Hello everyone, today we are taking a look at the "Magistr" worm,
an email worm and virus hybrid that began circulating around the Internet
in March of 2001.
The name "Magistr" is derived from "magistrate",
as the worm targets computers belonging to
person(s) affiliated with the law profession,
or anyone who might be unfortunate enough to have specific phrases
within word and text files on their computer.
Let's take a look what I mean by that.
As we can see on this computer, there are a number of
word documents on the desktop.
This is designed to simulate an office environment of perhaps
a law firm or a courthouse, as when the contents of one of these word documents
is examined, we can see that the text is a mock-up of what one might find
concerning legal documents relating to a court trial.
Although the language is crude and amateur-ish, I created this
document so that it will contain a number of phrases from this list.
"Magistr" specifically examines the content of all text and word documents
on the computer to check for phrases related to the legal system in three languages:
English, French, and Spanish,
in order to decide whether or not to activate its payloads.
More on that in a bit.
For the purposes for this video, there are multiple word documents,
however they all have the same text content.
But before we look at the payloads, let's take a look at
how "Magistr" spreads via email.
When we run the worm, nothing appears to happen.
The cursor shows the "busy" hourglass for a few seconds,
then everything returns to normal.
During this period, however, "Magistr" writes a 110-byte routine in order to
hook into "Explorer.exe", the Windows shell,
and from there proceeds to gather information on the computer's name,
the network information, and the user's email information.
On this computer, I am using the fake email address,
"danooct1@danooct1.com",
which the worm uses to send out emails in my name.
Let's take a look at the SMTP server I have running on an another computer on the network.
After the worm is executed and the email spreading routine begins,
it enumerates all email addresses it can find from several sources including
Outlook Express's address book, sent mail, and outbox folders, and the inbox.
It also checks for Microsoft Exchange and Netscape folders to acquire more email addresses.
Once it has these, it begins to mass-mail itself.
We can see on the SMTP server that it sends mail to four contacts at a time
every few seconds, however something odd can be seen as well.
The SMTP server reports that mail is coming from "dbnooct1@danooct1.com",
but we know that the actual email address is "danooct1@danooct1.com".
"Magistr", with an 80% probability, increments the second character in the
infected user's email address, so that emails being bounced from dead addresses
and replies from confused recipients will not reach the infected user to alert them
to the infection.
By the way, this demonstration was performed on an isolated network
with all of these email addresses being spoofed by the Mercury SMTP Server
so that the worm would work.
They don't actually exist, so I wouldn't suggest emailing them yourself,
but you're free to waste your time as you please.
If we take a look at yet another computer on this network, we can see
the type of emails "Magistr" constructs and sends.
"Magistr" would usually create emails using a random selection of text
within the word documents that it scans on the computer,
and then attaches one of the executables that it is infected
to the message and sends it out.
Pretty standard fare for the email worm variety, however it also has a chance to
send an email with potentially dangerous consequences.
When sending emails, "Magistr" has a 20% chance to also attach
the word document that it created the message, subject, and body from, to the email itself,
potentially leading to the leak of personal, private, or confidential information.
As stated from the first line of the word document shown here,
the contents were confidential and should not be shared,
however "Magistr" doesn't have the ability to care about your feelings
or desires and does it anyway.
In this way, data such as passwords, social security numbers, addresses,
or other sensitive information on your computer, could be shared with anyone
you had email contact with.
When "Magistr" finishes sending emails, it modifies your computer to enable it to
run when your computer is booted.
One of the more straightforward ways of accomplishing this is by adding
the files that it has infected to the run key in the registry, as we can see here.
When looking at the directory with the infected files in it, there is "Msoobe.exe",
along with "Msoobd.exe".
"Msoobe" is the Microsoft out-of-box experience, which deals with setting up
Internet connections and mail accounts for brand new Internet users.
This file is infected with "Magistr".
"Msoobd" is also infected with "Magistr", however it is just the virus
without the actual program tied to "Msoobe".
"Magistr" infects files and decrements the last character in the file name,
and uses the newly created "Msoobd.exe" file to run itself on startup.
"Magistr" is a worm of probabilities, and as it turns out, it has an alternate method
that it might use to run itself at startup.
When infecting files, there is a 25% chance that "Magistr" will alter the file name as usual,
however instead of adding this file to the registry, it will move the file to the
Windows directory, and add a path to this file to the "run=" command in "Win.ini",
which will also run an infected file when the computer boots.
In this case, the infected file that "Magistr" created is visible in the Windows directory,
while the original, also infected file, is located in the Windows system directory.
"Magistr" also keeps track of the date and time when it originally infected the PC,
as well as a log of email addresses that it has attempted to infect.
This log file is stored in either the root of the C: drive, the program files directory,
or in the Windows directory, and the name is generated based on the computer's name.
In this case, the computer is named "COMP2",
so the resulting DAT file is named "wkmj2.dat".
When viewing this in a text editor, the location of various email-related directories is visible,
along with a list of email addresses that it has tried to infect.
In this way, it can avoid sending multiple emails to the same email address,
as well as keep track of how many contacts it has sent itself to.
With the ground work of the worm out of the way, let's move on to the fun stuff:
the payloads.
Remember how in the beginning of the video I mentioned that "Magistr"
checks for specific phrases within word documents found on the system?
Well, if during the initial infection "Magistr" finds at least 3 documents,
that each have at least 3 of the phrases on the list shown earlier,
and at least 100 contacts has been sent an infected file,
then the worm flips its switch to arm its payloads.
If, however the computer does not have enough documents to fulfill the payload requirements
when the worm first infects the PC, then the payload switch is never activated.
The intent of the worm is to damage computers belonging to those in the law profession,
which explains the name the author gave the worm in hidden comments within the worm's code:
"The Judge's Disemboweler".
Similarly, if the documents are present during the initial infection but are deleted afterwards,
the payload toggle can be never be disarmed.
If the payload criteria has been met, and two months has passed,
then in odd days of the month, "Magistr" disregards all of the previous techniques
it has employed to be stealthy and engages the user head-on in very silly manner;
it makes the icons on the desktop run away from the mouse pointer.
This continues indefinitely, even with Windows open on top of the desktop.
This is annoying, but not destructive.
At this point, the user would surely know something was wrong with their computer,
but that's only if the computer had actually survived two months to see this payload.
If only one month has passed since the infection and the payload criteria has been met,
then "Magistr" unleashes its destructive power.
The virus deletes every file that it has infected, along with nearly every other file on the machine,
overwriting the remaining files, and displays a message box
telling the user what "Magistr" really thinks of them,
calling them a "haughty bloodsucker", and that they think they're God,
but they're only a "chunk of shit".
When the OK button on this dialogue box is pressed, the computer immediately
blue-screens as "Magistr" wipes the CMOS memory.
If the computer was vulnerable, the same exploit used by "CIH" to brick a PC's BIOS
is also used to wipe the BIOS on infected machines running Windows 95, 98, or ME.
If we continue past the blue screen and look in the Windows folder,
nearly everything that was once there is missing.
Programs that are left behind have been corrupted, and the system is basically trashed at this point.
When the computer is restarted, we can see that after accepting default values to restore the CMOS,
"Magistr" has overwritten a portion of the hard drive, destroying the Master Boot Record
and partition table in a manner similar to "CIH".
If the executable files on the machine are removed to an uninfected PC,
the overwriting payload of "Magistr" can be examined, even with a simple text editor;
in this case, WordPad, as the files are too large for Notepad to open on Windows 98.
Once a file is opened, the damage done by "Magistr" is apparent.
The entire beginning of the executable is overwritten with the text "YOUARESHIT",
as many times it will fit, destroying the file.
As we scroll through the profanities left behind by "Magistr" in this EXE file,
it's important to note, that this worm is not just a relic left behind in the Windows 9x era.
This worm is also capable of activating on Windows NT based operating systems,
like Windows 2000 or Windows XP.
The payloads that wipe the CMOS and delete the BIOS of infected computers
will not work on Windows NT based kernels.
However, the damage done by "Magistr" when it deletes all files
and overwrites the remaining EXE files, can still happen.
That just about wraps up the "Magistr" worm.
Thank you if you watched the video this far,
and thank you very much for helping me to reach the insane level of 100,000 subscribers.
This is the worm that made me more interested in malware than anything else I read about,
back in 2004,
and I hope this video has done its justice.
Allow me to take a moment to extend my greatest gratitude,
to all of you who have been here throughout the years, or have just recently come to this channel,
all of you who leave me encouraging comments,
positive tweets;
I try to read everything I get, and...
especially recently, it's been just;
I've been blown away by the response I've been getting.
Uh, so many people that I never would have expected,
tell me they interested in this kind of stuff,
and I said this before, I started these videos solely as a hobby,
and, uh, really means a lot to me like...
you guys are watching and enjoying it, as much as you have been,
so...
from me to you, from the bottom of my heart,
thank you.
I really, really appreciate it.
With all that sappy stuff out of the way,
I gotta close this video with a huge special thanks;
my good friend; it's been
talked about on this channel before, "FlightCPUboy".
Uh, without his help,
uh, he actually disassembled this virus entirely,
and, uh...
basically rewrote it a little bit,
so that instead of a hundred contacts, the worm will activate if 12 contacts were emailed;
basically just made it easier to debug, test, and make this video,
and without his very technical and detailed write-up,
this video would not have been possible, so,
"Flight",
Thank you for your help on "Magistr",
on SSR, on everything you helped me with,
throughout the years.
Thank you.
OK, I think for real,
that just about sums everything up, so,
thank you for watching, thanks for subscribing, commenting all the time...
I really appreciate it.
Hopefully you enjoyed this video too,
and take care; I'll see you next time.