Hello, everyone, today we're taking a look at "Magold,"
a Hungarian email worm from 2003, that actually contains
a surprising number of features, and is relatively complex.
So, to start things off, we'll go ahead and look at it emailing itself...
and see the email that a user would actually receive.
So here's the list of emails (it's 'email addresses', Dan) that will be sent a copy of the worm.
These are also duplicated here in this HTML file on the desktop,
so that Magold has an easy time finding them, and infecting them.
We'll go ahead and run the worm now, and see it infect it. *bop*
Outputs this fake error message, however, we will take a more in-depth look at the ACTUAL worm in just a bit.
[half of Windows XP startup sound]
So, here we go.
We're actually seeing some email being sent here.
And if we send and receive on this virtual machine...
There we go! There is our infected email.
So, as we can see, it's sent to all of these email addresses, plus a few more...
Subject: "Maya Gold-os"... Kapernylolkilmo? (top quality pronunciation)
Unfortunately, I... can't speak this... BUT!
I do have a rough translation for you!
Which reads: "Dear recipient,
in order to increase the popularity of 'EROTIKA.LAP.HU',
we would like provide you with a sample of our offers! (good grammar)
WARNING: The attached file 'Maya Gold.scr' is a screensaver;
as the name suggests, it contains pictures of the porn actress 'Maya Gold'.
In case you have a problem or question, you can write to the following address:
'erotika@lap.hu'.
Regards, EROTIKA.LAP.HU."
Now, I have no idea if this site is even associated with this actual worm or not,
BUT!
Considering this is... 14 years old by now, probably not.
An interesting side note is that Magold actually keeps track of what email addresses it has infected
from any PC.
So we can see this in a text file in the Windows-- uh, SYSTEM32 folder...
It's called raVec.txt.
And... should be down here somewhere...
Where's it at?
There it is.
So, here, we can see those same email addresses, plus a few more that it picked up from somewhere on this machine, I'm assuming.
But I don't think L@.9 or D@.d are gonna be infected anytime soon.
But, y'know... you never know.
So let's move right along.
So we're gonna go ahead and copy this file here...
It, unfortunately, does NOT work on Windows 98,
As, if we try to run it, it just errors out entirely.
So we're gonna move this over to a Windows XP machine on VMWare and see what it does.
Alright, so let's take a look at what this worm does.
We'll go ahead and run the executable one more time...
And as we saw before, we get a DirectX error, address: whatever.
This is totally fake. There is no DirectX error, this is the worm simply infecting your machine.
And now, the fun begins.
We'll go ahead and take a look at regedit...
And see how it uniquely hooks file extensions to run whenever you run any other program.
So any time you run batch, .com, .pif, .scr, and .exe...
You will also be running the worm.
So that's fun.
So if we look at "open" here, we can see that it's opening with "raVe.exe",
which is the worm.
We'll find this in the WINDOWS folder...
along with our Maya Gold.scr.
So you've got raVe and Maya Gold. Both the worm, both going to ruin your day.
Which is always fun.
Additionally, in the registry (although we don't have it installed),
we will find references to some peer-to-peer sharing programs like Limewire.
So this one is in "Software". Here's the KaZaa one.
So, KaZaa has its DlDir0 set to raVe.
So, your shared folder will also be hosting this worm
for anybody on your peer-to-peer networks to find and download and infect themselves with.
So, not only does it spread via email, but it also spreads via peer-to-peer networks.
And additionally, it also spreads via IRC, using mIRC.
"But that can't possibly be ALL the ways that it spreads," you might say.
And you'd be right, because take a look at this.
This is my shared folder for my host. This is my Windows 7 host,
This is where I keep all my malware and stuff,
to, uh, run on videos and move stuff to virtual machines.
And as you can see here, I had a virtual machine that had write-access to this folder,
and it went ahead and dropped its files here.
So we've got Mal-- Maya Gold.scr and an autorun.inf, and if we look at it...
we see it opens Maya Gold.scr.
So if you happened to have a thumb drive or anything like that in your machine,
or any shared folders that happened to work with autorun files,
you'd also be infected with the Magold worm.
So, wow.
So, now that we know that the worm spreads via email, peer-to-peer, shared folders, and IRC all at once...
It's time to go ahead and reboot and take a look at what it actually does.
One small thing to note is that the worm will actually attempt to kill processes associated with antivirus and firewall products.
And it's even been able to kill Explorer a few times, most notably, I've noticed...
when attempting to change your TCP/IP settings here.
There we go.
It detected that the window was open and just totally killed Explorer and restarted it.
And that pretty much effectively closes that window and prevents you from changing those details.
So, here, we can see the first of several payloads.
Our window colors have been changed to a very lovely shade
of... very bright red.
And this persists pretty much everywhere, in, um...
file dialogue boxes...
Taskbar Properties, anywhere that you have...
any sort of bar that needs to be displayed,
it's colored red. I especially like Calculator.
That looks pretty cool.
And Firefox gets a lovely red makeover as well.
All in all, I rate it 10/10.
So let's move on to the next payload.
Hey, there we go!
Here's the next payload. Took a few minutes to activate,
luckily you didn't have to sit here for all of this.
But, we now have our desktop filled with thousands of text documents.
That are all blank.
They are all named "raVe", and then an incrementing number.
So that's fun.
If you listen closely in the background, my printer just clicked on.
[ambient printer noises]
[Dan pulls out paper]
Well, this worm definitely just printed something.
So, let's take a look at it!
Alright, so here's the page that my printer spat out.
It's another message in Hungarian like the email.
So, I can't really read this, except for this line, it says,
"PUNK'S NOT DEAD" right there.
And I can read the smiley faces okay.
But I can't read the rest of it.
But I do have an English translation available, which reads:
"Help me.
I'm the printer and would like to ask you to talk to Windows, because this is getting out of hand.
It is continuously bugging me with silly questions like;
'Do you still have paper?'
'Can you print in color?'
'I'd like to have this one in landscape mode.'
'Are you ready?'
I think you would agree with me that this cannot go on like this any longer.
Regards, your sympathetic, helpful friend, the printer."
Now, I must say, if your printer is printing out stuff like this,
it's pretty safe to assume that something's wrong with your computer.
I mean, look at all these smilies.
No innocent program would print that many smilies.
So, I'd say it's safe to assume you have a virus.
That means you need to go right to the professionals!
Like the "VIRUS TERMINATOR", the most badass antivirus ever conceived!
It's got a gun on the cover! What more could you want?
And I've been thinking...
about potentially doing some malware livestreams, either here on YouTube, or on Twitch Creative,
either demoing these antiviruses (I have a ton of them from back in the day),
seeing how effective they are,
uh, hunting for malware...
running it on a virtual machine...
playing with some, uh, viewer-made malware that HASN'T made it into videos...
All sorts of stuff. If you have any OTHER ideas for streams, i'd love to hear 'em.
'Cause I'd love to stream for YOU!
So I want your input on stuff I could stream,
WHERE I should stream, either on here-- on YouTube, or on Twitch,
And anything along those lines that you wanna add, please leave it in the comments.
But for now, let's get back to the virus, 'cause it hasn't been terminated yet!
If you heard that click just now,
that was the worm attempting to open my disc drive, however, my optical disc drive is... broken...
and doesn't open unless you whack the crap out of it, so let's do that! (oh no)
[disc drive abuse] Open!
[more abuse] Open the drive!
[dan, stop] Open it!
There we go, we got it!
And so now the worm has successfully, with a little bit of "help", opened the disc drive.
Alright, the last payload is being... pretty stubborn,
so we're going to go ahead and switch over to Virtual PC 2007
since there's a payload that I can only show you on there.
Okay, we're here now with Virtual PC 2007.
My apologies for the, uh, rather terrible resolution...
However, I had to uninstall the, er, additions so that I could fully capture the mouse and it wouldn't escape the window.
So that I could show you this great...
"relocation" payload.
Every time you approach the top of the screen...
your mouse instantly relocates to...
the middle.
Which is INFURIATING.
Every time you go to close a window, or to the address bar in your browser,
NO.
You get pushed back down.
It just pushes you around, it doesn't care who you are, it's a bully!
It's nothing but a bully!
And I don't like it!
And in addition, as you've probably already read,
it changes your active window title text to the application followed by a smiley face,
that we saw in the printed text, and "OFFSPRING is coOL =:-)", "PUNK'S NOT DEAD =:-)",
and also opens up
Offspring.com.
So, I'm going out on a limb here, total wild guess, but...
I'm just gonna theorize that the virus author
was a fan of "The Offspring."
But, y'know.
That's just my crazy theory.
And that is about it for the Magold emul-- EMAIL worm.
Thank you very much for watching.
Hopefully you enjoyed this video,
And, uh, if you read my little blurb
in the beginning and listened to my little spiel
and, uh, when we were reading the printed document,
I would appreciate your feedback regarding Patreon and streams,
and anything along those lines.
So if you'd please post comments about that; questions, concerns, hatemail, et cetera,
Please let me know.
And that is about it!
Thank you for watching.
Take care!