Hello everyone, today we have the third Viewer-Made Malware video.
This is a trojan and file infecting virus hybrid called "Mist", written by mistake
And, uh, this is actually really cool so, thank you very much for writing this and sending it in...
I'm pretty excited to demonstrate this on video.
So, first things first, we have a few dummy files to look at.
First, we have...
Beautiful, beautiful art that I created...
A lovely bitmap file,
a text document that will eventually be overwritten,
and our regular non-infected version of Calculator.
Ships with every version of Windows XP.
It is 112 kilobytes... on the disk, so...
That's what we're looking for, as our base uninfected file size.
And one more thing to look at is that blue screens of death...
Are, infact, blue.
And, um, are not any other color.
They are regular Blue Screens of Death.
And right here, I've just triggered the, uh, Blue Screen of Death that you can do with control and scroll lock.
Just to demonstrate that this works properly.
Now let's move on to the virus...
Okay, it's time for us to look at the actual virus and trojan.
First things first, we're going to run the MistInstaller.
Which will actually install an infected driver to the machine that will then, uh... do all the rest of the malware's doings.
We'll actually take a look at the file infecting version next..
Remember, Calculator is 112 kilobytes.
When we run this, there should be 3,072 byte Goat file
However, its actually not. It's actually 22 kilobytes so it's definitely been infected by the virus
and now Calc has lost its icon, and has grown almost 20 kilobytes. So, the size of the virus
to 131 kilobytes,
Still works.. which is nice.
So, infected programs do still work..
however, they do get infected of course and will help spread this virus
And finally, MistInstallerRC helps the virus to run on the Windows log on screen
the Windows boot up screen i believe he said?
I'm not really sure if there's too much of a difference between either of these two
that would really be important for this video. But, we'll take a look at both anyway just to be sure.
Now, lets get to the actual payloads of this trojan/virus/hybrid thing whatever you want to call it.
First one activates randomly on any day that's not another payload trigger day,
so October 20th is a normal day to this virus.
It will not do anything too malicious
But, 1% chance of opening a bunch of different file types, it will actually block their opening
so we'll go ahead and open this text document until we see that happen.
And here we go
Instead of opening our text document like normal
we get a message saying
"The File or directory is corrupted and unreadable."
Which is.. kind of a bummer. But! We can just run it again
and it works.
Now we'll move on to the next payload, which activates on the 18th of May
so we'll go ahead and restart after we change the date, and see what it does.
Okay, we've booted back up, changed the day slightly, to the AM hour
just to make sure that it works, and it is May 18th.
And now whenever we try to run any of our affected file types, such as text documents
Word documents, PowerPoint, Excel, bitmaps, jpegs, pngs, tif's, gifs,
all that good stuff
We get the same error message, however instead of it being a 1% chance, it is 100% chance
so none of these files will open on May 18th.
Which, in it of itself, is not destructive, however it's rather annoying.
But this trojan/virus hybrid thing only gets worse from here
so lets continue on.
15th of December
this will actually start leaking memory
Which is actually pretty entertaining so we'll go ahead and restart, wait a little bit
and see what this ends up doing.
Okay, so we've booted up the computer on the 18th, I mean the 15th of December, excuse me.
and it's been about 5 minutes since we booted
and... we are really running out of available memory here.
I have reduced the memory available to the virtual machine to 256 Megabytes
and completely removed the page file
So things are not looking too good for this virtual machine
You see we have programs crashing, or out of virtual memory
and, uh, just generally not going well.
Left unchecked, this will eventually cause the machine to hang, or perform rather erratically.
and sluggishly
Since this is a virtual machine running on a solid-state drive
we're not going to see too much of a performance decrease unless we really sit here for awhile
But... imagine on a physical machine
running these kind of specs, as we can see the page files full since it doesn't really exist
It would really lag it.
and would become very sluggish.
So we'll move onto the next payload
Which is actually quite dangerous and activates on the 18th of April.
So we'll go ahead and change the date and restart
and we'll see what happens after the computer boots back up
Okay, we're booted into the computer,
the date is set properly, lets take a look at this 'dangerous payload'
Now, normally opening and closing text documents, or bitmaps, or HTM or HTML, Javascript,
Pretty much a lot of programming language files, opening and closing will be perfectly fine
We can open it and close it as much as we want, nothing happens
But, say, you're writing a program, like a C++ or C, or assembly program
"Oh no, that's bad!"
and we save it
Okay, we're running out of memory again for some reason, but that's okay
Oh god
What's happening?
Okay, this is unrelated to, um... this is not related to Mist, but it's kind of funny
Lets get back to the virus!
So now that we've edited this and changed it and saved the changes,
When we open it back up, our documents are overwritten with gibberish, instantly
so as soon as any save is applied to any file
It gets overwritten. So, say, you're working on a huge project,
You save your changes, try and compile, and your code is dead. Hopefully you have backups
We're gonna edit my beautiful art work here.
Gonna add some cool spray can green.
And, of course, we're gonna save that 'cause, I mean, it's modern art.
And uh...
We're gonna try to open it again
And our bit-map has been turned into garbage data.
Which, admittedly looks kinda cool, but, I mean its not my art...
And I was kind of attached to that, so..
I'm kinda sad now...
But moving right along, we're moving onto the last payload
which overwrites your Master Boot Record
Which is actually pretty neat.
So, we're going to change the date once again to the 30th of September
and restart and we should see it happen.
So we're booting up on the 30th of September
and...eventually...
The virus payload should start up *Tone*
There it is
So we get a nice song
The computer is still usable while this is happening.
As soon as the song is done, the computer crashes to a Blue Screen of Death however
this virus has changed it so that all Blue Screens of Death are now red
So we have the Red Screen of death with the error message "0xDEADDEAD"
So... that's kind of scary
We'll go ahead and restart the computer now
and we'll see that the MBR has been overwritten with this really cool
graphical, coloured-scrolling-rainbow thing
it's actually really neat.
And it will do this whenever you boot your computer
Which, you know, is kind of bad if you wanted to use your computer but...
for this channel, this is pretty cool.
and one hidden feature from the author, mistake
if you hit 'R'
It actually replaces your boot record
with the clean copy, and allows you to reboot your PC back to normal
However, if you do it again today, it will just play the song again, and overwrite your Master Boot Record again
So, pretty much waiting til' tomorrow, like it says
would be the best plan of action
So that is about it, for the Mist trojan/virus hybrid thing, as I keep calling it
If you'd like to see more information about it, or view the source code, or the author's write up on his website
Please check out the link in the description
If you'd like to send in your own malware, or trojan, or virus, or whatever, to be featured in one of these videos
Please check out my forum link in the description and read the guidelines
see if that's something you might want to do.
Thank you all once again for watching, if you're enjoying these videos, please let me know
and yeah... thank you, that's about it.