Re: IRC Bot traffic?

XDCC bots is what they are called.

Its a program called IRoffer.  What they do is the attacker uploads 
files to serve to irc users who just download using your bandwidth.  
They are commonly use for warez, ie the latest movies,applications 
etc.  So check over your system.

-Scott Mcintyre

> I found some IRC traffic on port 4500 with my IDS. I grabbed some
> pcaps and it looks like an IRC bot...(?)
> Has anyone seen something like this before?
> 
> [email protected] JOIN :#101-
FREEDOMXDCC
> 
> PING XDCC.101-Freedom
> :XDCC.101-Freedom PONG XDCC.101-Freedom :[101]14667
> 
> :[CrooK][email protected] QUIT :Ping
> timeout - Oxygen.101-Freedom
> 
> PING XDCC.101-Freedom
> :XDCC.101-Freedom PONG XDCC.101-Freedom :[101]14667
> 
> PING XDCC.101-Freedom
> :XDCC.101-Freedom PONG XDCC.101-Freedom :[101]14667
> 
> :[email protected] JOIN :#101-FREEDOMXDCC
> 
> :LastMetalWarrior!LastMetalWar@101Freedom-
3A40D27A.sunsh1.vic.optusnet.com.au
> JOIN :#101-FREEDOMXDCC
> 
> :[email protected] QUIT
> :Connection reset by peer
> 
> NICK [101]14667 
> PING XDCC.101-Freedom
> :XDCC.101-Freedom PONG XDCC.101-Freedom :[101]14667
> 
> :[email protected] QUIT
> :Ping timeout - Oxygen.101-Freedom
> 
> :[email protected] QUIT :loek
> 
> :[email protected] JOIN
> :#101-FREEDOMXDCC
> 
> PING XDCC.101-Freedom
> :XDCC.101-Freedom PONG XDCC.101-Freedom :[101]14667
> 
> :[email protected] QUIT :Ping
> timeout - Switch.Bladez.101-Freedom
> 
> PING XDCC.101-Freedom
> :XDCC.101-Freedom PONG XDCC.101-Freedom :[101]14667
> 
> PING XDCC.101-Freedom
> :XDCC.101-Freedom PONG XDCC.101-Freedom :[101]14667
> 
> NICK [101]14667 
> PING XDCC.101-Freedom
> :XDCC.101-Freedom PONG XDCC.101-Freedom :[101]14667
> 
> :[email protected] QUIT :Ping timeout -
> Oxygen.101-Freedom
> 
> :[email protected] QUIT :Ping 
timeout -
> Oxygen.101-Freedom
> 
> PING XDCC.101-Freedom
> :XDCC.101-Freedom PONG XDCC.101-Freedom :[101]14667
> 
> :[101][email protected] PRIVMSG #101-
FREEDOMXDCC
> :.**. ..15...14::: .8XDCC Bot Online .14:::.15.. .**.
> 
> :[101][email protected] PRIVMSG #101-
FREEDOMXDCC
> :.**. 1 pack .**.  0 of 2 slots open, Queue: 6/30, Record: 81.9KB/s
> 
> :[101][email protected] PRIVMSG #101-
FREEDOMXDCC
> :.**. Bandwidth Usage .**. Current: 77.4KB/s, Record: 89.0KB/s
> 
> :[101][email protected] PRIVMSG #101-
FREEDOMXDCC
> :.**. To request a file, type "/msg [101]00111 xdcc send #x" .**.
> 
> :[101][email protected] PRIVMSG #101-
FREEDOMXDCC
> :.**. To request details, type "/msg [101]00111 xdcc info #x" .**.
> 
> :[101][email protected] PRIVMSG #101-
FREEDOMXDCC
> :.#1 . 7x [1.1G] ..4,8 MoViE .1,1 .12,11 Hostage.TS-LRC
> 
> :[101][email protected] PRIVMSG #101-
FREEDOMXDCC
> :.**. ..15...14::: .4Rooted By The Best - Leeched By The Rest
> .14:::.15.. .**.
> 
> PING XDCC.101-Freedom
> :XDCC.101-Freedom PONG XDCC.101-Freedom :[101]14667
> 
> :[101][email protected] PRIVMSG #101-
FREEDOMXDCC
> :Total Offered: 1076.0 MB  Total Transferred: 12.45 GB
> 
> :[email protected] JOIN :#101-
FREEDOMXDCC
> 
> PING XDCC.101-Freedom
> :XDCC.101-Freedom PONG XDCC.101-Freedom :[101]14667
> 
> :[email protected] JOIN
> :#101-FREEDOMXDCC
> 
> :[email protected] QUIT :Ping timeout -
> Switch.Bladez.101-Freedom
> 
> :[email protected] JOIN :#101-
FREEDOMXDCC
> 
> NICK [101]14667 
> PING XDCC.101-Freedom
> 
> 
> --
> _______________________________________________
> Intrusions mailing list
> [email protected]
> http://www.dshield.org/mailman/listinfo/intrusions
> 
> 


_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions