Virus Writer Profile: Priest

Written by JPanic

Table Of Contents:

        About Priest.
        Virus: Satanbug
        Virus: Fruitfly
        Virus: Payback
        Virus: Jackal
        Virus: Predator
        Virus: Predator 2
        Virus: Incubus
        Virus: Natas
        References
        


% About Priest %

Priest (aka Little Loc) was a young but talented American virus writer, with a
career spanning 1992 to 1994. Priest's first two viruses, Incubus and Satanbug
were authored under the handle "Little Loc" while in later ones he called
himself "Priest" after joining Phalcon/SKISM. Priest seemed to be a fan of the
infamous virus writer "Dark Avenger" (dav) and studied his viruses, and what 
he considered other "real viruses" diligently. Like Dark Avenger, Priest often
included dangerous payloads in his viruses. Priests viruses were sophisticated
for their time, and many did well in the wild. Viruses by Priest include (but
are not limited to): Satanbug, Incubus, Fruitfly, Natas, Payback, Jackal,
Predator. In 1994 Priest was visited by the Secret Service, after a person
known as 'Aristotle', a BBS sysop for NuKE, handed over his personal details.
The fact that Satanbug had infiltrated the Secret Service's network causing a
small epidemic did not help. After these legal problems Priests was offered a
job at Norman Data Defence on finishing high school. This position did not
last for long. Although a skilled and 'elite' virus writer, Priest seemed
friendly approachable, willing to chat with newer and lesser vx'ers and even
help them out with coding problems. [1]

Back to top


% Virus: Satanbug %

'Satanbug' was probably Priest's (Little Loc) most publicised virus due to the
outbreak on the Secret Service's network. Satanbug was a polymorphic memory-
resident fast infecter of MS-DOS .COM and .EXE files, along with COMMAND.COM.
Satanbug was polymorphicly encrypted in both files and memory. Encryption
could have as many as 9 layers. Satanbug was also a retro virus, disabling
'Virus Scan' validation and 'CPAV' (Central Point Anti-Virus) immunisation
when infecting files. When a Satanbug infected file was run, the virus would
decrypt itself and then immediately relocate CS:IP so the virus was aligned at
offset 100h. This avoided the need for 'delta offset' operations through out
the virus. If run from a .COM file, Satanbug would next restore the first 4
bytes of the file that were patched during infection. At this point Satanbug
would check if it was already memory-resident and immediately return control
to the host if so. If Satanbug was not memory-resident, and not running from
an infected COMMAND.COM it would search the environment segment of the host
for 'COMSPEC=' string (COMSPEC variable). If COMSPEC did not equal
'COMMAND.COM' the Satanbug would again return control to the host with out
going memory-resident. When Satanbug goes memory resident it obtains the
segment of the host MCB (Memory Control Block) and then walks the MCB chain
until the last MCB is found. Satanbug reduces the amount of memory allocated
by the MCB, as well as the 16-bit WORD at 0:413h (BIOS Data - Size of
Conventional Memory in Kilobytes) to allocate memory for itself. The virus
then moves itself to the newly allocated memory. Next INT 21h (MS-DOS API) is
hooked in an unusual manner. An internal flag in the virus is cleared to
indicate that the virus is not in the middle of an INT 21h call. This flag is
used to avoid recursive handling of INT 21h calls due to the polymorphic
encryption in memory. The original INT 21h vector is obtained using
INT 21h/AH=35h (get interrupt vector), and a JMP FAR (opcode 0EAh) is built
pointing to the original INT 21h. Another JMP FAR is built pointing to 
Satanbugs own INT 21h handler, but the exact offset of this JMP will change
depending on whether Satanbug is currently encrypted in memory or not, and
whether it is in the middle of an INT 21h call. INT 21h/AH=25h
(set interrupt vector) is then used to point INT 21h to this second JMP FAR
(virus INT 21h handler). Memory-residency is now complete, and Satanbug
returns control to the host. When encrypted in memory the polymorphic code
PUSH's (saves) all the registers before decryption and the INT 21h hander
POP's (restores) them back. The INT 21h handler is used to provide the
memory-residency check and to catch files to infect. Satanbug is only
decrypted in memory if one of these INT 21h functions is called
(polymorphic stub checks the value of AH first). Files are infected on
open, extended open, and execute. When infecting a file Satanbug stores
address of the current DTA (Disk Transfer Area), sets the the new DTA 
address to the virus heap and calls an INT 21h/AH=4Eh (ASCII FindFirst) on the
filename. The ASII find record created in the new DTA provides Satanbug with
the files name in upper-case, size, attributes and date-stamp The DTA is then
restored to its original address. Satanbug differentiates the type of file
being infected with 3 checks: If the file begins with the 'MZ' header it is
treated as a .EXE file. If the filename is 'COMMAND.COM' it is clearly a
COMMAND.COM infection. Finally if the extension of the file is '.COM' it is
treated as a .COM file. If the file does not match any of these criteria, it
is not infected. If the 'read-only' attribute is set on the victim file,
Satanbug clears the attributes and restores them after infection. Infected
files are marked by adding 100 years to the date-stamp Apart from disabling of
anti-virus immunisation codes, the file infection algorithms are fairly
standard. Satanbug includes the text string:

Satan Bug virus - Little Loc

[1] [2] [3] [4]

Back to top


% Virus: Fruitfly %

In addition to the original Satanbug virus, there was also the 'Fruitfly'
variant. The main difference between Fruitfly and Satanbug was that Fruitfly
was not memory resident, infecting all .com files in the current directory and
directories in the 'PATH' environment variable. Additionally, Fruitfly only
infected MS-DOS .com files, not .exe. Fruitfly also deleted certain anti-virus
database files used for integrity checking: 'VS.VS' and 'CHKLIST.CPS':
ViruScan and CPAV (Central-Point Anti-Virus) respectively. Fruitfly includes
the text strings: 

Fruit Fly virus - Little Loc
Hacker4Life
Hackers In ThE Mist

[3] [4]

Back to top

 
% Virus: Payback %

After Satanbug came 'Payback'. Payback was a full stealth memory-resident
floppy boot sector and MBR infecter written in retaliation for the arrest of
members of the British 'ARCV' virus writing group. On January 27th, Payback
would erase the CMOS, format the first physical hard drive and display a
message. When a disk infected with Payback was run, the virus would setup the
stack and 'DS' (data segment) register. Payback would then allocate 1kb of
memory by decrementing the 16-bit WORD at 0:413h (BIOS size of conventional
memory) and hook INT 13h (BIOS Disk Services) directly in the IVT (interrupt
vector table). Payback then copied itself to this newly allocated memory -
after hooking INT 13h, but this should not be a problem. Once copied over
Payback would continue execution in this new copy and load the original
(uninfected) boot sector back to 0:7C00h (load address of a boot sector) using
INT 13h/AH=02h (Read Sector). The instructions to set registers CX and DX for
this INT 13h calls are modified by the virus on each infection to reflect the
correct location of the original sector on that disk. Payback then hits the
MBR. The MBR is loaded, checked if already infected (offset 10h = 12CDh,
INT 12h instruction of the virus) and checked if bootable (last 16-bit word is
0AA55h). If these conditions are met MBR infection continues. The original MBR
is written to head 0, track 0, sector 2 of the hard drive (unused by MS-DOS)
and address of this sector is stored in the virus (see above). Payback then
conditionally runs its activation routine and control is returned to the
original, 'clean' sector at 0:7C00h. Paybacks INT 13h handler performs two
functions: infecting floppies, and stealth. Both these functions are performed
if a read sector request (INT 13h, AH=02h) is called on head 0, cylinder 0,
sector 1 (boot sector/MBR). In such a case the INT 13h handler begins by
allowing the read of the boot sector to go through and aborts on error. Next
Payback checks if the sector is already infected - WORD at offset +10 = -12CDh,
same check as when infecting the MBR. If the sector is already infected,
stealth action is taken. If the sector is not already infected and is on a
floppy drive the disk is infected. Stealth is achieved through a simple
algorithm: CX and DX registers are saved, Payback takes the location of the
original (uninfected) sector from the previously read virus body, reads the
original sector over the infected sector in memory, restores registers and
returns from the INT 13h handler. When infecting floppies, the original
sector is stored in the last sector of the diskette. This sector is calculated
using the 'NumSectors', 'SectorsPerTrack' and 'NumberOfHeads' fields of the
BPB (BISO Parameter block) and checks are performed for non-standard disks.
The address of this sector is stored in the virus body, and Payback writes
itself to the floppies boot sector. As when infecting the MBR, Payback checks
if the sector is bootable by 0AA55h marker in the last 16-bit WORD of the
sector. On infection Payback displays the message:

That was for ARCV, mother fucker!
Payback! (c) 1993'

[1] [6]

Back to top


% Virus: Jackal %

'Jackal' was Priest's next virus. Jackal was a memory-resident full-stealth
multipartite infect of the MBR and MS-DOS .COM and .EXE files. Jackal
contained some interesting features. When infecting the MBR, Jackal only
modified 3 bytes of the partition table. When loaded from an infected MBR,
Jackal attempted to 'survive' a warm-reboot when 'CTRL+ALT+DEL' was pressed.
Jackal was also a destructive virus, containing 3 separate destructive
payloads. The condition for the first and most destructive payload is the
most interesting: Jackal infected files were able to detect the presence of
'TBCLEAN' (the generic file disinfection utility of ThunderByte Anti-Virus),
and disable its 'controlled environment'. When attempting to TBCLEAN a Jackal
infected file, Jackal would break out of TBCLEAN, lock the keyboard (port 21h,
IRQ Enable Mask), trash the CMOS (ports 70h, 71h), then entirely format all
hard drives reported by the BIOS then freeze the computer with 'CLI, HLT'
series of instructions. The other 2 payloads were executed periodically after
a file was infected. Jackal maintained a counter of files that had been
infected. If this counter value was a multiple of 32 after infecting the last
file Jackal would implement its lesser payload: A random sector is read from
the first hard drive, a random byte is modified in this sector, and the sector
is re-written. This lead to slow, gradual corruption of the data on the hard
drive. The other destructive payload was called if this 'infection counter'
was a multiple of 666h (1638 decimal): A randomly chosen track of the first
hard drive was formatted Both these last 2 payloads were gradual and at times
could go unnoticed. The last 2 payloads were only called if the BIOS INT 40h
(Floppy Disk Services) vector was different from the BIOS INT 13h (Disk
Services) vector. In all 3 payloads the (tunnelled) INT 13h vector is used to
access the hard drive, bypassing anti-virus software. When infecting the MBR
only 3 bytes of the partition table are affected. Jackal reads the MBR and 
checks if it is bootable (0AA55h marker in last two bytes). Next it saves the
affected 3 bytes of the partition table: start cylinder/sector and start head
of the first partition. The virus then loads the first sector of this
partition (boot sector) and checks if it is bootable (0AA55h marker) and if
it is not already infected (infection marker). Jackal then re-reads the MBR,
calculates address of a last 7 sectors on the first physical track (using the
'last cylinder/sector' field of the first partition table entry), saves this
sector address, saves 2 bytes at offset 01FEh of the virus and sets them to
0AA55h marker. Jackal then writes itself to the least 7 sectors of the first
track then restores the bytes at offset 01FEh of the virus. Finally the virus
sets the first head, cylinder, track of the first partition of the MBR to the
first sector of virus code and rewrites the MBR. This change of the partition
table means that the first sector of the virus is read instead of the boot
sector of the partition and that first sector loads the rest of the virus.
Since the change to the partition table is hidden by Jackals stealth
abilities, booting off a clean disk or attempting to disinfect the hard drive
with 'FDISK /mbr' or any other utility that replaces the MBR code will leave
the first partition inaccessible. When loading from an infected MBR the Jackal
sets the DS and register then allocates 5kb of memory by reducing 16-bit WORD
at 0:413h (BIOS size of conventional memory). The virus then copies the first
sector (512 bytes) of itself to this newly allocated memory and corrects the
bytes that were patched with the 0AA55h marker. Jackal jumps to this new
copy of its first sector and immediately loads the remaining 6 sectors of the
virus from the end of the first track. If this read fails, the original boot
sector of the partition is loaded and executed. Jackal saves a copy of the
entire IVT (interrupt vector table) in its memory - this is used to fake a
warm reboot. The virus also saves the new value at 0:413h (BIOS size of
conventional memory) for the same reason. Next the virus hooks INT 09h
(Keyboard IRQ) and INT 13h (BIOS Disk Services). The INT 09h handler is used
solely to fake the warm reboot: If ALT+CONTROL+DEL is pressed Jackal takes
special action, otherwise control is released to the original INT 09h handler.
When faking a warm reboot, Jackal resets and enables the Keyboard hardware
controller, restores the saved interrupt vector table, zeros its INT 21h
vector, clears they keyboard flags and sets the value of 0:413h, sets video
mode 03h and default cursor (using INT 10h), re-hooks INT 09h and INT 013h then
finally issues an INT 19h (BIOS boot-strap loader). The INT 13h handler serves
two purposes: hooking INT 21h (MS-DOS API) when loading from the MBR, and
stealthing the MBR. Hooking of INT 21h is achieved by checking the segment of
the INT 21h vector on every INT 13h call. When it is is below 800h, INT 21h 
is hooked in the IVT and this check is disabled. Stealth of the MBR is quite a
simple process. After the MBR is read, if the first partition points to the 
first sector of the virus (reading in this sector and checking infection
marker), the modified 3 bytes of the partition table are taken from the just
read first sector of the virus and the read MBR is corrected. After hooking
INT 09h and INT 13h, Jackals MBR loader code reads the original boot sector of
the first partition and executes. If this read fails, an INT 18h (Transfer to 
ROM BASIC) is issued. When running from an infected file Jackal immediately
saves the 'CS' register and realigns CS:IP so that it is run from offset 0
using a 'RETF' instruction. This eliminates the need for use of a 'delta
offset' register. The virus then sets two switches: one to tell its INT 13h
handler not to check for INT 21h hook, and one to tell the virus to later
tunnel and patch some interrupts.  After this a routine is called to detect
and disable 'TBCLEAN' (see above). If 'TBCLEAN' is detected Jackal modifies
its code to run the destructive payload instead of returning to the host when
it is done. Jackal then aves the entire IVT (interrupt vector table) and
retrieves the segment of the first MCB (INT 21h/AH=52h - DOS List of Lists)
and considers any thing below this segment as belonging to DOS when it tunnels
interrupts. After this INT 13h, INT 21h, INT 15h and INT 40h are tunnelled
using INT 01h single-stepping. In case of INT 21h, the MS-DOS handler is saved.
In the case of INT 13h both MS-DOS and BIOS handlers are saved. In the case of
INT 15h and INT 40h the BIOS handlers are saved. Jackals INT 01h handler 
emulates PUSHF/POPF/IRET/INT xx/INT3/INTO instructions to hide TF (Trace Flag)
and to stop it from being cleared. The virus then checks if it is already 
memory-resident. Jackal does not survive a warm reboot when loaded from a file
infection. Jackal then allocates memory: The virus checks that the hosts MCB
(Memory Control Block) is the last in the chain and is big enough to allow
allocation and then reduces it and 'Top Of Memory' field (offset +02h) of the
host PSP (Program Segment Prefix). Jackal copies itself to this newly allocated
memory and jumps to it, continuing execution. Next Jackal infects the MBR (see
above). The virus hooks INT 13h and INT 21h. Unlike loading from an MBR, file
infections do not hook these interrupts in the Interrupt Vector Table. Instead
the code of the tunnelled INT 13h and INT 21h MS-DOS handlers are patched with
a 5-byte JMP FAR (0EAh) instruction each, pointing to the virus handlers.
Jackal then returns control to the host (or the TBCLEAN payload). The INT 21h
handler of Jackal serves 4 purposes: the memory-residency check, to activate
the payloads (see above), to infect files and to stealth files. Files are
infect on open, extended open, execute and close calls. When infecting on
'close' the virus first duplicates the handle (INT 21h/AH=45h). When infecting
a file, Jackal resets the INT 13h, INT 15h and INT 40h vectors in the IVT to
boot time or tunnelled values to bypass anti-virus software. Jackal also uses
System File Table (SFT) entries to avoid lseek/chmod/date/time calls in an 
attempt to reduce code size and by pass anti-virus software too. Finally,
files are opened read-only and then the SFT entry is modified to read/write,
again to bypass anti-virus software. Infected files are marked by adding 100
years to their time-stamp File infection is standard append to the end and
modify the header type, except the virus is aligned on a 16-byte boundary so
the virus can re-align itself to offset 0 when loaded (see above), and the
appropriate amount of padding is put between the end of the virus and the
original file header to be used by the file stealth routines. When infecting
.COM files the Jackal checks for the .COM extension, when infecting .EXE files
Jackal checks for 'MZ' or 'ZM' marker. When infecting .COM files Jackal avoids
files beginning with suspicious code: If the first byte is 0 or NOP, HLT, CMC,
CLC, STC or INT 20h (Terminate) instruction the file is avoided. Additionally
if the file starts with "MOV AH,4Ch" or "MOV AX,4Cxxh" (Terminate Call), or
"MOV AH,09h" or "MOV AX,09xxh" (Print string call) the file is avoided. This
might be to avoid bait files. File stealth is performed on FCB
FindFirst/FindNext calls, ASCII FindFirst/FindNext calls, read, write, lseek,
and get/set date-stamp calls. In the case of FCB/ASCII FindFirst/FindNext
calls, Jackal gets the current Disk Transfer Area (DTA) using INT 21h/AH=2Fh
Jackal and hides the increase in file size and the 100 year marker in the file
date-stamp In the case of read call, if all or part of the file header is
read, Jackal replaces it with the original 'clean' header. If the read extends
pass the end of the original file into the virus body Jackal truncates it at 
the end of the virus body. In the case of a write call, the file is
disinfected on disk before the write is done. If an lseek call is issued
relative to the end of an infected file, it is instead done relative to the
end of the original file, before the virus body. In the case of requests to
get the file date-stamp, Jackal hides the 100 year marker. In the case of 
requests to set the date-stamp, Jackal ensures the 100 year marker is set if
the file is infected. Jackals INT 21h handler locks out they keyboard (Port
21h - IRQ Enable Mask) and re-enables it on exiting. This means that if an
anti-virus monitor brings up a message, the user cannot respond and must
reboot. When exiting the INT 21h handler, Jackal single-steps (INT 01h) 5 
instructions before returning to the next INT 21h handler in the chain. It
is this INT 01h handler that resets the INT 21h JMP FAR patch (if used, see
above). This seems to be an attempt to stop anti-virus software from tunnelling
through its code. During INT 21h calls, Jackal points INT 24h (DOS Fatal Error
Handler' to "MOV AL,3 / IRET" handler. This will return 'Fail' on fatal errors
such as writing to a write-protected floppy, without any error messages.
Jackal includes the text string:

Ja?ck?al

where '?' are extended ASCII characters. This is part of the code to load the
BX/CX/DX registers for the virus residency check. [1] [7] [8] [18]

Back to top


% Virus: Predator %

Upon joining Phalcon/SKISM, Priest published the 'Predator' virus in 40-Hex
Issue 11. Predator was a memory-resident, encrypted, stealth infecter of
MS-DOS .COM files. Predator also contained a dangerous payload. When ever a
'random' number is need for Predators encryption or payload, the 16-bit WORD
at 0:416h (low word of timer ticks) is used. When a Predator infected file is
run, the virus decrypts itself then passes control to the decrypted virus body
which immediately restores the stack pointer (SP register) to its original
value. Predator then issues an INT 21h call to check if it is already memory-
resident. If this is the case, Predator immediately returns control back to
the original host. Otherwise, Predator goes memory resident: Predator checks
if the MCB (Memory Control Block) of the host is the last in the chain. If
it is not then return is controlled to the host. Predator then goes memory
resident by reducing the size of this MCB as well as the 16-BIT WORD at 0:413h
(BIOS size of convention memory) to allocate memory. The virus then copies its
self to this newly allocated memory and jumps to it to continue execution.
Predator then hooks INT 21h (MS-DOS API) and INT 13h (BIOS Disk Services).
INT 21h/AH=35h (Get Interrupt Vector) is used to retrieve original interrupt
values and then INT 21h/AH=25h (Set Interrupt Vector) is used to hook these
interrupts. Predator then sets the 'count down' variable for the payload to
a random value and returns control to the host. The INT 21h handler is used
to infect files and implement stealth routines and provide Predators residency
check. The INT 13h is used solely for Predators destructive payload. The
INT 21h handler infected files on open, extended open and execute calls.
Stealth routines are provided on FCB and ASCII FindFirst/FindNext calls and on
FCB Open call. Stealth is implemented the same way on all of these calls: the
file size is reduced to the original file size, and Predators 'infection
marker' in the date-stamp field is removed. When infecting files Predator
checks for the '.COM' extension (upper-case only) as well as the absence of the
'MZ' marker. Predator is encrypted in all file infections. Infected files are
marked as infected by adding 100 years to their date-stamp The destructive
payload of the INT 13h handler randomly inverts one bit on sector reads. On
INT 13h/AH=02h, Predator performs the read and then subtracts the number of
sectors read from the payloads 'count down' variable. When this variable
becomes less than or equal to zero the payload is implemented: A random 16-bit
WORD in the read buffer is chosen, a random bit in this word is complemented
and the 'count down' variable is reset to a new random value. Predator
includes the text string:

Predator virus  (c) Mar. 93  Priest

[9] [10]

Back to top


% Virus: Predator 2 %

Although Predator was relatively simple, it was soon followed by 'Predator 2'.
Predator 2 was a more complex semi-polymorphic stealth multipartite infecter
of MS-DOS .com and .exe files, floppy boot sectors and the MBR. Like many of
Priests viruses, Predator 2 tunnels interrupts 13h and 21h on execution of an
infected file, in an attempt to bypass anti-virus software. On execution of an
infected file Predator 2 hit the MBR then went memory resident. Upon booting
from an infected MBR/boot sector, the virus also went memory resident. Once
resident the virus hooked INT 21h to hit files and INT 13h to hit floppy boot
sectors. These interrupts were also used for Predator 2's stealth routines.
When going resident under MS-DOS, rather than placing a hook in the INT 21h
vector chain, Predator 2 patches the tunnelled INT 21h address with an 0EAh 
(JMP FAR) instruction pointing to the virus handler. When infecting files
Predator 2 checks for the file names of several anti-virus programs and does
not infect them. These names are stored backwards in a single string:
"TORPNACSAELCFASVVAPC.VANOCED"- PROT, SCAN, CLEA*, VSAF, CPAV, NAV,
and DECO respectively. Predator 2 includes the text strings:

Predator virus #2  (c) 1993  Priest - Phalcon/Skism
THE PREDATOR

[10] [11] [12]

Back to top


% Virus: Incubus %

Around this time Priest also wrote 'Incubus'. Incubus.a was a memory-resident
infecter of the MBR and floppy disk boot sectors. Rather than replacing the
original boot sector with the virus code and storing the original sector else
where on disk, Incubus copied a small 26-byte 'loader' stub over the original
code of the sector, saved the original 26-bytes of the sector in the virus
body and wrote the full virus else where on the disk. Infected sectors began
with a two byte JMP $+3C (0EBh 3Ch) which passed control to the loader stub
at 0:7C3Eh (boot sectors are loaded at 0:7C00h). The small size and position
of this stub meant that it sat after the BPB (BIOS Parameter Block) on floppy
disks and before the partition table on the MBR. In floppy disk infections
Incubus stored the full virus body in the last sector of the disk. This was
calculated using the 'NumSectors', 'SectorsPerTrack' and 'NumberOfHeads'
fields of the BPB. For MBR infections, Incubus stored the main virus body
in the last sector of the first cylinder of the hard disk (this was unused
under MS-DOS). The last sector of the cylinder was calculated by taking
the last cylinder/sector field (+06h) of the first partition entry (+1BEh)
and then clearing all but the lower 6-bits (sector only). The 26-byte virus
loader setup the machine stack and then loaded the virus from the appropriate
sector to 0:7E00h (immediately after the original boot sector). The majority
of the code used by Incubus before memory-residency is encrypted - in all 202
bytes. This encrypted portion of the code includes a copy of the 26-byte
loader, the original code of the infected boot sector that was patched, the
code to infect the MBR and the code to go memory-resident. Incubus uses 300
bytes of the virus that are not encrypted to calculate the encryption key.
This unencrypted code includes the INT 40h handler, encryption/decryption 
routine and the routine to calculate the key, and the routines to patch the
sector with the loader and to calculate the last sector of the floppy. Incubus
also stores a 'random' 16-bit value in this decrypted code taken from 0:46Ch
(BIOS timer ticks) to make the key more random. Before patching a sector with
the loader Incubus compares 17 bytes of the sector with the first 17 bytes of
the loader to check if it is already infected. When Incubus is loaded to
0:7E00h and executed it immediately sets the DS register and decrypts itself.
The virus next restores the original bytes patched with the JMP and the loader
of the boot sector at 0:7C00h. The image of the sector is now its original.
Incubus allocates 1kb of memory for itself by reducing the word at 0:413h
(BIOS size of conventional memory), copies itself to this newly allocated
memory and hooks INT 40h (BIOS Floppy Disk Services). Other strains of Incubus
may hook INT 13h (BIOS Disk Services). Incubus will now jump to the new copy
of the virus at the top of memory and proceed to infect the MBR. The original
MBR code is saved and patched with the JMP/loader and the virus is written to
the last sector of the first cylinder. After infecting the MBR, control is 
returned back to the original (restored) boot sector at 0:7C00h. The INT 40h
(or INT 13h) handler is used solely to infect floppy disks. Floppy boot
sectors are infected when a read attempt of exactly one sector is made from
the boot sector (head 0, cylinder 0, sector 1). On infecting a floppy, the
original code is saved in the virus body, the boot sector is patched and
written and the virus is saved in the last sector of the disk. Incubus
includes the (encrypted) text string:

Incubus PRiEST - Phalcon/Skism

[1] [5] [17]

Back to top


% Virus: Natas %

In 1994 Priest published what seemed to be his last virus, 'Natas'. Aside from
publishing the virus source code in 40-Hex Issue 12, Priest also provided his
friends, the U.S. Secret Service, with a copy. Natas was a memory-resident 
full-stealth, highly polymorphic, multipartite infecter of MS-DOS .COM and
.EXE files, as well as floppy boot sectors and the MBR. Natas was the third
virus to be both full-stealth and polymorphic at the same time, after 'Tremor'
and 'Neuroquilla' (aka Havoc). Natas contained a highly destructive payload:
With 1/512 chance when run from an infected MBR or when an infected file was
run under 'TBCLEAN' (ThunderByte Anti-virus) Natas would format all hard drives
present, the entire drive one at a time. When a Natas infected disk was
booted, a small loader placed in the boot sector/MBR will run. It will first
issues a 'CALL' instruction to place the loaders 'delta offset' on the stack.
This is because the loader can be at a different position on different disks:
When infecting the boot sector/MBR, Natas follows any JMP SHORT (0EBh) or
JMP NEAR (0E9h) instructions and places the loader at the destination. This
allows the loader to be at the normal start of the sector for MBR infections
and after the BPB (BIOS Parameter Block) for floppy infections. The loader
then allocates 6kb of memory by reducing the word at 40:13h (BIOS size of
conventional memory) and loads 9 sectors containing the real 'virus body'
to this newly allocated memory. Natas then jumps to this new copy of the
virus in memory. If any errors are encountered in the 'loader' code, an
INT 18h (Boot ROM BASIC) is issued. Natas's boot process continues by
storing the original INT 13h, INT 15h, INT 21h and INT 40h vector. INT 13h
(BIOS Disk Services) is used instead of INT 40h (BIOS Floppy Disk Services)
if the byte at 40:75h (BIOS number of hard drives) is non-zero. Next Natas
pops the 'delta offset' of the loader stub off the stack and sets two flags:
INT 13h handler should check for MS-DOS loading, and virus is run from 'boot'
infection. The bytes of the boot sector that were replaced with the virus
loader are decrypted from the virus body and the boot sector is corrected in
memory. Natas then hooks INT 13h and infects the MBR. When infecting the MBR
Natas first reads the original MBR and performs 2 checks: Is the drive already
infected with 'Jackal' (see above) and does the drive have enough sectors per
track to hold store the virus body on the first cylinder after the MBR. This
second check is performed by querying the 'end sector, track' field of the
first Partition entry. If the MBR passes these checks the MBR is checked to
be 'bootable' (0AA55h marker at end of sector), 2 16-bit words in the virus
boot loader code are patched to point to head/cylinder/sector of the virus
body to be stored on the disk (last sectors of the first head/cylinder) and
the original MBR is patched with the virus loader. When patching a boot sector
or MBR with the virus loader Natas follows any JMP instructions at the start
of the sector (see above) saves the bytes to be over written (encrypted in the
main virus body) then copies over a small portion of the original sector with
the loader. After this point of the Natas's boot process, the virus if loaded
from a hard drive formats all hard drives with 1/512 possibility) then returns
control to the original boot sector/MBR. The INT 13h handler of Natas serves 3
purposes: To hook INT 21h during boot-up when MS-DOS loads, to provides stealth
routines and to infect floppies. If checking for MS-DOS is enabled the INT 13h
handler always begins by checking if the segment of INT 21h in the IVT
(interrupt vector table) is equal to or below 800h. If it is and this segment
is writeable INT 21h is hooked: Natas installs its INT 21h handler in the IVT
and disables this INT 21h checking code in future INT 13h calls. Both
infection and stealth are performed on reads from the boot sector/MBR. In 
such a case the call is performed to read the sector (exiting on error) and
stealth is performed if the sector is infected, while infection is performed
if the sector is not infected and on a floppy disk. Floppy infection is very
similar to MBR infection (see above) except the full 'virus body' is placed
on the last cylinder of the last track of the disk. This address is calculated
using the BPB (BIOS Parameter Block) of the boot sector. Stealth is performed
by performing the read of the infected sector and then reading the first
sector of the virus body, as pointed to by the virus loader of the infected
sector. This first sector of the virus body contains the encrypted 'original'
bytes that were replaced with the loader and these bytes are decrypted to the
callers read buffer, making the sector appear 'clean'. During stealth and
infection of sectors, the BIOS 'INT 13h' handler is used for hard drives while
the BIOS 'INT 40h' handler is used for floppies. When MS-DOS is present,
the MS-DOS INT 13h handler is hooked rather than the BIOS INT 13h handler, and
instead of hooking INT 13h and INT 21h vectors, the first 5 bytes of these
handlers are patched with a 5-byte JMP FAR (0EAh) to the appropriate
virus handler. When a Natas infected file is run, the virus saves the 'DS'
register on the stack and calculates the infections 'delta offset'. Natas then
checks for and disables 'TBCLEAN' - the generic file disinfection utility of
the ThunderByte Anti-Virus suite. The virus clears TF (trace flag of the
'flags' register) and sees if it is reset after a 'POP SS' instruction. If
TBCLEAN is detected, Natas disables it by disabling interrupts ('CLI'
instruction, changing 'SS' segment register to 0, reading the address of the
TBCLEAN INT 01h (single-stepping) handler with an 'LES' instruction relative
to 'BP' and patching the handler with an 'IRET' (0CFh) instruction. If TBCLEAN
was detected, Natas continues with special action: the virus does not perform
its MS-DOS residency check or inspect the MCB (Memory Control Block). It then
performs the same as the code would without TBCLEAN, but at the end it does
not return control to the host - it goes to routine to format hard drives.
Hence users attempting to clean files with TBCLEAN will experience loss of
data. If TBCLEAN is not detected however, Natas continues going resident.
Natas performs its memory-residency check and checks if the host MCB is the
last in the chain. If either of these cases fail residency is passed on to the
host file. Next Natas allocates memory by reducing the size of the MCB of the
host and also reduces the 'top of memory' field of the host PSP (Program
Segment Prefix) and 16-bit WORD at 0:413h (BIOS size of conventional memory).
Natas copies itself to this newly allocated memory and jumps to it. Natas sets
a flag to indicate it is running from a file (as opposed to a sector) and
with 1/3 probability sets a flag to disable file 'stealth' routines when
'special' programs are running. Natas prepares 2 JMP FAR (0EAh) constructions:
one to jump to virus INT 13h handler, one to jump to virus INT 21h handler
(see above). Next several interrupts are 'tunnelled' using INT 01h single-
stepping. Natas call INT 21h/AH=52h (DOS List Of Lists) to obtain the segment
of the first MCB. Anything below this segment is considered as belonging to
DOS. Natas tunnels for: MS-DOS INT 13h and INT 21h and BIOS INT 13h, INT 15h,
INT 40h handlers. MS-DOS interrupts are saved when code segment is below
segment of the first MCB. BIOS interrupts are saved if the code segment is
between 0C800h and 0F400h. MS-DOS interrupts are used for JMP FAR virus hooks.
BIOS interrupts are used to bypass anti-virus software when infecting files.
The INT 01h handler used by Natas to tunnel, emulates several instructions:
'PUSHF', 'POPF', 'IRET', 'INT xx', 'INT3' and 'INTO'. In the case of these
instructions Natas attempts to hide the 'TF' flag, while keeping it from being
cleared. Natas then patches DOS INT 13h and INT 21h handlers if both have been
found and infects the first hard drives MBR, in the manner described above for
'sector' infections. When infecting the MBR from a file Natas uses the
tunnelled BIOS INT 13h handler. Natas then returns control to the host. The
INT 21h handler of Natas is used for 3 purposes: memory-residency check, file
infection and file stealth. Natas INT 21h hander setup its own stack and set
INT 24h (DOS Critical Error Handler) to 'MOV AL,03h / IRET' to disable error
messages when trying to infect a file on a write-protected floppy. The INT 21h
handler also locked the keyboard by disabling its IRQ (Port 21h - Hardware
Interrupt Enable Mask). This made Natas harder to debug, but also stopped the
user to responding to any memory-resident anti-virus software that might bring
up a warning during virus activity. When infecting files Natas did some
unusual things: The handle to be infected was 'duplicated' first
(INT 21h/AH=45h), INT 21h,13h,15h,40h were to original or tunnelled values to
bypass anti-virus software and restored after infection, and SFT (System File
Entries) were used to reduce code size and bypass anti-virus software. The
routine used to get the SFT of the handle also ensured the file was not a
device and checked if it was already infected. SFT entries were used instead
of lseek, chmod and time/date-stamp calls bypassing some anti-virus monitors.
They were also used in stealth routines. If the drive of the victim file was
deemed 'removal' and 'A:' or 'B:' Natas reads a sector then rewrites it using
INT 13h to check if the disk is write protected. Files are opened 'read only'
then the file mode in the SFT structure is set to 'read/write', also bypassing
some anti-virus software. Infection algorithms are fairly standard with Natas
appending itself to the end of the file with a fixed length polymorphic
decrypter and modifying the files header. Files are marked as infected by
adding 100 years to the date-stamp .COM files are identified by file
extension, while .EXE files are identified by presence of 'MZ' or 'ZM'
marker. Stealth routines are used on FCB/ASCII FindFirst/FindNext calls, lseek,
read, write and set/get date calls. On FindFirst/FindNext calls Natas hides
the increase in file length and the modified dates-tamp field. In the case of
lseek calls, if the seek origin is from the end of file, the seek is performed
relative to the uninfected file end. On read calls Natas truncates reads pass
the end of the original file into the virus, and replaces reads from the
infected file header at the start of the file with the original header. On
writing to an infected file, Natas disinfects it first. Natas takes some
special action for stealth routines depending on the program running. If
'chkdsk' is running Natas disables FCB FindFirst/FindNext calls. This stops
check disk reporting file allocation errors on infected files. With 1/3 
probability at install time (see above) Natas disables all stealth routines
when certain programs are running. These programs are: AR* (ARJ), LH* (LHA),
(PK*) PKZIP, *BACK* (BACKUP) and *MODEM*. Natas uses the name of the MCB
associated with the current PSP (INT 21h/AH=62h - get current PSP). When 
exiting the INT 21h handler and if installed from a file infection, Natas
single-steps (INT 01h tracing) 5 instructions of code. On the fifth
instruction the 'JMP FAR' INT 21h patch is re-patched. This seems to stop
some programs from tunnelling past its INT 21h handler. The polymorphic engine
of Natas was complex for its time. Natas decryptors were always forward on
16-Bit words and used 3 or 4 registers: 1 or 2 pointer registers, a key
register and a count register. All single or dual-register addressing modes
could be used with 0/8/16-bit displacement. Encryption was in the form of
"ADD/SUB/XOR/ADC/SBB [PTR],KEY", or possibly "ROL/ROR [PTR],CL" if CX is the
count register. The key register is optionally modified with an 
"ADD/XOR/OR KEY,IMM16", an ADD made of multiple instructions, 
"ROL/ROR KEY,1/CL" (CL if CX is count) or "NOT/NEG KEY". The pointer is always
incremented, the key is always decremented. When incrementing the pointer, one
or both registers maybe incremented when dual-register addressing is used.
Loop types used by Natas are JNE/JNS/JG/JGE with an optional explicit
register test, JE/JS/JLE/JL follow by a JMP NEAR or LOOP/LOOPZ/LOOPNZ if CX is
the count. Natas uses many different methods to load register values,
increment the pointer or decrement the counter, and to test registers values.
Natas is also able to generate many different junk instructions. The engine
differentiates between .COM and .EXE infections and generates the correct
segment override if needed. Natas includes the text string:

Natas

[1] [13] [14] [15] [16]

Back to top


% References: %

[1] A PRIEST DEPLOYS HIS SATANIC MINIONS, 
"The Virus Creation Labs: A Journey Into the Underground" (American Eagle, 
ISBN 0-929408-09-8).

http://download.adamas.ai/dlbase/Stuff/VX%20Heavens%20Library/static/vdat/llpriest.htm

[2] Source Code.

satanbug.asm

http://www.thehackademy.net/madchat/vxdevl/vxsrc/MS-Dos/

[3] http://virus.wikia.com/wiki/SatanBug

[4] http://www.securelist.com/en/descriptions/old19521

[5] http://www.securelist.com/en/descriptions/old17163

[6] Disassembly.

payback.asm

http://www.thehackademy.net/madchat/vxdevl/vxsrc/MS-Dos/

[7] http://www.virus-database.com/description/1962-jackal.html

[8] http://www.f-secure.com/v-descs/jackal.shtml

[9] Predator Source Code.
40-Hex Issue 11, File 008.

[10] http://www.eset.com/us/threat-center/encyclopedia/threats/predator/

[11] http://www.securelist.com/en/descriptions/old8752

[12] Virus Catalogue Entry: Predator.

http://agn-www.informatik.uni-hamburg.de/catalog/msdos/html/predator.htm

[13] Natas Source Code.
40-Hex Issue 12, File 005.

[14] http://www.f-secure.com/v-descs/natas.shtml

[15] http://virus.wikia.com/wiki/Natas

[16] http://www.csie.ntu.edu.tw/~wcchen/asm98/asm/proj/b85506050/ORIGIN/NATAS~1.HTM

[17] Reversal of Virus.Boot.Incubus.a by JPanic (Thanks to hh86).

[18] Reversal of Virus.Multi.Jackal.3101 by JPanic.