Sample viewer

vx.netlux.org/Trojan.DOS.SWP

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:25:42.08834207Z 53 PC: 12fe2 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:25:42.089921161Z 53 PC: 12fe2 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:25:42.091105737Z 53 PC: 12fe2 | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:25:42.092339631Z 53 PC: 12fe2 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:25:42.093912145Z 53 PC: 12fe2 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:25:42.094982283Z 53 PC: 12fe2 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:25:42.095990384Z 53 PC: 12fe2 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:25:42.097771744Z 53 PC: 12fe2 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:25:42.098827263Z 53 PC: 12fe2 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:25:42.099958979Z 53 PC: 12fe2 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:25:42.101447057Z 53 PC: 12fe2 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:25:42.109331437Z 53 PC: 12fe2 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:25:42.110328873Z 53 PC: 12fe2 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:25:42.111786571Z 53 PC: 12fe2 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:25:42.113074376Z 53 PC: 12fe2 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:25:42.114172931Z 53 PC: 12fe2 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:25:42.115600229Z 53 PC: 12fe2 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:25:42.117194138Z 53 PC: 12fe2 | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:25:42.118545583Z 53 PC: 12fe2 | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:25:42.120119687Z 37 PC: 12ff7 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:25:42.121670143Z 37 PC: 12fff | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:25:42.122692106Z 37 PC: 13007 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:25:42.123704409Z 37 PC: 1300f | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:25:42.125618479Z 68 PC: 13381 | I/O control for devices (Set for = '')
2018-12-17T22:25:42.126983963Z 44 PC: 13dbf | Get time 0x13dbf: mov word ptr [0x3e], cx
0x13dc3: mov word ptr [0x40], dx
0x13dc7: retf
0x13dc8: push di
0x13dc9: cld
0x13dca: mov bx, ax
0x13dcc: or dx, dx
0x13dce: jge 0x13ddd
0x13dd0: not bx
0x13dd2: not dx
0x13dd4: add bx, 1
0x13dd7: adc dx, 0
0x13dda: mov al, 0x2d
0x13ddc: stosb byte ptr es:[di], al
0x13ddd: mov si, 0xe8a
0x13de0: mov cl, 9
0x13de2: cmp dx, word ptr cs:[si + 2]
0x13de6: jb 0x13def
0x13de8: ja 0x13df6
0x13dea: cmp bx, word ptr cs:[si]
2018-12-17T22:25:42.129364669Z 64 PC: 13484 | Write file or device (Write 56 bytes on handle 1)
2018-12-17T22:25:42.134944159Z 64 PC: 13484 | Write file or device (Write 2 bytes on handle 1)
2018-12-17T22:25:42.14064819Z 64 PC: 13484 | Write file or device (Write 25 bytes on handle 1)
2018-12-17T22:25:42.143628303Z 63 PC: 1342d | Read file or device (Read 128 bytes on handle 0)