{
  "family": "mirc",
  "sample_count": 10,
  "category": "trojan",
  "description": "HackTool:Win32/mIRC (or **mIRC Abuse**) refers to the malicious exploitation of the legitimate, highly popular Internet Relay Chat (IRC) client, mIRC. While the software itself is perfectly legal, historically, it was the foundational architecture for the very first massive botnets. Threat actors would secretly install modified versions of mIRC on victim machines to connect them to decentralized, attacker-controlled chat rooms, allowing a single 'Botmaster' to issue commands to thousands of infected PCs simultaneously.<br><br><b>Understanding IRC Botnets</b><br>To an infected user, the mIRC client was configured to run silently in the background, completely invisible. For security analysts in the early 2000s, IRC botnets were the primary method of conducting massive Distributed Denial of Service (DDoS) attacks. Because IRC is a highly resilient, decentralized protocol designed for massive group communication, it was perfectly suited for Command and Control (C2).<br><br><b>Execution and Botnet Mechanics</b><br>The attack begins with a dropper (often a worm or trojan) infecting the machine (`T1204.002`). It silently drops a legitimate copy of `mirc.exe` into a hidden folder, alongside a heavily customized `mirc.ini` (configuration file) and a malicious `script.ini` (mIRC scripting language file) (`T1059`). It establishes persistence via Registry Run keys to ensure mIRC starts at boot. The customized client automatically connects to the attacker's IRC server (`T1071.001`), joins a password-protected, hidden channel, and waits for text commands. The malicious `script.ini` translates these IRC chat commands into native Windows actions, allowing the attacker to download further payloads (`T1105`), launch SYN floods (DDoS), or steal files.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact was the unauthorized use of the machine's bandwidth for DDoS attacks, and the potential for secondary malware deployment. The most glaring IoC is persistent, long-standing outbound network connections on TCP Port 6667 (the default IRC port) to unknown domains. Host-based IoCs include the presence of `mirc.exe` running in the background (often renamed to `svchost.exe`) and the existence of malicious `.ini` scripts in the application directory.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Mirc and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Mirc is classified as a Trojan. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Mirc establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Mirc typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Mirc compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Mirc should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary payloads and staging behaviors are commonly associated with Mirc?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Mirc frequently operates as a loader or dropper designed to establish a foothold before downloading and executing secondary high-impact malware payloads. Depending on the threat actor's objectives, these dropped modules can range from ransomware and banking injects to modular infostealers and remote management backdoors."
      }
    },
    {
      "@type": "Question",
      "name": "How can security operations teams effectively detect and hunt for Mirc across enterprise endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Defenders should hunt for Mirc by deploying behavioral endpoint detection and response (EDR) rules that monitor suspicious process spawning (such as cmd.exe or powershell.exe spawned from office documents or temporary directories), anomalous outbound network connections from non-browser binaries, and unauthorized modifications to Windows Run keys and scheduled task registries."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1498",
    "T1071.001",
    "T1059",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols (IRC for C2)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1059",
      "name": "Command and Scripting Interpreter (mIRC Scripting Language)",
      "tactic": "Execution"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys",
      "tactic": "Persistence"
    },
    {
      "id": "T1498",
      "name": "Network Denial of Service (Botnet DDoS attacks)",
      "tactic": "Impact"
    }
  ],
  "containment_steps": [
    "Block TCP Port 6667 outbound at the enterprise firewall (unless IRC is explicitly required for business purposes) to sever the botnet C2 connection.",
    "Use EDR to locate the hidden mIRC executable and its associated configuration (`.ini`) scripts.",
    "Review the malicious `script.ini` file; it is plaintext and will reveal exactly what commands the botmaster is capable of executing, and often lists alternative C2 servers.",
    "Remove the persistence mechanisms (Registry Run keys) and delete the mIRC directory."
  ],
  "what_to_avoid": [
    "Do not assume a machine is safe just because standard antivirus missed the `mirc.exe` file; it is a legitimate application, the threat lies in the `.ini` configuration.",
    "Avoid ignoring persistent IRC traffic; it is a massive red flag for a legacy botnet infection."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}