Sample viewer

vx.netlux.org/Trojan.DOS.Loshara

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:03:27.080329491Z 53 PC: 1387a | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:03:27.082050098Z 53 PC: 1387a | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:03:27.087304135Z 53 PC: 1387a | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:03:27.088897113Z 53 PC: 1387a | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:03:27.091066027Z 53 PC: 1387a | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:03:27.092909237Z 53 PC: 1387a | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:03:27.093973961Z 53 PC: 1387a | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:03:27.095068199Z 53 PC: 1387a | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:03:27.097014001Z 53 PC: 1387a | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:03:27.09846527Z 53 PC: 1387a | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:03:27.099891133Z 53 PC: 1387a | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:03:27.110430861Z 53 PC: 1387a | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:03:27.111886013Z 53 PC: 1387a | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:03:27.11337675Z 53 PC: 1387a | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:03:27.125477785Z 53 PC: 1387a | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:03:27.126652902Z 53 PC: 1387a | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:03:27.127757428Z 53 PC: 1387a | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:03:27.1290908Z 53 PC: 1387a | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:03:27.133453034Z 53 PC: 1387a | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:03:27.134798032Z 37 PC: 1388f | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:03:27.136011432Z 37 PC: 13897 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:03:27.138710888Z 37 PC: 1389f | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:03:27.140189716Z 37 PC: 138a7 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:03:27.142807692Z 68 PC: 1439e | I/O control for devices (Set for = '..I
2018-12-17T22:03:27.258277737Z 37 PC: 13251 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:03:27.260165991Z 61 PC: 14382 | Open file (Filename = 'C:\autoexec.bat')
2018-12-17T22:03:27.266549774Z 63 PC: 13c41 | Read file or device (Read 128 bytes on handle 5)
2018-12-17T22:03:27.270861426Z 63 PC: 13c41 | Read file or device (Read 128 bytes on handle 5)
2018-12-17T22:03:27.273051095Z 44 PC: 144d5 | Get time 0x144d5: mov word ptr [0x58], cx
0x144d9: mov word ptr [0x5a], dx
0x144dd: retf
0x144de: mov di, 0x6c
0x144e1: push ds
0x144e2: pop es
0x144e3: mov cx, 0xada
0x144e6: sub cx, di
0x144e8: shr cx, 1
0x144ea: xor ax, ax
0x144ec: cld
0x144ed: rep stosd dword ptr es:[di], eax
0x144ef: ret
0x144f0: add byte ptr [bx + si], al
0x144f2: popaw
0x144f3: bound sp, dword ptr [bp + di + 0x64]
0x144f6: push 0x6c6b6a69
0x144fe: insw word ptr es:[di], dx
0x144ff: outsb dx, byte ptr [si]
0x14500: outsw dx, word ptr [si]