Lmfao hey im sending my new photo album, Some bare funny pictures!

继昨天我们截获一支通过MSN快速传播的ircbot后，今天有网友向我们上报了一支新的变种，对这位网友表示感谢。
（Update：我们又收到两个不同MD5值的样本，看来作者正在疯狂的更新，希望MSN用户提高警惕）

今天收到的变种大小为21,504字节，UPX加壳，MD5为cd32ff331a2ea7d2a22fd11a952fb1c2，升级了Kaspersky到今天的库后，已经可以查杀，仍检测为Backdoor.Win32.IRCBot.aaq。

新变种，释放的dll文件名为rdfhost.dll（20,992字节），象MSN发送以下文字和photo album.zip文件：

Lmfao hey im sending my new photo album, Some bare funny pictures!

lol my sister wants me to send you this photo album loooooooooooool :D looooook :p

Hey i been doing photo album! Should see em loL! accept please mate :)

HEY lol i've done a new photo album !:) Second ill find file and send you it.

Hey wanna see my new photo album? OMG just accept please its only my photo album!!

Hey accept my photo album, Nice new pics of me and my friends and stuff and when i was young lol...

Hey just finished new photo album! :) might be a few nudes ;) lol...

hey you got a pho