Hello everyone, today we're taking a look at the Parrot email worm.
This worm spreads through both email and MIRC,
and while it is kinda annoying, it is not overtly destructive
and is in fact, a little bit entertaining.
We will go ahead and run this worm...
which talks to us.
COMPUTER: Hi there, I'm Parrot the talking virus, written by 'jiggabyte'.
So this is Parrot, the talking virus, written by "jigga-byte", aka 'Gigabyte',
who was apparently, at the time, a 17-year-old female virus author out of Belgium,
who wrote this in response to a security analyst... and we'll get to that a bit later.
But first things first, let's take a look at our Windows folder,
which is now in complete disarray due to this worm,
as we notice all of our EXE files are now replaced with the Parrot icon.
If we scroll all the way down, we can see many extra files here that match the filenames
and these are our original EXEs - "TUNEUP.prt", the original, is replaced by this.
So, Parrot is actually a companion virus in that it drops its files and then links them back to the original EXE here.
So if you run 'Welcome.exe', it will run this, which runs the worm,
and then it will run the program you're looking for.
So this shows up when we run any of these executables.
We run it, and...
COMPUTER: I'm Parrot the talking virus, written by 'jigga-byte' (Gigabyte)
...and we get the err... voice clip, and it also runs the program that we're looking for.
However, this does lead to some unintended behaviour.
We'll go ahead and make a text file here.
COMPUTER: Hi there, -
Yes, yes, yes, we know, you're Parrot, okay...
And we'll just write "test" and we will save this onto the desktop.
So this is just our average text file...
and when we open this, we would expect to see our text, which says "test", however...
COMPUTER: Hi there, I'm Parrot -
Parrot simply runs the program that we're looking for, but forgets to actually open the file that we're looking for.
So this just runs Notepad.
It knows you want to open Notepad since we're opening a text file.
However it just runs Notepad and does not actually open the text file you were looking for.
So, to actually use this text file, you'd have to use it [from] the 'Open' menu from inside Notepad
which is kind of annoying.
One last thing to check out on Windows 98:
We'll go ahead and restart...
and eagle-eyed-
(Parrot virus talks again)
Oh crap.
Yes, we know you're Parrot.
I forget, you can't actually shutdown or restart because it just tells you that it's "Parrot, the talking virus",
so we're gonna have to reset using the VM menu.
Now if you look carefully, you'll be able to see this next payload 'cause it only shows up for a fraction of a second.
COMPUTER: Hi there, I'm -
Yes, yes, we know you're Parrot. Okay.
Now, you probably saw it, but just in case,
here is a freeze-frame of a few frames from this boot-up sequence which shows us a new message
from Parrot, the talking virus.
Now,
there is one more thing we've gotta look at, but for that we need to switch to Windows XP.
Okay, so here, on Windows XP, we'll go ahead and run the worm again.
(Parrot speaks in background yet again)
We get the same message, this time without Windows Media Player popping up,
and we'll go ahead and restart, and see the final thing that this virus/worm does.
Okay, for whatever reason, my XP Virtual Machine resized its resolution, but that doesn't really matter.
So here, we get a new message box, saying,
"you'd better not... fuck on the table, Graham Cluley,"
"you son-of-a-bitch."
"I don't even know the lady and she calls me a son of a bitch."
So this is taken from the Italian -
what is it?
- 'The Italian Man who went to Malta' ?
Which is a pretty funny joke. If you haven't heard it, there's a link in the description.
However, once we press "OK", we are actually treated to
another computer generated voice, and an excerpt from the techno remix of...
(stifled laughter)
this... great joke.
COMPUTER: (largely distorted) [you better not fuck on the table, Graham Cluley] you son of a bitch.
COMPUTER: (male voice) I don't even know the lady and she calls me a son of a bitch.
Excerpt (from joke): Then I go to eat at a bigga restaurant. The waiter brings me a spoon and a knife but no fork, I tell 'a "I wanted a fock [fork]"
She tellin' me "everybody wanna fuck!", I tell her "You no understand!"
"I wanna fock-a on the table!"
She say "You betta NO fuck on the table, you son of a bitch!"
I don't even know the lady and she call me a "son of a beech" !
I
DON'T
NEED
THIS SHIT!
(bassy techno remix.)
(pauses remix)
So. Classic, classic, audio file,
I remember it from way back in the day,
which makes an appearance in this worm every time you boot your computer.
...so,
what brought this all on? Who is Graham Cluley?
Well he was actually a senior technology consultant at Sophos.
He became the target of a bunch of these viruses and worms,
because he said some rather disparaging remarks regarding the social status and physical appearance
of virus authors, and let's leave it at that.
So here's actually a worm written in retaliation to something that an anti-virus vendor
or one of their employees actually said or did.
So... kinda interesting when you think about it.
And that is about it for the Parrot email worm, thank you for watching.