ragebot - 61.236.93.74 - IRC

Server : 61.236.93.74 
// hxxp://whois.domaintools.com/61.236.93.74
Port : 6667/tcp  open irc Unreal ircd
Channels : #g0tme# , #pwned#
// traffic on that 
<< MODE raGe|iuxwTmMNJS :+iwG
>> JOIN #g0tme#
<< JOIN :#g0tme#
<< 332 raGe|iuxwTmMNJS #g0tme# :!xpl 94 1 222.x.x.x 3 1 222.x.x.x 3 1
<< 333 raGe|iuxwTmMNJS #g0tme# root 1422314449
>> PRIVMSG #g0tme# :\x0314,1.:[\x0315,1rAGEBoT\x0314,1]:.\x0315,1 range: 222.x.x.x with 94 threads. (autorooting)
<< 404 raGe|iuxwTmMNJS #g0tme# :You must have a registered nick (+r) to talk on this channel (#g0tme#)
// run's under the process name system32dll.exe
// bot commands commands: botinfo/rarworm/xpl/p2p/vncstop/disconnect/reconnect/nick/restart/part/join/
// host auth md5 crypted 630e20d41ee020459be07f5e8b7810dc : root.edu
// delete and download command md5 crypted099af53f601532dbd31e0ea99ffdeb64 - deletefd456406745d816a45cae554c788e754 - download
// VNC brutefore used paswswords password
11111111
12345678
1234567
123456

Plain bin and a report serach malwr for : 81062eeec1984689b90fc38dc1bfcc6b