Hello everyone, for today's Viewer-Made Malware (VMM) we are looking at the Resonate Virus.
This was written and submitted by 'justquant', so thank you for submitting this.
Err... First things first we will just go ahead and run it
This is the... uh.... file infecting portion of this virus, which searches for .exes
on the system... and if they are the right type, CIL .exe's, they will be infected.
Fortunately it drops one for us right here, as we can see we ran it and it drops
two identical copies of itself with .scr (screensaver) extensions
and the reason it does this because it will be infected if they are of .exe type.
*And it doesn't wanna delete itself*
So we'll go ahead and change the file extension here.
Just to demonstrate that it does indeed infect files,
And normal size is 4.46 MB
and when we run this virus portion again..., you see the icon changes. And file size increases to 8.93 MB, as this now contains the virus.
But, the bulk of this malware takes place in these two trojans, or at least one of them.
So, that what we will be looking at for its many payloads.
So go ahead and delete this since we don't need it anymore...(clicking)
Uh, it's not very stealthy, you can see it running plain-as-day in Task Manager and end its task right here.
Uh, and it also uses a new text in regedit, pretty simple to find under HKEY_CURRENT_USER/Software/Resonate.
It creates a new text called 'who do you fear' with the value of 'No one' and when the trojan reads the registry and sees this, it knows it already has a copy on the system...
...and it doesn't need to reinfect it.
(breathing) So, without further ado, let's get right to the payloads.
First one activates on January 2nd of any year, forgot we gotta do this to change the date...
And we'll go ahead and restart, see what it does.
Okay, we're booted back in.
Switch over to the desktop, and eventually...
Uh-oh, there we go.
So, the justquant trojan portion drops a copy of BlastButton joke program to the machine and runs it.
So, of course, this makes various Explorer elements explode violently...
Which is always fun, and on Windows 8, it's actually extra fun because it makes the Start button explode and disappear.
Uh, if you hover over to the corner it kinda reappears but it's...kind of hit or miss.
Oh no, we need to change the date!
Alright, this is gonna be kinda dicey.
So we need to hit that change date/time button so that we can change the date to look at the next payload before it explodes.
So, as we can see, buttons pretty readily explode, we don't want that to happen... GO!! (frantic clicking)
Go go go!! Alright, we made it on to the menu.
We can now change the date.
So next payload is gonna happen on February 16th...
And things are still exploding.
(Dan is annoyed)
Okay. We'll hit Enter. (Dan hits Enter)
Okay, no, okay we changed the date, that's all that matters, we're gonna restart now.
We're gonna tell VMWare to restart, and we'll take a look at the next payload.
So, we're booted back in, we just need to wait a little bit for the trojan to run and activate it's next payload.
(clicking)...which is uh, pretty annoying.
(music starts playing) There we go. So, it plays an endless loop of the Super Mario Brothers 3 World Theme from the first world...
uh, with Spongbob Steppin' On The Beach layered over it.
Which is pretty great.
And uh, as you can see this follows you everywhere.
Running apps, programs, anything you happen to be doing will be accompanied by Mario and Spongebob. Endlessly.
As you can hear, it loops, so we're gonna change this as it's pretty annoying, actually.
Next payload is supposed to activate on April 20th, where it changes the background to a cannabis leaf.
However, I've never been able to get this to work, unfortunately.
So, maybe in the future, I'll be able to show you that happening, but I can't for this video.
So, let me skip to May 24th.
Gonna restart as soon as possible.
See what it does.
Alright, it's May 24th, and uh I'm sure a lot of people will be happy with this one.
...judging by the popularity its had on my channel recently...
(You Are An Idiot starts playing)
Actually, I'm gonna turn down the Virtual Machine's volume.
So we've got a recreation of You Are An Idiot and asks us if we are an idiot.
And I know if you say 'no I'm not' it starts bouncing them all around the screen, so we're gonna say yes I am.
Yes, I'm sure.
Okay, so no matter what this still happens, and uh Task Manager does work, that's kinda surprising...
But I know if you try to Alt-F4 out of these, if we can select any of them...
Gonna try to Alt-F4, it spawns more of them, and it's really loud, and quite annoying...
And if you keep pressing Alt-F4...(Dan frantically presses Alt-F4)...you get a million of them, which is pretty funny.
(Dan still frantically pressing Alt-F4)
Ah!! (Dan is pressing Alt-F4 for dear life now)
Okay.
Hopefully that's not like overpowering my voice...
Oh, it's still going.
It's...that's annoying.
We'll see if we can stop this.
Oh, the computer is lagging.
Okay, it's stopped.
For now. Oh?
There it goes!
(clicking) I can't right-click. (clicking continues)
Can I change the date please?
(You Are An Idiot continues to play. Super annoying.)
Please end my suffering.
Just let me change the date, please.
(Annoyed clicking)
Okay, so if you make Task Manager appear, you can stop it.
And regain your sanity.
Which is nice.
Next payload activates September 4th, so we'll go ahead and change the date and take a look at it.
This payload's not quite as the uh others, but still a payload so we need to look at it.
Every 15 seconds our browser opens up fittea dot org.
Eh, maybe it's a bonus.
You know, get to look at hot women...
...drinking tea with dogs...
There's a hot guy, if you're into that.
Oooh, non-GMO.
Gluten-free!
Dairy-free.
Good to know!
And, uh, every 15 seconds, so it says it will open that up.
Oh, what's happening?
What?!
No, go away!
I didn't ask for this!
Go away.
(frantically clicking) I can't get out of it!
Alt-F4 works, that's nice.
Uuuh, we're gonna change the date before that happens again.
...to September 6th.
And we're gonna restart before the store pops back up, there we go.
And look at this next payload.
So, on September 6th, as soon as the Trojan loads up...
We get a pixelated image of Fred Durst, according to the author here.
And the message in Comic Sans MS reading 'fred durst says: no computer today silly boy go outsie to play'
Justquant says the typo was unintentional but was noticed and left for effect.
Which is nice.
If we hit Alt-F4 (Dan laughs) this is my favorite part of this...
It just says 'no' and doesn't work.
So I wonder how we're gonna change the date to look at the last payload, I can't remember how I did it before...
Uh, Ctrl-Shift-Esc?
We can run Task Manager, I guess?
...Adjust date and time but I just can't see it.
Uh?
Alright, we ran the Start screen.
Can we change the date from here?
Hello account no. No, go away.
I don't wanna sign in to use Calendar, damn you.
Alright, we're gonna Alt-Tab, not to Fred Durst but nope.
Son of a bitch.
Date and time? No. I don't want this. I want Date and Time.
Okay.
Ummm....
Let's see...
It would be nice if I could just change it on here, but I can't.
I can't do it!
I can't remember how I did it before.
Well, I'll figure it out and we'll take a look at the last payload, which occurs on December 30th.
Okay, I restarted and changed the date really quick before the Trojan activated, and then restarted again.
So, it's now December 30th, and we will be seeing the last payload shortly...
There we go!
'Resonate, written by justquant, Fall 2015. Remember when viruses were fun? I do.'
'Music: Adam Freeland - Fear is the Mind Killer'
And, uh, it scrolls through some nice colors, it looks pretty neat.
And...
It's pretty chill payload if I do say so myself.
And true to its word, if you hit any key...
...to continue.
It goes to your desktop and you can use your computer normally.
So, not really destructive in anyway. Amusing payloads, nice spectrum of stuff that it does to you...
And overall, it's pretty neat.
So, thank you justquant for writing and sending this in. Uh, if you'd like to your own programs or creations featured here in a possible future video, please follow the links and instructions in the description.
Thank you for watching, I'll see you next time.