Sample viewer

vx.netlux.org/Trojan.DOS.Ares.a

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:56:44.259539334Z 53 PC: 138aa | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:56:44.261125854Z 53 PC: 138aa | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:56:44.273363458Z 53 PC: 138aa | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:56:44.27485226Z 53 PC: 138aa | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:56:44.276263412Z 53 PC: 138aa | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:56:44.281840241Z 53 PC: 138aa | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:56:44.284392696Z 53 PC: 138aa | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:56:44.286433673Z 53 PC: 138aa | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:56:44.288921419Z 53 PC: 138aa | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:56:44.290498009Z 53 PC: 138aa | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:56:44.291972158Z 53 PC: 138aa | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:56:44.294410632Z 53 PC: 138aa | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:56:44.296232037Z 53 PC: 138aa | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:56:44.297985166Z 53 PC: 138aa | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:56:44.300851279Z 53 PC: 138aa | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:56:44.302228848Z 53 PC: 138aa | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:56:44.304066395Z 53 PC: 138aa | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:56:44.30588338Z 53 PC: 138aa | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:56:44.307749811Z 53 PC: 138aa | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:56:44.309117094Z 37 PC: 138bf | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:56:44.310740498Z 37 PC: 138c7 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:56:44.312536354Z 37 PC: 138cf | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:56:44.3137822Z 37 PC: 138d7 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:56:44.315516999Z 68 PC: 13f35 | I/O control for devices (Set for = '󤬪�� ���ȭ��u�����')
2018-12-17T22:56:44.41846184Z 37 PC: 13151 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:56:44.421027543Z 42 PC: 136d7 | Get date 0x136d7: xor ah, ah
0x136d9: les di, ptr [bp + 6]
0x136dc: stosw word ptr es:[di], ax
0x136dd: mov al, dl
0x136df: les di, ptr [bp + 0xa]
0x136e2: stosw word ptr es:[di], ax
0x136e3: mov al, dh
0x136e5: les di, ptr [bp + 0xe]
0x136e8: stosw word ptr es:[di], ax
0x136e9: xchg ax, cx
0x136ea: les di, ptr [bp + 0x12]
0x136ed: stosw word ptr es:[di], ax
0x136ee: pop bp
0x136ef: retf 0x10
0x136f2: push bp
0x136f3: mov bp, sp
0x136f5: mov cx, word ptr [bp + 0xa]
0x136f8: mov dh, byte ptr [bp + 8]
0x136fb: mov dl, byte ptr [bp + 6]
0x136fe: mov ah, 0x2b
2018-12-17T22:56:44.424319901Z 37 PC: 13a01 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:56:44.427146946Z 37 PC: 13a01 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:56:44.428804581Z 37 PC: 13a01 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:56:44.430422847Z 37 PC: 13a01 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:56:44.433255494Z 37 PC: 13a01 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:56:44.434975762Z 37 PC: 13a01 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:56:44.436472566Z 37 PC: 13a01 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:56:44.438973068Z 37 PC: 13a01 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:56:44.440935748Z 37 PC: 13a01 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:56:44.44269089Z 37 PC: 13a01 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:56:44.444866113Z 37 PC: 13a01 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:56:44.447023163Z 37 PC: 13a01 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:56:44.448769809Z 37 PC: 13a01 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:56:44.450568541Z 37 PC: 13a01 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:56:44.453447331Z 37 PC: 13a01 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:56:44.455339274Z 37 PC: 13a01 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:56:44.457059673Z 37 PC: 13a01 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:56:44.459410291Z 37 PC: 13a01 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:56:44.460841137Z 37 PC: 13a01 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:56:44.462294666Z 76 PC: 13a40 | Terminate with return code (Return code = '0')