Skip to content
MalwareWiki

Botnet

Sockbot

Sockbot is a customized and in Go written fork of the Ligolo reverse tunneling open-source tool.

Sockbot is a Windows botnet.

Background

Sockbot is a Go-based variant derived from the open-source Ligolo reverse tunneling utility. The actors behind it reworked the original source, introducing changes such as added execution checks and hardcoded values. Ligolo: https://github.com/sysdream/ligolo

Source: Malpedia (Fraunhofer FKIE).