Sample viewer

vx.netlux.org/Trojan.DOS.KillHDD.e

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:25:02.010857582Z 53 PC: 13356 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:25:02.014481487Z 53 PC: 13356 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:25:02.016206415Z 53 PC: 13356 | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:25:02.017203001Z 53 PC: 13356 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:25:02.018739534Z 53 PC: 13356 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:25:02.019711991Z 53 PC: 13356 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:25:02.020699716Z 53 PC: 13356 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:25:02.022029803Z 53 PC: 13356 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:25:02.023035612Z 53 PC: 13356 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:25:02.024021274Z 53 PC: 13356 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:25:02.025148882Z 53 PC: 13356 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:25:02.026298127Z 53 PC: 13356 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:25:02.027155261Z 53 PC: 13356 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:25:02.028008045Z 53 PC: 13356 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:25:02.029010254Z 53 PC: 13356 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:25:02.029968245Z 53 PC: 13356 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:25:02.031025347Z 53 PC: 13356 | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:25:02.03316877Z 53 PC: 13356 | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:25:02.034139443Z 37 PC: 1336b | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:25:02.035072767Z 37 PC: 13373 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:25:02.036679763Z 37 PC: 1337b | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:25:02.037934417Z 37 PC: 13383 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:25:02.039329956Z 68 PC: 137da | I/O control for devices (Set for = '')
2018-12-17T22:25:02.125762057Z 37 PC: 12ca7 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:25:02.127124325Z 42 PC: 132a3 | Get date 0x132a3: xor ah, ah
0x132a5: les di, ptr [bp + 6]
0x132a8: stosw word ptr es:[di], ax
0x132a9: mov al, dl
0x132ab: les di, ptr [bp + 0xa]
0x132ae: stosw word ptr es:[di], ax
0x132af: mov al, dh
0x132b1: les di, ptr [bp + 0xe]
0x132b4: stosw word ptr es:[di], ax
0x132b5: xchg ax, cx
0x132b6: les di, ptr [bp + 0x12]
0x132b9: stosw word ptr es:[di], ax
0x132ba: pop bp
0x132bb: retf 0x10
0x132be: push bp
0x132bf: mov bp, sp
0x132c1: mov cx, word ptr [bp + 0xa]
0x132c4: mov dh, byte ptr [bp + 8]
0x132c7: mov dl, byte ptr [bp + 6]
0x132ca: mov ah, 0x2b
2018-12-17T22:25:02.129418973Z 37 PC: 13465 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:25:02.130957103Z 37 PC: 13465 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:25:02.132083674Z 37 PC: 13465 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:25:02.133206229Z 37 PC: 13465 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:25:02.13484247Z 37 PC: 13465 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:25:02.135929932Z 37 PC: 13465 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:25:02.136950952Z 37 PC: 13465 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:25:02.139053376Z 37 PC: 13465 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:25:02.14012824Z 37 PC: 13465 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:25:02.141164898Z 37 PC: 13465 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:25:02.142689877Z 37 PC: 13465 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:25:02.144011244Z 37 PC: 13465 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:25:02.145974028Z 37 PC: 13465 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:25:02.148038908Z 37 PC: 13465 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:25:02.149052401Z 37 PC: 13465 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:25:02.150061082Z 37 PC: 13465 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:25:02.165376132Z 37 PC: 13465 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:25:02.166522055Z 37 PC: 13465 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:25:02.16750648Z 76 PC: 134a4 | Terminate with return code (Return code = '0')