Earlier this week, Lawrence Baldwin of myNetWatchman provided me with a malware binary, and it was later identified as Troj/Winser-A by Sophos. I dug into it with my usual tools, and the result is a paper:
Unixwiz.net Research: Analysis of the Troj/Winser-A Malware
I've done reverse engineering before, but have never waded into the world of IRC - this one joined a botnet - and the process was quite an eye opener for me. I had long believed that IRC is nothing but a sewer, and this recent experience has done nothing but confirm it.
Ultimately, the DNS name that the bots "phoned home" to was removed - for unknown reasons - and because it not a worm, it didn't spread very far as far as we know.
