HOW WRITE YOUR OWN MUAZZIN

Muazzins receive control at first byte, and can respond to the following
request, passed in the appropriated structure:

MT_QUERY           - called for all muazzins, used for self identification,
                     should return name, version, and requests it support

MT_PROCESSDROPPER  - called with the buffer and the current size as parameter,
                     is the place to insert poly over the dropper, change the
                     icon, and all other things that affect the form of the
                     pe exe dropper, that is the traveling form of the virus.

MT_BLOCKIP         - called with the IP that the user pretend connect and the
                     port, it have several uses. Can block the IP of AV sites
                     in the internet, can save the smtp and nntp server that
                     the user uses, can scan for open machines in these
                     network, etc...

MT_APP             - generic porpouse, is here the place for payloads, scan
                     for files of different kinds to infect, and all other
                     type of thing.

MT_GENTEXT         - to avoid suspicion, the text used for sending e-mail is
                     generated by this muazzin. it create the body of msg,
                     the headers, and determine the attachment name. Here,
                     you can put your engine and generate random but still
                     understandable texts about sex, pokemons, jokes, etc...

MT_BLOOM           - here, the muazzin should try to contact a source of
                     muazzins and retrieve they. Acessing usenet newsgroups,
                     irc, pop3 e-mail account, www/ftp sites, all is done
                     here...

MT_BREED           - called each full moon, is the time for the muazzin send
                     all muazzins installed in current system to places where
                     others muazzins, by using MT_BLOOM, can retrieve they.
                     Post to usenet, sending emails, etc should be done here.

Notice that a single muazzin can respond to more than one type of call. Is a
good idea make they work together: a muazzin that generate texts about pokemon
in MT_GENTEXT can also change the icon, in MT_PROCESSDROPPER. A muazzin that
scan for back orifice backdoor at each MT_BLOCKIP and upload itself to there,
should also process MT_APP, coz the dropper, that it will need to upload to
backdoor, isnt passed in calls to MT_BLOCKIP. Etc...

Also notice that these rules arent written in stone: nothing forbid you to,
in a dynamic system as IRC, use MT_BLOOM to receive and also send muazzins,
or like.

Once you have written your own muazzin, you should encrypt and sign it with
the included utility, and should test it lots. They key included in this
release isnt the key that the virus carry, so, dont wait for it work with "in
the wild" samples. If you think that others infected machines need your
muazzin, contact me for a signature.
