Re: IRC Bot traffic?

this is interesting. We ran our AV and a few different spyware
catchers against it and nothing was picked up. We stopped seeing the
traffic once MSN Messaenger was removed from the machine.


On Wed, 23 Mar 2005 13:18:14 -0600, Scott Mcintyre
<[email protected]> wrote:
> XDCC bots is what they are called.
> 
> Its a program called IRoffer.  What they do is the attacker uploads
> files to serve to irc users who just download using your bandwidth.
> They are commonly use for warez, ie the latest movies,applications
> etc.  So check over your system.
> 
> -Scott Mcintyre
> 
> > I found some IRC traffic on port 4500 with my IDS. I grabbed some
> > pcaps and it looks like an IRC bot...(?)
> > Has anyone seen something like this before?
> >
> > [email protected] JOIN :#101-
> FREEDOMXDCC
> >
> > PING XDCC.101-Freedom
> > :XDCC.101-Freedom PONG XDCC.101-Freedom :[101]14667
> >
> > :[CrooK][email protected] QUIT :Ping
> > timeout - Oxygen.101-Freedom
> >
> > PING XDCC.101-Freedom
> > :XDCC.101-Freedom PONG XDCC.101-Freedom :[101]14667
> >
> > PING XDCC.101-Freedom
> > :XDCC.101-Freedom PONG XDCC.101-Freedom :[101]14667
> >
> > :[email protected] JOIN :#101-FREEDOMXDCC
> >
> > :LastMetalWarrior!LastMetalWar@101Freedom-
> 3A40D27A.sunsh1.vic.optusnet.com.au
> > JOIN :#101-FREEDOMXDCC
> >
> > :[email protected] QUIT
> > :Connection reset by peer
> >
> > NICK [101]14667
> > PING XDCC.101-Freedom
> > :XDCC.101-Freedom PONG XDCC.101-Freedom :[101]14667
> >
> > :[email protected] QUIT
> > :Ping timeout - Oxygen.101-Freedom
> >
> > :[email protected] QUIT :loek
> >
> > :[email protected] JOIN
> > :#101-FREEDOMXDCC
> >
> > PING XDCC.101-Freedom
> > :XDCC.101-Freedom PONG XDCC.101-Freedom :[101]14667
> >
> > :[email protected] QUIT :Ping
> > timeout - Switch.Bladez.101-Freedom
> >
> > PING XDCC.101-Freedom
> > :XDCC.101-Freedom PONG XDCC.101-Freedom :[101]14667
> >
> > PING XDCC.101-Freedom
> > :XDCC.101-Freedom PONG XDCC.101-Freedom :[101]14667
> >
> > NICK [101]14667
> > PING XDCC.101-Freedom
> > :XDCC.101-Freedom PONG XDCC.101-Freedom :[101]14667
> >
> > :[email protected] QUIT :Ping timeout -
> > Oxygen.101-Freedom
> >
> > :[email protected] QUIT :Ping
> timeout -
> > Oxygen.101-Freedom
> >
> > PING XDCC.101-Freedom
> > :XDCC.101-Freedom PONG XDCC.101-Freedom :[101]14667
> >
> > :[101][email protected] PRIVMSG #101-
> FREEDOMXDCC
> > :.**. ..15...14::: .8XDCC Bot Online .14:::.15.. .**.
> >
> > :[101][email protected] PRIVMSG #101-
> FREEDOMXDCC
> > :.**. 1 pack .**.  0 of 2 slots open, Queue: 6/30, Record: 81.9KB/s
> >
> > :[101][email protected] PRIVMSG #101-
> FREEDOMXDCC
> > :.**. Bandwidth Usage .**. Current: 77.4KB/s, Record: 89.0KB/s
> >
> > :[101][email protected] PRIVMSG #101-
> FREEDOMXDCC
> > :.**. To request a file, type "/msg [101]00111 xdcc send #x" .**.
> >
> > :[101][email protected] PRIVMSG #101-
> FREEDOMXDCC
> > :.**. To request details, type "/msg [101]00111 xdcc info #x" .**.
> >
> > :[101][email protected] PRIVMSG #101-
> FREEDOMXDCC
> > :.#1 . 7x [1.1G] ..4,8 MoViE .1,1 .12,11 Hostage.TS-LRC
> >
> > :[101][email protected] PRIVMSG #101-
> FREEDOMXDCC
> > :.**. ..15...14::: .4Rooted By The Best - Leeched By The Rest
> > .14:::.15.. .**.
> >
> > PING XDCC.101-Freedom
> > :XDCC.101-Freedom PONG XDCC.101-Freedom :[101]14667
> >
> > :[101][email protected] PRIVMSG #101-
> FREEDOMXDCC
> > :Total Offered: 1076.0 MB  Total Transferred: 12.45 GB
> >
> > :[email protected] JOIN :#101-
> FREEDOMXDCC
> >
> > PING XDCC.101-Freedom
> > :XDCC.101-Freedom PONG XDCC.101-Freedom :[101]14667
> >
> > :[email protected] JOIN
> > :#101-FREEDOMXDCC
> >
> > :[email protected] QUIT :Ping timeout -
> > Switch.Bladez.101-Freedom
> >
> > :[email protected] JOIN :#101-
> FREEDOMXDCC
> >
> > NICK [101]14667
> > PING XDCC.101-Freedom
> >
> >
> > --
> > _______________________________________________
> > Intrusions mailing list
> > [email protected]
> > http://www.dshield.org/mailman/listinfo/intrusions
> >
> >
> 
> _______________________________________________
> Intrusions mailing list
> [email protected]
> http://www.dshield.org/mailman/listinfo/intrusions
> 


-- 
Lawerence A. Wichman
2719 W Thomas Apt 2
Chicago, Il 60622
773-807-7606
_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions