Hello everyone,
today we're taking a look at the Dumb VBS worm.
Now, unlike many other Visual Basic Script worms we've looked at on this channel, this one is actually very well written
but weighs in at only 41 lines of code, including comments and blank lines.
Now how could this be, you might ask? Well, let's take a look at it and we will let this worm speak for itself.
So here is Dumb, we have it on our desktop, we're going to run it...
it's going to drop a file in this fake MIRC directory I created, and it's going to send some emails.
And Clippy is here to spectate, so let's go ahead and run the worm.
[Dumb runs, but not dumbly]
So the hard drive ticked for a bit and we see the worm send itself out, and script.ini appears in MIRC.
Right from the get go we see "This is a worm," so let's take a look at these emails that Dumb is sending out.
So we see "This is a worm, make sure to be a dumbass and open this - the sender was."
And we have our original attachment reattached. So it sends it to all of your contacts in your address book.
And quite obviously it has very little respect for anybody who might've been infected with a worm with a Visual Basic Script extension.
Taking a look at this script.ini file, we can see that on joins to new channels, it's sending itself from our Windows NT directory.
And we see this rather interesting file name that includes "worm" in parentheses, so once again there is no attempt
to hide what Dumb truly is. We can navigate there and check it out for ourselves.
[quietly] Scroll on down...Is it down here? No it's going to be in the System32.
And all the way at the bottom...yeah here we see "XXX Pics Worm dot text dot JPG dot EXE dot COM dot GIF dot VBE dot JS...dot VBS.
Some of you liked it when I kind of psychoanalyzed the author who may have written the Jesus VBS worm a couple weeks ago.
Allow me to do just one more. I'm sensing somebody here who is fed up with script kiddies, fed up with stupid clones of the Loveletter worm
which only came out a year or two before Dumb did. And someone who really does not like this method of hiding the true file extension
by burying it with other file extensions to trick the user. If you recall back to the original Loveleter worm it sent itself as
"LOVE-LETTER-FOR-YOU.TXT.vbs," and because of default Windows behavior, it would hide the .vbs part, leaving only the .txt part visible.
Dumb takes this to the extreme, having not one, not two additional extensions, but eight total including vbs.
Now that's pretty funny. Now, only having 41 lines of code, Dumb does not include any kind of precaution or flags
to prevent itself from being mailed out again, so if we run this...
we see "This is a worm," but now we have our original attachment name attached to this email.
So now it's even more obvious what this email is supposed to be and what it's attempting to do to the end user.
Now of course, being Visual Basic it is very simple to come into the code here
scroll on down - we can change the name that it's saving itself as. We could even change the subject or the message body.
So in less than thirty seconds, anybody could open this up and rewrite this information to be slightly more subtle.
Something along the lines of "kindly check the attached LOVELETTER coming from me."
But in this case I'm sensing a great deal of hostility and contempt from this worm author
directed towards whoever might actually want to create something like Loveletter, or one of its many dozens of variants.
But it's not destructive. Like I said, only 41 lines - it doesn't delete all your files.
And while you could easily add a routine in there to do that, Dumb does not, because I believe this was meant to be a proof of concept.
And it doesn't even run itself on startup, so we're going to restart and show that to be true.
Also because I don't have a good take of Windows 2000 booting up with its lovely startup sound.
So enjoy the seek test and the bootup.
Yes I wanna exit...and we loaded the, uh, Zapotec wallpaper I was looking at before I started recording this video.
[spooky ghost wallpapers]
[3.5" floppy A: drive grinds menacingly]
[quick disk eject and POST beep, then drive check]
I almost forgot to eject the disk.
[hard drive whirrs softly as Windows 2000 loads]
[thanks for sticking around - I'm amazed you aren't skipping ahead]
[nearly there...]
[floppy drive clicks for some reason]
[Windows 2000 bootup music]
Beautiful. It's been a long time since I've heard that one.
And Dumb, being as nice as it is, doesn't even launch on startup.
Or maybe it does - okay, so it did email itself again. So maybe I thought the author was being a little too nice.
No, it is a true worm - it does add itself on startup to the registry so that it can launch itself.
Oh good, Clippy's here. But at any rate, it's not destructive,
and it's well written - I didn't have to fix anything on it to get it to work.
It does what it's intended to do. And what it's intended to do is apparently mock those script kiddies
who think that making minor tweaks to existing malware makes them cool.
So that's about it for the Dumb Visual Basic Script worm, thank you very much for watching,
take care. :)