{
  "family": "mirc",
  "sample_count": 10,
  "category": "trojan",
  "description": "HackTool:Win32/mIRC (or **mIRC Abuse**) refers to the malicious exploitation of the legitimate, highly popular Internet Relay Chat (IRC) client, mIRC. While the software itself is perfectly legal, historically, it was the foundational architecture for the very first massive botnets. Threat actors would secretly install modified versions of mIRC on victim machines to connect them to decentralized, attacker-controlled chat rooms, allowing a single 'Botmaster' to issue commands to thousands of infected PCs simultaneously.<br><br><b>Understanding IRC Botnets</b><br>To an infected user, the mIRC client was configured to run silently in the background, completely invisible. For security analysts in the early 2000s, IRC botnets were the primary method of conducting massive Distributed Denial of Service (DDoS) attacks. Because IRC is a highly resilient, decentralized protocol designed for massive group communication, it was perfectly suited for Command and Control (C2).<br><br><b>Execution and Botnet Mechanics</b><br>The attack begins with a dropper (often a worm or trojan) infecting the machine (`T1204.002`). It silently drops a legitimate copy of `mirc.exe` into a hidden folder, alongside a heavily customized `mirc.ini` (configuration file) and a malicious `script.ini` (mIRC scripting language file) (`T1059`). It establishes persistence via Registry Run keys to ensure mIRC starts at boot. The customized client automatically connects to the attacker's IRC server (`T1071.001`), joins a password-protected, hidden channel, and waits for text commands. The malicious `script.ini` translates these IRC chat commands into native Windows actions, allowing the attacker to download further payloads (`T1105`), launch SYN floods (DDoS), or steal files.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact was the unauthorized use of the machine's bandwidth for DDoS attacks, and the potential for secondary malware deployment. The most glaring IoC is persistent, long-standing outbound network connections on TCP Port 6667 (the default IRC port) to unknown domains. Host-based IoCs include the presence of `mirc.exe` running in the background (often renamed to `svchost.exe`) and the existence of malicious `.ini` scripts in the application directory.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1498",
    "T1071.001",
    "T1059",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols (IRC for C2)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1059",
      "name": "Command and Scripting Interpreter (mIRC Scripting Language)",
      "tactic": "Execution"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys",
      "tactic": "Persistence"
    },
    {
      "id": "T1498",
      "name": "Network Denial of Service (Botnet DDoS attacks)",
      "tactic": "Impact"
    }
  ],
  "containment_steps": [
    "Block TCP Port 6667 outbound at the enterprise firewall (unless IRC is explicitly required for business purposes) to sever the botnet C2 connection.",
    "Use EDR to locate the hidden mIRC executable and its associated configuration (`.ini`) scripts.",
    "Review the malicious `script.ini` file; it is plaintext and will reveal exactly what commands the botmaster is capable of executing, and often lists alternative C2 servers.",
    "Remove the persistence mechanisms (Registry Run keys) and delete the mIRC directory."
  ],
  "what_to_avoid": [
    "Do not assume a machine is safe just because standard antivirus missed the `mirc.exe` file; it is a legitimate application, the threat lies in the `.ini` configuration.",
    "Avoid ignoring persistent IRC traffic; it is a massive red flag for a legacy botnet infection."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}