> For the complete documentation index, see [llms.txt](https://arachn3.gitbook.io/malware-development-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://arachn3.gitbook.io/malware-development-guide/intermediate-malware/worms.md).

# Worms

> A **computer worm** is a standalone malware computer program that replicates itself in order to spread to other computers. It often uses a computer network to spread itself, relying on security failures on the target computer to access it.
>
> * Wikipedia

A worm is a program that *spreads itself* across a network without user interaction. Unlike viruses which attach to files or trojans which trick users, worms are self-contained and just keep multiplying on their own. The key thing is **self-propagation** - infect one machine, and the worm spreads to the rest automatically, with each infected machine becoming a new launchpad.

## SQL Slammer

Alright so let me tell you about this one. January 25th, 2003, a 376-byte UDP packet starts spreading across the internet. It's exploiting a buffer overflow in Microsoft SQL Server, no handshake needed, just fire and forget.

Within 10 minutes, 90% of vulnerable hosts on the entire internet were infected. The thing doubled every 8.5 *seconds*. Bank of America ATMs went down, Continental Airlines couldn't process tickets, Seattle's 911 stopped working. 376 bytes, 10 minutes, and it didn't even have a payload - it just spread.

Some other greatest hits: Code Red in 2001 infected 359,000 hosts in 14 hours, Conficker in 2008 hit 9-15 million machines and is *still active*, WannaCry in 2017 took out the UK's National Health Service, and NotPetya also in 2017 caused $10 billion in damage while looking like ransomware but actually being a wiper.

## How It Works

```mermaid
flowchart LR
    A[Infect Host] --> B[Scan for Targets]
    B --> C[Exploit or Auth]
    C --> D[Copy Self]
    D --> E[Execute]
    E --> B
```

Find targets, get on them, repeat. Each infected machine runs the same loop, leading to exponential growth until you run out of vulnerable targets. The scary part is that no human interaction is needed after initial infection - worms just go, and you could be asleep while your network gets completely owned.

## Spreading

Two main approaches here.

**Credential-based** spreading means trying default or stolen creds against network services. Sounds primitive but it works great - Mirai took down Twitter, Reddit, and Netflix in 2016 by trying just 62 default username/password combos against IoT devices. Turns out "root:root" and "admin:admin" get you pretty far when you're targeting security cameras. SSH on port 22 for Linux with passwords like root/toor or pi/raspberry, SMB on port 445 for Windows shares, RDP on 3389 for remote desktop. Even a 1% success rate is devastating at scale.

**Exploit-based** spreading uses a vulnerability instead of guessing passwords. SQL Slammer exploited a buffer overflow where no login was needed, just send the packet. WannaCry and NotPetya both used EternalBlue (MS17-010), an SMB vuln leaked from the NSA. This is faster than cred stuffing but needs either a zero-day which is rare, or unpatched systems which are common but the window shrinks as people update. Best approach is to try the exploit first and fall back to creds.

Other vectors include ILOVEYOU which emailed itself to Outlook contacts, Stuxnet which spread via USB drives to reach air-gapped targets, and NotPetya which came through a compromised software update as a supply chain attack.

## Payloads

Once the worm lands it can do whatever you want. Destructive payloads delete files and brick devices - NotPetya encrypted the MBR with no way to decrypt, and Stuxnet targeted Siemens PLCs to make centrifuges spin at wrong speeds while showing normal readings, physically destroying around a thousand of them. Resource theft payloads do cryptomining or build botnets like Mirai which did 1+ Tbps DDoS attacks. Espionage payloads keylog passwords, screenshot activity, exfiltrate docs, and map internal networks. And then there's trolling - changing wallpapers, inverting mouse controls, playing sounds, opening and closing CD trays. Old school vibes.

## Architecture

```mermaid
flowchart TB
    subgraph Worm["Worm Binary"]
        Config[Config<br/>targets, creds, flags]
        Scanner[Scanner<br/>TCP/UDP probe]
        
        subgraph Vectors
            SSH[SSH Vector<br/>bruteforce]
            SMB[SMB Vector<br/>share auth]
            Exploit[Exploit Vector<br/>CVE payloads]
        end
        
        Payload[Payload<br/>miner/troll/wiper]
        Self[Embedded Self<br/>go:embed]
    end
    
    Config --> Scanner
    Scanner -->|open ports| Vectors
    SSH & SMB & Exploit -->|success| Self
    Self -->|deploy + exec| Target[New Host]
    Target -.->|runs| Worm
    Payload -.->|optional| Target
```

The **scanner** finds targets on the network. Naive approach is to blast every IP, smarter approach is to randomize order, add jitter, and use passive discovery first by checking ARP tables and DNS cache. There's a speed vs stealth tradeoff here - SQL Slammer didn't care about stealth and just wanted to spread fast before anyone could react, while Stuxnet was slow and careful because it needed to stay hidden for months.

**Vectors** are modular spreading methods where an SSH vector bruteforces SSH, an SMB vector targets Windows shares, and exploit vectors use specific CVEs. Design them as plugins so you can mix and match.

For **self-embedding** the worm needs to carry itself somehow. Go uses `//go:embed` and Rust uses `include_bytes!` to make a single file, though it gets bigger. Alternative is downloading from C2 but that's a single point of failure.

## Keeping It Under Control

Worms get out of control even for the attacker. Robert Morris in 1988 made a "harmless" worm to measure internet size but a bug caused re-infection which crashed machines and infected 10% of the internet, becoming the first federal computer crime conviction.

A **kill switch** lets you stop it remotely - WannaCry checked if a specific domain was registered and a researcher found it, registered it for $10, and stopped the spread through what's called "sinkholing."

**Scope limits** restrict spread to only RFC1918 addresses, specific subnets, max hop count, or time-based expiration.

**Infection markers** check for a marker file, process, or registry key and exit if present, preventing resource exhaustion and reducing detection noise.

## Evasion

Use standard ports like 22, 445, and 443 while mimicking legit protocols, adding delays, and randomizing target order since sequential IPs scream "automated scan." Name the process something boring like `svchost.exe` or `kworker`, use low CPU priority, or inject into an existing legit process. For anti-analysis, check for VM artifacts, debuggers, and analysis tools, then exit or behave normally if detected.

## Stuxnet

The most sophisticated worm ever discovered. Target was Iran's Natanz nuclear facility, specifically the uranium enrichment centrifuges, and since it was air-gapped they spread via USB drives.

It used *four* zero-days which is unprecedented, and spread through Windows looking for specific Siemens Step 7 PLC software. When it found the right PLCs with specific frequency converter drives at specific speeds matching the exact Natanz config, it altered rotational speeds while replaying "normal" readings to operator screens. The centrifuges tore themselves apart and operators saw everything was fine.

Destroyed around 1000 centrifuges and set Iran's nuclear program back years. Almost certainly US-Israeli and demonstrated that malware could cause physical destruction.

## Building One

Go is probably best since it gives you a single static binary with great concurrency, solid SSH support, and trivial cross-compilation. Rust works if you want memory safety and smaller binaries than Go. C gives the smallest binaries but you handle everything yourself.

## Implementation

For a working worm with scanning, SSH/SMB vectors, embedded payloads, web UI, dry-run mode, and troll payloads, check out [glowworm](https://github.com/ARaChn3/glowworm). It's Go + Fiber + React and designed for educational use with safety features.

### References

* [Computer worm - Wikipedia](https://en.wikipedia.org/wiki/Computer_worm)
* [SQL Slammer - Wikipedia](https://en.wikipedia.org/wiki/SQL_Slammer)
* [Stuxnet - Wikipedia](https://en.wikipedia.org/wiki/Stuxnet)
* [Mirai (malware) - Wikipedia](https://en.wikipedia.org/wiki/Mirai_\(malware\))
* [NotPetya deep dive - Wired](https://www.wired.com/story/notpetya-cyberattack-ukraine-russia-code-crashed-the-world/)
* [Remote Services - MITRE ATT\&CK](https://attack.mitre.org/techniques/T1021/)

### Libraries & Tools

* [Fiber - Go web framework](https://docs.gofiber.io/) - used for the control panel server
* [Bubbletea - TUI framework](https://github.com/charmbracelet/bubbletea) - for building terminal UIs
* [Lipgloss - styling for TUIs](https://github.com/charmbracelet/lipgloss) - pretty terminal output
* [x/crypto/ssh - Go SSH client](https://pkg.go.dev/golang.org/x/crypto/ssh) - SSH vector implementation
* [go-smb2 - SMB2/3 client](https://github.com/hirochachacha/go-smb2) - SMB vector implementation
* [Neurax - Go worm framework](https://github.com/redcode-labs/Neurax) - another worm implementation to study