found, it scans the drive for folders, creating appropriate LNK files and
hiding the originals. It also listens for new devices and infects them as they are
added. This module will output to IRC after a successful infection.

<n{US|W7-64u}dnsmdks> [USB]: Completed LNK spread on (G:) with 7 files.

Twitter

Command
.twitter “msg”

This module queries the chrome grabber for accounts that fit twitter.com, and
attempts to login. If the login was a success, it proceeds to update the status to
the specified message. This does NOT use the Twitter API and does NOT require OAuth.
It simulates the http web requests made by a real browser to login to twitter and
update the status.

<n{US|W7-64u}dnsmdks> [TWITTER]: Status updated. (user@email.com => ‚msg‛ )

Description
Updates twitter status on the system.

Facebook

Command
.facebook “msg”

This module queries the chrome grabber for accounts that fit facebook.com, and
attempts to login. If the login was a success, it proceeds to gather information
about the Facebook account required to login to the Facebook chat system via the XMPP
protocol. Once the data is acquired, resources are disposed of and a chat session is
initiated with the user's credentials. Once the module has access to the chat system,
it will begin to send the message you provided with the given options.

You can specify to send to only online/offline friends with the parameters above. You
can also specify to send to a certain number of friends (the friends will be randomly
chosen), by using the –f parameter followed by a number of your choice.

<n{US|W7-64u}dnsmdks> [FACEBOOK]: Spreader module started. (user@email.com => ‚msg‛)

Description
Starts facebook spread module with specified message.

Topic Generator

Insomnia comes with a topic generation utility to help you secure your topic commands
from prying eyes, and simplify commands that should be performed in sequential order.

To use, please run the topic generator that was included with your purchase. Each
customer gets a topic generator that encrypts based on your unique customer ID, so no
one else with the topic generator could interact with your binary, compiled with the
same customer ID.

To use the Topic Generator, simply type in the commands exactly how you would in IRC,
then click Add. The topic generator will add them to the listview, automatically
parsing and detecting the parameters.

When you are all finished, click Generate, and use the topic in IRC. If a topic is
too big for the IRC topic character limit, you can host the encrypted commands and
set the topic to the encrypted version of .read http://yoururl.com/commands.txt

Complete Command List

.m on/off
.avinfo

.j #channel
.p #channel
.sort

.unsort
.permsort
.rm
.rc
.ftp
.im
.read URL
.open FILE/URL
.open FILE/URL –h
.dl URL
.dl URL –m

.dl URL –t X

.dl URL –r

.socks
.speedtest URL
.bk
.bk –i
.getadmin

.acc keyword

.arme HOST TIME
.slow HOST TIME
.layer4 HOST PORT TIME
.layer7 HOST PORT TIME
.udp HOST PORT TIME

Description
Outputs version, MD5 hash, process path, registry
location.
Toggles mute (blocks all output).
Display current Antivirus/Firewall programs installed.
(Vista+)
Joins a channel.
Parts a channel.
Sorts bots into channels based on their country. (#US,
#RU, etc).
Parts the sorted channels.
Sorts the bots based on privileges. (#users/#admins).
Completely removes Insomnia from the machine.
Reconnects to IRC after waiting 10 seconds.
Outputs saved FTP credentials on the machine.
Outputs saved IM credentials on the machine.
Reads encrypted topic commands from a remote URL
Opens a URL or file on machine.
Opens a URL or file on the machine but hides the window.
Downloads a file and executes it.
Downloads a file and executes it in memory (.NET files
only)
Downloads a file and terminates after X seconds have
passed.
Downloads a file with Ruskill and outputs to Ruskill
channel.
Attempts to start SOCKS5 server
Download the URL and output speed information.
Standard botkiller module
Injected botkiller module
Added by request. Prompts UAC for admin, if acquires,
restarts.
Chrome grabber based on url keyword. Leave keyword blank
for all.
Multithreaded Apache Remote Memory Exhaustion flood.
Multithreaded Slowloris Flood
Multithreaded Layer4 (SYN) Flood
Multithreaded Layer7 (HTTP GET) Flood
Multithreaded UDP Flood