Benign Download

backdoor

mIRC INI enables its DDE command serverINI contains mIRC remote-script list section
SHA-25685827b76c3bc411771ff069e01ffbb455f7b9a44db2ce4a29afed869ba13164b
MaleculeH(Db)Md

Evidence

mIRC INI enables its DDE command server lines 53–68
53:44… IMN.EXE
54finger=finger.txt
55urls=urls.ini
56addrbk=addrbk.ini
57
58[dde]
59ServerStatus=on
60ServiceName=mIRC
⋯8 lines
INI contains the mIRC client identity section lines 69–89
⋯4 lines
73
74
75[mirc]
76nick=hershey
77host=irc.tu-pac.netSERVER:irc.tu-pac.net:9876
78email=%email
79anick=KuzuM
⋯10 lines
INI contains mIRC remote-script list section lines 172–188
⋯5 lines
177n0=alias1.ini
178
179[rfiles]
180n0=remote.ini
181n1=remote.ini
⋯7 lines

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.