Hare

aka HD Euthanasia / Hare Krsna

Hare virus payload message
discovered
1996-07
origin
Slovenia
reported by
various
family
Hare
size
7610 bytes
platform
DOS and Windows 95
vector
COM and EXE files, master boot record
payload
destructive, polymorphic
trigger
August 22 and September 22

Payload

Displays the message HDEuthanasia by Demon Emperor and overwrites the first track of every disk it can reach.

In the summer of 1996, a virus emerged from Slovenia that collapsed the boundary between spiritual practice and digital destruction. The Hare virus, attributed to an author calling themselves Demon Emperor, carried a name that worked on multiple registers: it referenced both the Hare Krishna movement and the concept of hard drive euthanasia, a perverse act of mercy conducted through code.

The virus was multipartite, meaning it didn't choose between infection vectors. It hit COM and EXE files. It corrupted the master boot record. This redundancy made it harder to remove, harder to contain. On August 22 and again on September 22, the virus would trigger: it would display "HDEuthanasia by Demon Emperor" and then overwrite the first track of every accessible disk. A payload that was both message and mutation.

What's striking about Hare is how it embodied a late-1990s particular kind of chaos: the author was not a teenager playing with a kit. Demon Emperor demonstrated technical sophistication. The virus was polymorphic, meaning it changed its signature with each infection, making antivirus detection a guessing game. The Windows 95 platform was metastasizing through corporate offices, and Hare could spread through both DOS and 95 machines. It was built for an ecosystem in transition.

The spiritual name was not accident. By the mid-1990s, virus authors were thinking of themselves as a kind of counterculture. The Hare Krishna reference sits uncomfortably, carrying undertones of the appropriation and mockery that would dog the movement's visibility in Western culture. But it also suggests something else: the author knew that a virus's name would be remembered, discussed, feared. The name itself was payload.

At a fame rating of 4 out of 5, Hare circulated. It hit systems in the wild. Users encountered that August 22 trigger date and watched their drives get erased. The virus achieved what most threats aim for: notoriety. It made people afraid to boot their machines on certain dates. That's a kind of power.

Hare represents a moment when virus writing was moving toward sophistication and away from mere chaos. Demon Emperor knew multipartite construction. Knew polymorphism. Knew that a trigger date would make the virus more memorable, more feared. This was engineering with intent, even if that intent was destruction.

The virus is dormant now. It lives here, archived, analyzed, defanged. But the message remains readable: "HDEuthanasia." A proposition wrapped in code. A reminder that even in digital sabotage, authors have something they want to say.

Related specimens

Sources

  • Virus Bulletin, July 1996 :: Virus Bulletin, July 1996, Hare analysis

last updated: 2026-04-12 :: curated by the_curator