Need help of a mirc/irc script expert
reddit / irc

----------------------------------------------------------------------
_c0rle0ne_ · 2014-10-27 09:46

Today one of my VPS was infected by some kind of irc script. Files
contained are port scanner and mirc.exe with some scripts which I
don't understand. I've removed the files from the VPS but need to know
how this compilation works. Any script expert around who can give an
hour to test the kit and shed some light? SkyPe would be nice. Thnx

----------------------------------------------------------------------
KindOne · 2014-10-27 13:23

pastebin the scripts?

----------------------------------------------------------------------
L4YER · 2014-10-27 22:19

^^^ This

----------------------------------------------------------------------
myg0tchrono · 2014-10-27 23:03

sorry mate just testing my old GTbot mod by rain,
Panic Attack 3 with targa.exe u mad?

----------------------------------------------------------------------
_c0rle0ne_ · 2014-10-28 06:51

thnx for replying. here's the pastebin link. all 3 scripts there and
the file list screenshot link on top.

http://pastebin.com/UEVXGwnW

----------------------------------------------------------------------
_c0rle0ne_ · 2014-10-29 04:02

c'mon guys ... i see 10 views but no reply here :(

----------------------------------------------------------------------
KindOne · 2014-10-31 13:29

Better yet, put all those files from that screenshot into a password
protected archive and share the link/password.

Looks like it sets a random nick/name/email, connects to some irc
server that is inside that "dop" file. It seems to look to see if vnc
is running, then kills it, then I guess it starts its own copy. It
also looks for Filezilla with that "dfind.exe" that is executed via
the script. Without ALL the files, can't really tell what is going on,
I want to poke at this inside a VM to see what all it can do.

Also, give it a few days/weeks or whatever. My understanding of mIRC
scripting is a bit lacking in some areas.

----------------------------------------------------------------------
Forence · 2014-12-05 23:02

It's a bot full of tools to take control of your server, not unlike a
Trojan. Change your password and watch it diligently.