Hello everyone today we're going to take a look at
"Rabbit," the very first Visual Basic Script, or VBS virus
to ever exist.
This was written in the late 90s and although it is
exceedingly simple as far as VBS viruses go, it paved
the way for many more to come including the infamous
Love Letter Worm that took down computer networks all
over the world in the year 2000.
We can go and open this up and check out what it does.
It is only 11 lines of code and 2 of those are comments.
Basically all it does it scans through the current
directory and overwrite every VBS file with a copy
of itself.
And if the day is the 15th of the month, then it opens
up the CodeBreakers's website.
And CodeBreakers was a virus writing group in the
late 90s and early 2000s and this particular sample was
coded by Lord Natas.
So you can thank him for helping to pave the way
for Visual Basic Script malware.
And one last thing to check on our desktop, we have a
test VBS all it is on it is a message box.
Run it, and it says "Hello".
And that's it.
So let's get right to the virus.
We'll go and run it, and nothing apparently happens.
But if we look at our previous test VBS, it is
no longer a simple message box. It is been overwritten
with the contents of the virus.
So it goes both ways. It doesn't care which one we're
running, each one is overwriting the other.
It pops up a command box sometimes, you can see
it. There was a second variant of this virus and the only
thing it changed was it removed that command prompt
box from popping up when it executed
and it also autoran the CodeBreakers's website.
So let's see that payload real quick in action.
Change to the 15th, run any of these, you get the
message box, "VBS v1.0," click OK, and we get a
shortcut to the CodeBreakers's website
"codebreakers.org"
Unfortunately, it no longer exists and we get a park
domain page if it every loads here
on our excellent IE5 I believe...
There we go it loaded, ok, that's fine.
I'm completely fine with webpages not showing up
okay, I can't imagine why that might happen.
Oh, yes, we are on Internet Explorer 5 and the colors are
really washed out for some reason my virtual
machine is going nuts.
But this domain is parked and you can really see how
something as simple as this can help pave the way
for future viruses and worms and all that stuff
because if we edit this, its very easy to read and just
sort of see what's going on and we can change this,
instead of "*VBS" how about "*.*" That would infect
every file in the directory (and yes I want to save these
changes). And let's add a new file here.
New bitmap image, ok...
"cool"
No... "cool.bitmap".
There we go.
And its coooooooooool!
I can not write with the mouse.
But there we go.
"Cool", it pops up, its good.
Now we run this and our file has been overwritten, we
see it jump positions here and now Paint can not read
this file, unfortunately.
We change this to something that we can open in
Notepad really easily.
And we see it is indeed been overwritten.
And we can unleash some real havoc here
if we go to our Windows directory and we just put it
right here.
And let's run it.
Alright you can see the command prompt going
through every file and scroll down.
Nothing opens anymore.
No text documents will open because Notepad
no longer works.
Oh... what's going on here?
I don't even know, but it looks like we broke it, so go us!
Alright we're attempting to get on here...
Defrag... does not work.
M386... nope.
Explorer... still works alright!
We're moving up on the world!
We're doing alright for ourselves.
Net.exe, no.
Netstat, get out of here!
You know, anything we run, can't open text,
can't open bitmaps that are all invalid. Paint still works!
Amazing, I can't believe it, Paint has held on,
I am so proud of you!
And if we go ahead and restart here, we will see that
it won't error out after restarting because all of our files
are still present, however they have been overwritten.
So our computer hangs on this Windows 98 screen
because it can't actually load any of the files to boot
the operating system.
So something like Rabbit could be, and indeed
was incredibly dangerous because although simple
and not that destructive overall, it is easily
changed as we see to become incredibly destructive
and sort of (you know) plants that seed in the brains of
other authors of the period. See now there's a new
method of writing malware, you can use the
Windows script process and you can just cruise
on to anyone's files, overwrite, delete, do
do whatever you want, eventually that evolved into
emailing (and we saw stuff like Love Letter
and Anna Kournikova, which I haven't taken a look at
on this channel, maybe I should) and that is about it.
Thank you for watching. Take care.
(8-bit music plays)