Latest wave of spam

PingBad · Posted: Aug 09, 2009 2:04am Post subject: Latest wave of spam

Lately, I have noticed a spambot making its way around a few of the networks I frequent (one of which is indexed here, but I shall not name it) offering mIRC with free registration and a "handy script". Upon examining (and virus scanning) the rar file on offer, the bot seems to have helped the cause for fighting abuse of IRC... in the root of the rar file is a handy little file named "IRCproxys.txt" which contains a veritable list of IPs (and ports) it can use to connect to your network with - how convenient Smile

For now, it uses the same download link, but after conferring with a trusted IRC colleague of mine, it appears it uses a new link when it starts noticing that its current one is getting blocked/banned.

As for the script itself, upon a brisk examination it appears to be a flood-type script using raw socketry as well as an mIRC script-driven psyBNC clone. I'll post more as I find out more - watch this space Smile

For you admins and irc operators out there hoping to prevent this bot from spamming itself further (it mentions the link in it's first message upon joining, and then again when it parts), here's the link for you to filter:

Jobe · Posted: Aug 09, 2009 2:58am Post subject: Re: Latest wave of spam

PingBad · Posted: Aug 09, 2009 3:16am Post subject: Re: Latest wave of spam

PingBad · Posted: Aug 09, 2009 3:41am Post subject:

Ok, when the spambot connects to a network, the first thing it does is try to register with NickServ (if you're using AuthServ or the like, it doesn't account for this) with the password "w33dz00" and an email address fitting the regex pattern ([a-z]{7})@live.ca - this is hard coded into the bot's source so spamfiltering the password and that email address would certainly curb it no matter what advertising text or URL it uses to propogate

PingBad · Posted: Aug 09, 2009 4:23am Post subject:

This bot also has two nicks on notify/watch:

indep_
Independent (with note: Author)

When it receives notification about either being online, the bot will notice the nick with the following:

nenolod · Idler Joined: 23 Jan 2004 Posts: 357 Location: A box!

it is just the same independent spam as discussed on irc-security...

maddog906 · Lurker Joined: 08 Mar 2005 Posts: 164

i see you got new ones /spamfilter add cpnNPqdat gline - Spammer Register mIRC FREE and Get a nice little script
try this too /spamfilter add cpnNPqdat gline - Spammer /!\ Register mIRC FREE and Get a nice little script
and this /spamfilter add cpnNPqdat gline - Spammer http://hyperfileshare.com
and this one /spamfilter add cpnNPqdat gline - - h[^a-z]{0,}y[^a-z]{0,}p[^a-z]{0,}e[^a-z]{0,}r[^a-z]{0,}f[^a-z]{0,}i[^a-z]{0,}l[^a-z]{0,}e[^a-z]{0,}s[^a-z]{0,}s[^a-z]{0,}h[^a-z]{0,}a[^a-z]{0,}r[^a-z]{0,}e[^a-z]{0,}.+c[^a-z]{0,}o[^a-z]{0,}m

(i am normaly up to date on this but i was on holiday and still will be for the next two weeks)

Trixar_za · Posted: Aug 09, 2009 5:08pm Post subject:

PingBad · Posted: Aug 09, 2009 8:14pm Post subject:

Willaim · Idler Joined: 27 Jun 2003 Posts: 323 Location: IRC

Since PB isn't replying to my IRC PMs..

Anyone know why this wouldn't work?

./spamfilter add p gline 3d Independent_Worm register w33dz00 ([a-z]{7})@live.ca

PingBad · Posted: Aug 09, 2009 10:13pm Post subject:

Jobe · Posted: Aug 10, 2009 1:41am Post subject:

I will note there is also "$encode()"'ed details where the bot connects to a C&C server+channel, or at least there was in older versions. Havnt got a copy of this version to check anymore.

PingBad · Posted: Aug 10, 2009 4:28am Post subject:

Willaim · Idler Joined: 27 Jun 2003 Posts: 323 Location: IRC

Aha, you didn't tell me it was using an alias... now I added "spamfilter yes;" to the various alias blocks.. we'll see if that works.

maddog906 · Lurker Joined: 08 Mar 2005 Posts: 164

you can edit the alias config
/* Anope Aliases */

alias nickserv { type services; };
alias ns { target nickserv; type services; };
alias chanserv { type services; };
alias cs { target chanserv; type services; };
alias memoserv { type services; spamfilter yes; };
alias ms { target memoserv; type services; spamfilter yes; };
alias operserv { type services; };
alias os { target operserv; type services; };
alias helpserv { type services; };
alias botserv { type services; };
alias bs { target botserv; type services; };
alias hostserv { type services; };
alias hs { target hostserv; type services; };

include "aliases/aliases.conf";