zombie.pm.459
Webroot Antivirus: The best protection against viruses, spyware data theft and hackers.
Description:
Details
Zombie.PM.4592
This is a non memory-resident polymorphic parasitic virus. It searches for COM files, then writes itself to the end of the file. Before writing its code to the file the virus converts it to text data: each byte is converted to the pair of text bytes. Each bytes can get value from '6' till 'L'. Then these text bytes are separated to lines of text with LineFeed characters at the end of the line.
When an infected file is executed and the virus takes control, the reverse conversion routine is called. This routine converts text data back to executable binary code. It also contains only text bytes, and moreover - it is polymorphic. Its code looks like follows:
as assembler code: as text bytes: result test line:
PUSH 2F5D h]/ h]/X-?"5!#P^hdPX-!tP_18
POP AX X
SUB AX,223F -?"
XOR AX,2321 5!#
PUSH AX P
POP SI ^
PUSH 5064 hdP
POP AX X
SUB AX,7421 -!t
PUSH AX P
POP DI _
XOR [BX+DI],DI 18
SUB AX,0A0D
all ...
To the header and footer of the block of text data the virus writes standard PGP stamps of encrypted message:
-----BEGIN PGP MESSAGE-----
Version: 2.6.3i
-----END PGP MESSAGE-----
As a result the virus code looks like a real PGP message with standard footer, header and some random text data inside:
+-----------------+
|JMP Virus |-----+
|- - - - - - - - -| |
|Original file | |
|data and code | |
| | |
|-----------------| |
|PGP header text | |
|- - - - - - - - -| |
|Virus code |<----+
|converted to text|
|- - - - - - - - -|
|PGP footer text |
+-----------------+
The virus contains the text strings, the major part of it is the text of Scorpion's song "Wind Of Change", the rest of text looks as follows:
z0mbie$$.$$$Z0MBiE.PGPMorph Version 1.00 (c) 1997, 1998 Z0MBiE International
Now we can infect Dr.WEB addons...
homepage: http://www.chat.ru/~z0mbie
e-mail: z0mbie@chat.ru
Scorpions is BEST!
@SONG: WIND OF CHANGE
The virus also accesses in some way TPU (Turbo Pascal library files) and DrWeb anti-virus databases. In case of TPU files the virus adds its code to the library. In my experiments the virus failed to modify both types of files.
Copyright @2006 zombie.pm.459