MEMZ

"tunnel" payload

**MEMZ** is a trojan horse created by Leurak for the YouTuber Danooct1's *Viewer-Made-Malware* series. It is well known for it's complex and unique payloads. Like the name suggests, many of MEMZ's payloads are inspired by/based on memes.

## Payloads

When run, 2 messages pop up, both of which warning the user that the program they have just executed is malware that will harm their computer, and to click "no" unless they are using a virtual machine.

if the user clicks "yes" on both warnings, a text file will appear, informing the user that their computer is no longer able to boot and not to restart the system.

MEMZ opens websites including satirical Google searches and other sites in the user's browser.

#### List of websites the trojan opens:

* how 2 remove a virus
* mcaffee vs norton
* how to send a virus to my friend
* minecraft hax download no virus
* how to get money
* bonzi buddy download free
* how 2 get weed out of ur system
* how to code a virus in visual basic
* what happens if you delete system32
* g3t r3kt
* batch virus download
* virus.exe
* internet explorer is the best browser
* facebook hacking tool free download no virus working 2016
* virus builder legit free download
* how to create your own ransomware
* how to remove memz trojan virus
* my computer is doing weird things wtf is happenin plz halp
* dank memz
* how to download memz
* half life 3 release date
* is illuminati real
* montage parody making program 2016
* the memz are real
* stanky danky maymays
* john cena midi legit not converted
* vinesauce meme collection
* skrillex scay onster an nice sprites midi

* *answers.microsoft.com/en-us/protect/forum/protect\_other-protect\_scanning/memz-malwarevirus-trojan-completely-destroying/268bc1c2-39f4-42f8-90c2-597a673b6b45*
* *motherboard.vice.com/read/watch-this-malware-turn-a-computer-into-a-digital-hellscape*
* *play.clubpenguin.com* (redirects to *www.Disney.com as Club Penguin and Club Penguin Island have shut down*)
* *PC Optimizer Pro*
* *Softonic*

It may also open the following Windows applications:

* Calculator
* Notepad
* Command Prompt
* WordPad
* Registry Editor
* File Explorer
* Task Manager
* *msconfig.exe* (System Configuration)
* Paint
* *devmgmt.msc* (Device Manager)
* Control Panel
* *mmc.exe* (Microsoft Management Console)

After a while, the trojan starts randomly moving the mouse slightly, and messages saying "still using this computer?" appear, showing up more and more often as time progresses. Then, error icons get drawn below the cursor and plays random error sounds.

After a bit, MEMZ copies the screen's contents and places them on top, getting smaller and smaller each time and creating a "tunnel" effect. The trojan also inverts the colors on the screen

MEMZ creates multiple processes which monitor each other, and terminating 1 of the processes causes several error messages to pop up saying the following:

* YOU KILLED MY TROJAN! Now you are going to die.
* REST IN PISS, FOREVER MISS
* I WARNED YOU...
* HAHA N00B L2P G3T R3KT
* You failed at your 1337 h4x0r skillz
* YOU TRIED SO HARD AND GOT SO FAR, BUT IN THE END, YOUR PC WAS STILL F\*\*\*ED!
* HACKER! ENJOY BAN!
* GET BETTER HAX NEXT TIME xD
* HAVE FUN TRYING TO RESTORE YOUR DATA :D
* BSOD INCOMING
* VIRUS PRANK (GONE WRONG)
* ENJOY THE NYAN CAT
* Get dank antivirus m9!
* You are an idiot! HA HA HA HA HA HA HA
* MakeMalwareGreatAgain
* SOMEBODY ONCE TOLD ME THE MEMZ ARE GONNA ROLL ME
* Why did you even tried to kill MEMZ? Your PC is f\*\*\*ed anyway.
* SecureBoot sucks.
* gr8 m8 i r8 8/8
* Have you tried turning it off and on again?
* <Insert Joel quote here>
* Greetings to all GAiA members!
* Well, hello there. I don't believe we've been properly introduced. I'm Bonzi!
* 'This is everything I want in my computer' – danooct1 2016 (not included in the original version)
* 'Uh, Club Penguin. Time to get banned!' – danooct1 2016 (not included in the original version)

MEMZ then bluescreens the computer and shows the startup payload

### Startup payload

On bootup, instead of booting into the OS, the computer instead displays the following message:

"Your computer has been trashed by the MEMZ Trojan. Now enjoy the Nyan Cat..."

This is followed by an animation of the Nyan Cat being played.

## Clean version

MEMZ Clean Version is a harmless version of the trojan, which allows users to replicate the trojan's non-destructive payloads. This version does not include the MBR overwrite or startup payload, and uses a dialog box for triggering/toggling payloads.