Hello, everyone! Today we're taking a look at "Neg", a macro virus written for Excel, rather than Word.
I like this one quite a bit, because with Excel, there are different ways to hide your work,
and this macro virus employs some pretty interesting techniques to try to avoid detection by the user.
As you can see here we have three variants:
We have B, C, and E,
and we'll run each one and they'll ALL infect Excel, and so we will end up with a very thoroughly infected spreadsheet before the end of this video.
We will go ahead and open the B variant, and nothing much appears to happen.
We have our spreadsheet open,
we can navigate to our macros,
we can see here that we have three macros in this file.
And three in a file called lore.xlm.
However, we do not see that file anywhere.
But thankfully, the virus does not lock it down,
And we can jump right into the code and see what's happening.
So we have some nice credits here at the top of the macro
Uh, 'NEG' is a trademark of NoMercy. Please include this text, generated with NEG.
Uh, i'm not sure what NEG is but..
We have a website and I tried visiting it, unfortunately it does not exist anymore.
UNFORTUNATELY.
Virus name is apparently supposed to be Lord, but Kaspersky decided it should be 'Neg'
And was written my Foxx with Neg
So, moving right along and moving clippy right out of the way,
we can see in this code that it employs one technique
It uh, actually checks to see if lord.xlm is running
And creates this as a hidden worksheet
And this is where it actually infects new worksheets and if this is running it's able to infect other stuff that is happening in Excel
So in the sub fuck, we can see that it turns off screen updating so that you can't see what's happening,
It activates the lord.xlm window, and makes it visible, activates it, makes sure that the sheet is visible, and then copies it to your current workbook so it is infected
And then turns them all off and makes the invisible and then reactivates screen updating.
so you won"t see this actually happen, but it will actually create this worksheet,
and attach it to the one you're attempting to use, and infect it and then hide everything that it did.
And we can actually see this if we go back here, we goto window, and on hide,
we can see unhide the workbook 'lord' where we now have two workbooks open,
and this one is trying to infect everything that runs.
And finally we have a payload for this variant.
Close out of it real quick here.
If you close one it closes both.
And we change it to the first of the month,
Run it again,
and close.
It says, 'get the best execel scanner, NVT-98'
So, pretty much referring to antivirus software you can get, because you're infected dOOd
Press OK, it goes away.
Move along to NEG-E now, and uh, we get some interesting notice from excel, that blablabla we don't care.
[inhale] macros aren't stored in the document, and we can see that this a sacrificial goat file from Sophos
And once again we can take a look at our macros, however we seem to be gaining some
we've got lord running, because it appends itself to every excel spreadsheet we open
Now I've also got 'neg.xlm'
Which is also infecting everything that we open.
If we edit it, we can see that it attempts to uh, hide everything we were just in.
uhhhh
It did not successfully delete all of these menu bars because we are here reading this code.
So.. you try.
If we keep on scrolling, things are generally pretty much the same.
And we just have a different message when we close out of excel on the 13th of the month.
So let's do that :D
We can see here 'Get the best Excel Scanner' because we are still infected with the first variant.
[Sexy Beats]