Benign Download

script1.ini

mIRC privmsg reports client addressmIRC writes PRIVMSG to all clone sockets
SHA-256f13b2020f6456a3837a5d385425d130061315503bad719f4840ff79c558e01b4
MaleculeO(C)Md

Evidence

mIRC writes PRIVMSG to all clone sockets lines 3–5
3:18… clone* nick $r(a,z) $+ $r(a,z) $+ $r(a,z) $+ $r(a,z) $+ $r(a,z) $+ $r(a,z)
4n2= /timer287 3 2 sockwrite -n clone* privmsg $$1 : $+ $chr(1) $+ PING $ctime $+ $chr(1) | sockwrite -n clone* privmsg $$1 : $+ $chr(1) $+ VERSION $+ $chr(1)
5n3= /timer289 3 2 sockwrite -n clone* privmsg $$1 : $+ $chr(1) $+ PING $ctim …
mIRC privmsg reports client address lines 15–19
15:26… nick $r(a,z) $+ $r(a,z) $+ $r(a,z) $+ $r(a,z) $+ $r(a,z) $+ $r(a,z)
16n14= sockwrite -n clone* privmsg $$1 : $+ $chr(001) $+ DCC CHAT chat $longip($ip) 4501
17n15= sockwrite -n clone* privmsg $$1 : $+ $chr(001) $+ DCC CHAT chat $longip($ip) 4501
18n16= sockwrite -n clone* privmsg $$1 : $+ $chr(001) $+ DCC CHAT chat $longip($ip) 4501
19n17= …

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.