Hello everyone,
today we're taking a look at the Hold VBS trojan.
This trojan is fairly simplistic but quite destructive,
and has some changes in behavior depending on which country you're located in.
Before we take a look at the trojan itself, we're going to take a look at these dummy documents
I've got on my desktop. We've got the "Important text file,"
the "Important log" (it's the same thing),
this Zip file which contains both of those,
this unstoppable virus that I wrote because I'm such a cool guy,
my resume (please hire me), we've got the budget,
it's looking good, and we've got a presentation that I made that just sort of...
...highlights some important things in the computing industry.
We've got a few ROMs, and Nintendo if you're watching this -
I do not condone piracy in any way whatsoever, I obtained these totally legally. Please don't delete my channel.
We also have this MP3...
a cool song.
[Mega Man 2 Dr. Wily Stage 1 briefly plays]
Capcom if you're watching, please don't delete my channel either.
I kinda - I like it. Don't delete it.
So just for the record, these are Super Nintendo games, and this one is a Gameboy Color game, which is important later.
And finally, we've got just a couple of default Windows JPGs.
So, first things first, I changed the country code in Regedit to 34,
which equates to Singapore for this trojan's purposes.
Now if you happen to find yourself in Singapore, this would be your experience with this trojan.
Let's go ahead and run it - [Windows XP critical stop sound]
and oh, we got a [sic] invalid character, hold on. One moment.
Okay, take two, if you're in Singapore this is what you would see.
We run it...
and you see....nothing. [Bummer.]
[sarcastically] Cool!
But what it *actually* happening, if we go up here and collapse this, and go to our...
...favorite...Microsoft\Windows\Current Version\Run...
[the folder that tells our lovely worms and viruses to run on startup]
We can see the trojan has added the "Please" entry,
pointing to the fonts directory with "JERRY.VBS."
Now this is interesting - if we actually go into the fonts directory...
[the suspense builds]
...we do not see it.
These are all just fonts; we don't see that VB script icon anywhere
However, it is there.
Let's go into our search. I've already prepared it, we're going to search for "vbs" on drive C:.
And there we go, we can see three actually in the fonts directory.
We've got Jerry, ORD.DOC.vbs. and ORD photo dot jpg dot vbs.
And it's really interesting that we can't see those at all, even though we're looking right at the folder.
That's because the fonts folder behaves a little bit differently than any other folder on Windows.
If we drag and drop this JPG in here,
Windows thinks we're trying to install a font, and it'll tell you it can't do it.
And okay it's "damaged." Can't do it. Cancel. And...nothing appears in there.
So the only thing that will show up in this folder are fonts, but, if you go in through the back end with a Visual Basic script,
as you can see through the search, you can definitely copy files there.
So now we've got Jerry.VBS ready to go on start up, and that's just another copy of the trojan.
So we have three separate copies that are all the same thing.
And we do have a message box that pops up on June 12th, so let's look at that.
[clicking through date and time to activate a trojan like any other ordinary user]
[Windows XP: DUNNNN]
So there we go, our message is "Happy Birthday! ORD LOH, End of Suffering, happy birthday
Edwin and Jeremy." So, happy birthday. Hopefully this trojan is everything you'd want in a present.
[virus birthday wishes are the best birthday wishes]
So that's all well and good, but what happens, you may ask, if you are not in Singapore? Let's find out.
I figured I'd show you the way the trojan keeps track of what country you're in,
cuz if you're in Singapore according to the registry, it adds a key to the Software part under HKEY\Local Machine, Singapore equal to 1.
However if we now change our country code back to 1 for United States cuz that's where I'm at,
or any other country. So if you're not in Singapore, you're not gonna have a good time.
So let's keep our eyes on the desktop. You ready?
Aaaaand, go! [Windows XP chimes in] Oh, we got our message box.
Aaaand.....nothing. [how disappointing]
Well it seems like *something* should've happened, right?
[time to put in some virus-improvement work]
We come back over here to our Singapore key and now we can see it's set to 0, so obviously the trojan recognizes that the country code changed.
But still, we didn't see anything happen.
So I'm assuming that this is crashing, so we're going to edit out "On Error Resume Next,"
which for Visual Basic script tells it that when you encounter an error, don't say anything, just go to the next line of code and continue.
Unless of course it's a fatal error that the script can't continue from, in which case it just crashes entirely, and does not run anymore.
But, since it has this line in it, you don't see anything.
We can see that the author wanted to call it "ORDLOH," but I guess the antivirus vendors liked "Hold" a little better.
I'm not really partial to either, so I don't have an opinion on that, but it is what it is.
[what would you have named it? let me know with a comment.]
Okay, here we go, let's see what's going on with this.
[Windows XP is, once again, tired of your shenanigans]
We've got a "Type Mismatch, File Exists,"
on line 12.
So let's see, we've got [counting softly] 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11...12.
So I'm just going to point this directly to the FileSystem object it made...
...and try that. Okay, let's try that one more time.
[Windows XP say not today!]
Whelp, same thing, okay let's fix that on all those other lines real quick.
Come back here! Okay.
[speaking aloud while typing] "F," "S," "O," "dot."...
...No not slash, dot.
[not slashdot either.]
And finally, "F," "S," "O," "dot," alright, let's save.
Aaaaaand, go!
[DUNNN] Oop, we got our message. [DUNNN]
Ohh, permission denied, so, it's trying to manipulate some file - we didn't see that before.
[the gears turn in my head, slowly]
Everything's still here.
What's happening is Hold is attempting to delete files with extension of, you ready? There's quite a list, so be prepared:
ZIP, ARJ, RAR, ACE, LHZ, DOC, LOG, JS, RTF, PDF, ASM, WP, TXT, XLS, MDB, Powerpoint [PPT], AVI, MPEG, ASF, RM, MOV, MP3, MP2, MP,
MOD, MID, WAV, so sorry any MOD file music lovers, this trojan is not the trojan for you.
Also gets JPG, JPEG with the E, GIF, (or is it Jif?), BMP, and then finally,
for whatever reason, [it] targets SMC, GB, GBC, and GBA files.
Which as we can see here are Super Nintendo and Gameboy based ROM files, for the most part.
[piracy is bad, mmk]
I'm sure there's probably some other programs that utilize those file instructions, but,
most of us who watch this channel know it's probably related to Nintendo ROMs.
Well the reason why this is crashing so spectacularly is because Windows is constantly writing to one of those LOG files,
so we're going to scroll down here, and we're gonna take out LOG.
[viral hacking intensifies]
[clack clack hack hack]
Now let's try it! We ready?
Let's go! Take two for Hold deleting everything.
[DUNNNN]
[annoyed] Okay, end of suffering.
OHHH, there it goes. So we took LOG out so "important.log" survived.
And eventually we reach something that we couldn't delete and we got "Permission denied" again,
but it was not soon enough to crash the script to save all of our data. So that important budget,
my beloved resume, my amazing, uh, virus that I wrote in Javascript,
clearly Javascript and not anything else,
the Powerpoint, all those lovely photos and the ROMs, everything is just gone.
I'm sure Nintendo probably would've liked the ROM part, but probably not any of the other parts.
This trojan wasn't very widespread - I mean, you're not in Singapore, the instant you run it everything gets wiped.
But, it doesn't get wiped because that log file is in use, but I guess if that log file wasn't in use then maybe it would trash all your data.
But in most cases it seems like you're not gonna see anything happen at all once you run this script.
How 'bout we have some fun with it?
Bring it back up. Instead of Zip, how about we just do EXE.
And instead of ARJ, how 'bout DLL?
That sounds fun, let's go!
Bet it'll crash pretty quick, but let's give it a shot.
[DUNNN - Windows XP is beyond done with this video]
Let's see if anything goes wrong with Windows XP.
[DUNNN hard with a vengeance]
Okay, "Permission denied" at long last.
"Umm...I don't know if we're missing many EXE files in the Windows directory at least.
Yeah I can still see plenty of stuff here.
Seems like it didn't make it far enough into Windows to really trash everything.
But you know I noticed something - it is trying to delete Regedit as well but we have that open.
So I'm gonna try closing that and we'll relaunch the trojan just to see if we can actually delete our EXE or DLLs.
[DUNNNNNN]
[DUNNNN2: dunnn harder]
Alright, so we're still running into something that's in use, it doesn't look like it's gonna let us delete the EXEs just as simple as this.
I do recall a recent video I made on another Visual Basic piece of malware that suffered the same problem
and I had to make a huge string of files that it wasn't allowed to try to delete, before it would actually destroy the system.
So I'm guessing you could do the same sort of..."fix," here.
Not that you really want to destroy your PC - I mean *I* do, but you probably don't.
So, pretty destructive if you're not in Singapore, but maybe not just because it's not very well coded.
I guess that holds true for a lot of malware from this era.
But, that is about it for the Hold VBS trojan, thank you very much for watching,
take care :)