In this post we will be looking at ABR-1171, which is infected by PS-MPC.c virus. This is a file infector type malware and is also know as Abraxas. File infectors are malware that scan the disk for all files and then overwrite them making them unusable. This particular malware infects only the first file present in the directory. This encrypted malware was first seen around 1993 and is of Russian origin. The group that wrote the malware is ARCV(Association of Really Cruel Viruses).

The virus detection rate is 40/56 on Virustotal.

Environment setup →

• Grab the latest version of DOSBox and install it. Link
• Grab the version of Debug build of DOSBox and place it in the installation folder. Link

Upon opening the file in a disassembler we can see that the first instruction is a jump to the unpacking routine. The unpacking routine can be replicated fairly easily since it’s a simple XOR. The IDApy script for unpacking is as follows.

from idautils import *
from idc import *
from idaapi import *

ea = 0x10100 # This is the start address of Seg000
end_ea = get_segm_end(ea)

patch_byte(ea,0x29)
patch_byte(ea+1,0xd8)
patch_byte(ea+2,0xc1)

for i in range(0,586,2):
	patch_byte(ea+i,(get_wide_byte(ea+i) ^ 0xc1))
	patch_byte(ea+i+1,(get_wide_byte(ea+i+1) ^ 0xd7))

plan_and_wait(ea,end_ea)

Now let’s look at what the malware does.

Function - Tone

This function is responsible for playing the tone. In the function we check if the speaker is on or not.

seg000:0129                 in      al, 61h
seg000:012B                 test    al, 3
seg000:012D                 jnz     plat_tone
seg000:012F                 or      al, 3
seg000:0131                 out     61h, al

Once this is done the malware sets the frequency of tones.

seg000:0144                 int     1Ah       
seg000:0146                 add     bx, dx
loop_back:
seg000:0148                 int     1Ah
seg000:014A                 cmp     dx, bx
seg000:014C                 jnz     loop_back

The interrupt 1Ah with AH 0 returns the time, which is then compared until we hit the time set in the BX register. Once this is done we reset the speaker and return back.

Function - Find all files

This function is responsible for finding all the .exe files in a particular directory and overwriting with the malware file itself.

Function - Replace dosshell

This function is responsible for opening c:\\dos\\dosshell.com and copies the unpacked malware into it.

seg000:018B                 mov     dx, 1B2h      ; Name of file
seg000:018E                 xor     cx, cx
seg000:0190                 mov     ax, 3C02h
seg000:0193                 int     21h           ; Open file   
seg000:0195                 xchg    ax, bx
seg000:0196                 mov     ah, 40h ; 
seg000:0198                 mov     cx, 493h      ; len of bytes to write
seg000:019B                 mov     dx, 100h      ; OEP of malware
seg000:019E                 int     21h           ; write to file       
seg000:01A0                 mov     ah, 3Eh       ; close file
seg000:01A2                 int     21h

Function - Output to display

In this function it checks for the video modes. The check for the type of display is done using the interrupt 10, with AH set as 0fh. We see that a particular value is set depending on the value returned by the interrupt. A look at the video memory map of DOS tells us that value is the address of the video memory.  

If the display type is mono then it prints out the string.

For he is not of this day...Nor he of this mind

If the display type is a 16bit color mode with res 720x400 it prints out

Putting it all together

After unpacking the malware, it turns the speaker on and plays a tone. The next few functions are responsible for overwriting the first file of the current directory and the previous directory. Then we have a function that replaces/overwrites the dosshell with a copy of the malware itself. On completion the malware prints out a graphic version of Abraxas as shown above. The malware does not reside in the memory.

References used:

http://www2.ift.ulaval.ca/~marchand/ift17583/dosints.pdf

https://www.osdata.com/system/physical/memmap.htm#MSDOS

https://www.csee.umbc.edu/courses/undergraduate/211/Spring00/Burt/lectures/CntlHardware/timer.html

http://cd.textfiles.com/thegreatunsorted/live_viruses/virus_collections/BBB/