MEMZ
MEMZ is a trojan horse created for Microsoft Windows.[1][2][3][4][5] The name of the malware refers to its purpose as a humorous Trojan intended to replicate the effects of early computer viruses. OriginMEMZ was originally created by Leurak for YouTuber danooct1's Viewer-Made Malware series.[4] It was later featured by Joel Johansson, alias Vargskelethor, a member of the livestreaming group Vinesauce on his series Windows Destruction. Here, he demonstrated the trojan in action against a Windows 10 virtual machine[6] after being provided with a copy by danooct1. PayloadsThe trojan gained notoriety for its unique and complex payloads, which automatically activate after each other, some with delay. Examples of payloads include displaying a Windows Notepad file that reads:
Others include randomly moving the cursor slightly; opening up satirical Google searches under Google.co.ck, such as "how to remove a virus" and "how to get money" on the user's web browser; reversing text; and opening various random Microsoft Windows programs, such as the calculator or command prompt. True to the program's name, many parts of the trojan are based on Internet memes; for example, the trojan overwrites the boot sector with an animation of Nyan Cat.[1][2][3][4][5] Leurak also created a safer version of MEMZ called MEMZ-Clean. The clean version allows the non-destructive payloads to be safely tested and gives the user full control about which payloads are active.[7] VineMEMZ VariationA variant of MEMZ, dubbed "VineMEMZ", was coded by Leurak as a gift to Johansson after the livestream featuring the original MEMZ gained significant traction. This version of MEMZ is similar to the original, but features many references to Vinesauce, especially Johansson's other game streams, such as the bootleg game 7 Grand Dad and the adware program BonziBuddy. This variant has also been released to the public.[8] VineMEMZ running on Windows 11. Depicted is one of its payloads, the christmas light effect, where it changes the screen color. For this image, it is set to pink. Half of the payloads have executed at this point. References
|