Vulnerability Development: Re: Suspicious JOe.exe

[OblivionO () aol com]

I ran a hex editor on a copy of Joe.exe that was sent to me and although i 
found most of the same information as the strings command, i was unable to 
find the request of invite. Upon entering the iRC network that joe.exe is 
connecting to i tried to enter channel "#penr0x". It is invite only, whcih 
leads me to believe that when the zombie connects to irc it sends a request 
to a bot or botnetwork with a specific phrase, ordering the botnet to invite 
it to #penr0x.... My question is where would this phrase/nick be located in 
the file? i cant seem to find it although it seems to me that it should be in 
plain text...

 ~ Chris