Sample viewer

vx.netlux.org/Trojan.DOS.Active

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:25:50.304796887Z 53 PC: 12b2a | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:25:50.306903016Z 53 PC: 12b2a | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:25:50.309183208Z 53 PC: 12b2a | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:25:50.310967491Z 53 PC: 12b2a | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:25:50.313118774Z 53 PC: 12b2a | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:25:50.315231071Z 53 PC: 12b2a | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:25:50.317035617Z 53 PC: 12b2a | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:25:50.318581855Z 53 PC: 12b2a | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:25:50.320088552Z 53 PC: 12b2a | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:25:50.321158747Z 53 PC: 12b2a | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:25:50.322210598Z 53 PC: 12b2a | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:25:50.323786189Z 53 PC: 12b2a | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:25:50.324924714Z 53 PC: 12b2a | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:25:50.326183106Z 53 PC: 12b2a | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:25:50.327876319Z 53 PC: 12b2a | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:25:50.329221559Z 53 PC: 12b2a | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:25:50.330686169Z 53 PC: 12b2a | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:25:50.332572314Z 53 PC: 12b2a | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:25:50.333902607Z 53 PC: 12b2a | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:25:50.335125289Z 37 PC: 12b3f | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:25:50.336458132Z 37 PC: 12b47 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:25:50.337768508Z 37 PC: 12b4f | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:25:50.338932747Z 37 PC: 12b57 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:25:50.340855033Z 68 PC: 12fb2 | I/O control for devices (Set for = 'I< tA')
2018-12-17T22:25:50.343029193Z 44 PC: 130e9 | Get time 0x130e9: mov word ptr [0x3e], cx
0x130ed: mov word ptr [0x40], dx
0x130f1: retf
0x130f2: mov di, 0x50
0x130f5: push ds
0x130f6: pop es
0x130f7: mov cx, 0x520
0x130fa: sub cx, di
0x130fc: shr cx, 1
0x130fe: xor ax, ax
0x13100: cld
0x13101: rep stosd dword ptr es:[di], eax
0x13103: ret
0x13104: add byte ptr [bx + si], al
0x13106: add byte ptr [bx + si], al
0x13108: add byte ptr [bx + si], al
0x1310a: add byte ptr [bx + si], al
0x1310c: add byte ptr [bx + si], al
0x1310e: add byte ptr [bx + si], al
0x13110: add byte ptr [bx + si], al