Sample viewer

vx.netlux.org/Virus.DOS.Andromeda.826

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T23:05:35.992019992Z 42 PC: 12ab0 | Get date 0x12ab0: cmp al, 6
0x12ab2: je 0x12ac5
0x12ab4: cmp al, 0
0x12ab6: je 0x12ac5
0x12ab8: mov si, 0xcdfe
0x12abb: mov ah, 0x30
0x12abd: int 0x21
0x12abf: cmp di, 0x1b3d
0x12ac3: jne 0x12adc
0x12ac5: mov si, 0x421
0x12ac8: pop bx
0x12ac9: sub bx, 0x100
0x12acd: add si, bx
0x12acf: mov di, 0x100
0x12ad2: mov cx, 5
0x12ad5: rep movsb byte ptr es:[di], byte ptr [si]
0x12ad7: mov ax, 0x100
0x12ada: jmp ax
0x12adc: push es
0x12add: mov ax, cs
2018-12-17T23:05:35.995845465Z 48 PC: 12abf | Get DOS version
2018-12-17T23:05:35.997141773Z 38 PC: 12aff | Create PSP

{"DateBased":true,"Day":5,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":15261,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:43:02.481405034Z 42 PC: 12ab0 | Get date 0x12ab0: cmp al, 6
0x12ab2: je 0x12ac5
0x12ab4: cmp al, 0
0x12ab6: je 0x12ac5
0x12ab8: mov si, 0xcdfe
0x12abb: mov ah, 0x30
0x12abd: int 0x21
0x12abf: cmp di, 0x1b3d
0x12ac3: jne 0x12adc
0x12ac5: mov si, 0x421
0x12ac8: pop bx
0x12ac9: sub bx, 0x100
0x12acd: add si, bx
0x12acf: mov di, 0x100
0x12ad2: mov cx, 5
0x12ad5: rep movsb byte ptr es:[di], byte ptr [si]
0x12ad7: mov ax, 0x100
0x12ada: jmp ax
0x12adc: push es
0x12add: mov ax, cs

{"DateBased":true,"Day":6,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":15261,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:43:02.621951469Z 42 PC: 12ab0 | Get date 0x12ab0: cmp al, 6
0x12ab2: je 0x12ac5
0x12ab4: cmp al, 0
0x12ab6: je 0x12ac5
0x12ab8: mov si, 0xcdfe
0x12abb: mov ah, 0x30
0x12abd: int 0x21
0x12abf: cmp di, 0x1b3d
0x12ac3: jne 0x12adc
0x12ac5: mov si, 0x421
0x12ac8: pop bx
0x12ac9: sub bx, 0x100
0x12acd: add si, bx
0x12acf: mov di, 0x100
0x12ad2: mov cx, 5
0x12ad5: rep movsb byte ptr es:[di], byte ptr [si]
0x12ad7: mov ax, 0x100
0x12ada: jmp ax
0x12adc: push es
0x12add: mov ax, cs

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":15261,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:43:02.671635836Z 42 PC: 12ab0 | Get date 0x12ab0: cmp al, 6
0x12ab2: je 0x12ac5
0x12ab4: cmp al, 0
0x12ab6: je 0x12ac5
0x12ab8: mov si, 0xcdfe
0x12abb: mov ah, 0x30
0x12abd: int 0x21
0x12abf: cmp di, 0x1b3d
0x12ac3: jne 0x12adc
0x12ac5: mov si, 0x421
0x12ac8: pop bx
0x12ac9: sub bx, 0x100
0x12acd: add si, bx
0x12acf: mov di, 0x100
0x12ad2: mov cx, 5
0x12ad5: rep movsb byte ptr es:[di], byte ptr [si]
0x12ad7: mov ax, 0x100
0x12ada: jmp ax
0x12adc: push es
0x12add: mov ax, cs
2018-12-25T12:43:02.681075558Z 48 PC: 12abf | Get DOS version
2018-12-25T12:43:02.682659367Z 38 PC: 12aff | Create PSP

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":15261,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:43:02.712793665Z 42 PC: 12ab0 | Get date 0x12ab0: cmp al, 6
0x12ab2: je 0x12ac5
0x12ab4: cmp al, 0
0x12ab6: je 0x12ac5
0x12ab8: mov si, 0xcdfe
0x12abb: mov ah, 0x30
0x12abd: int 0x21
0x12abf: cmp di, 0x1b3d
0x12ac3: jne 0x12adc
0x12ac5: mov si, 0x421
0x12ac8: pop bx
0x12ac9: sub bx, 0x100
0x12acd: add si, bx
0x12acf: mov di, 0x100
0x12ad2: mov cx, 5
0x12ad5: rep movsb byte ptr es:[di], byte ptr [si]
0x12ad7: mov ax, 0x100
0x12ada: jmp ax
0x12adc: push es
0x12add: mov ax, cs
2018-12-25T12:43:02.71581757Z 48 PC: 12abf | Get DOS version
2018-12-25T12:43:02.718061338Z 38 PC: 12aff | Create PSP

{"DateBased":true,"Day":5,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":15261,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:43:02.761099872Z 42 PC: 12ab0 | Get date 0x12ab0: cmp al, 6
0x12ab2: je 0x12ac5
0x12ab4: cmp al, 0
0x12ab6: je 0x12ac5
0x12ab8: mov si, 0xcdfe
0x12abb: mov ah, 0x30
0x12abd: int 0x21
0x12abf: cmp di, 0x1b3d
0x12ac3: jne 0x12adc
0x12ac5: mov si, 0x421
0x12ac8: pop bx
0x12ac9: sub bx, 0x100
0x12acd: add si, bx
0x12acf: mov di, 0x100
0x12ad2: mov cx, 5
0x12ad5: rep movsb byte ptr es:[di], byte ptr [si]
0x12ad7: mov ax, 0x100
0x12ada: jmp ax
0x12adc: push es
0x12add: mov ax, cs

{"DateBased":true,"Day":6,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":15261,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:43:03.797365034Z 42 PC: 12ab0 | Get date 0x12ab0: cmp al, 6
0x12ab2: je 0x12ac5
0x12ab4: cmp al, 0
0x12ab6: je 0x12ac5
0x12ab8: mov si, 0xcdfe
0x12abb: mov ah, 0x30
0x12abd: int 0x21
0x12abf: cmp di, 0x1b3d
0x12ac3: jne 0x12adc
0x12ac5: mov si, 0x421
0x12ac8: pop bx
0x12ac9: sub bx, 0x100
0x12acd: add si, bx
0x12acf: mov di, 0x100
0x12ad2: mov cx, 5
0x12ad5: rep movsb byte ptr es:[di], byte ptr [si]
0x12ad7: mov ax, 0x100
0x12ada: jmp ax
0x12adc: push es
0x12add: mov ax, cs