|Place of Origin||Czech Republic|
|Infection Length||3,236 bytes|
Leviathan is a Windows 32-bit virus coded in 1999 by Benny. It is the first multi-threaded, semi-polymorphic, anti-debugging, anti-heuristic virus for 32-bit windows. It is also the first virus to attempt to simulate neural nets. Antivirus products often mistake the virus for Benny's Millenium because of some similarities between the two.
When a file infected with Leviathan is executed, it spawns seven threads from its main function. Each thread has a limited set of abilities, communicating and passing control to other threads.
The virus scans victim files for GetModuleHandleA and GetModuleHandleW functions for access to Windows Kernel functions. If it finds them, it will store the addresses of the functions in its installation routine. If it doesn't find the functions, it will not affect the file.
The virus keeps a generation counter for each new infection. When it has reached 30 generations, it will display a message.
Win32.Leviathan (c) 1999 by Benny Hey stupid ! This is gonna be your nightmare... 30th generation of Leviathan is here... beware of me ! Threads are stripped, ship is sinkin'... Greetz: Darkman/29A Super/29A Billy Belcebu/DDT and all other 29Aers... Special greet: Arthur Rimbaud New milenium is knockin on the door... New generation of viruses is here, nothing promised, no regret.
Several variants of the virus were coded by both Benny and other people. Most were likely by Benny, given he encouraged people to email him to suggest improvments and fixes to the virus. At least one was by someone Benny considered a lamer after someone posing as 29A member Z0mbie leaked the source code. All variants are between 3,040 and 3,432 bytes long.
He gave a copy of the source code to someone maliciously posing as Z0mbie on IRC (it was actually a someone he considered a lamer who usually goes by the name IntelServ) who made a modified version of the virus or leaked it to someone who did.
This variant displays the message:
Win32.Wildfire (c) 1998 Magnic I am/I can - The Wildfire virus. -d e c o d e- idwhereamif73hrjddhffidosyeudifr ghfeugenekasperskydjfkdjisfatued 938rudandmydickisgrowingehdjfggk
The virus is actually from 1999, in spite of what the message says and appeared shortly after the original.
Leviathan was coded some time in 1999 in the Czech Republic by Benny of the group 29A. It appeared in issue 4 of their magazine. When finished with the original, Benny shared the binary with friends who were interested.
Benny's intent when creating Leviathan was to create a virus simulating neural nets. The virus contains various functions, parameters and subroutines which are analogous to the cells and functions of a working brain, complete with neurons, dendrites, and axons. The virus however did not contain any learning abilities because Benny did not believe there was anything important for it to learn.
Benny described the virus as being very difficult to code. The methods of synchronizing the virus's threads was the most difficult. It was unoptimized and written to simulate a high-level language.
Name and Dedication
Leviathan was first mentioned in the Tanakh (Old Testament to Christians) as a sea monster. It may have originally been a whale, though the word "leviathan" can be used as an adjective describing any large sea creature. Leviathan is also one of four or seven princes of Hell and is important in LaVeyan Satanism.
The virus was dedicated to Jean Nicolas Arthur Rimbaud, a French poet known for his influence on modern literature. Rimbaud mentions Leviathan in one of his early poems, The Drunk Boat.
Benny.29A, Issue 4, Win32.Leviathan. 1999