Sample viewer

vx.netlux.org/Virus.DOS.Gobot.4000

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:33:46.690629356Z 53 PC: 12a56 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:33:46.6926896Z 37 PC: 12a66 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:33:46.694746009Z 78 PC: 12a75 | Find first file
2018-12-17T22:33:46.701873214Z 61 PC: 12a7f | Open file (Filename = 'SLEEP.COM')
2018-12-17T22:33:46.709589267Z 63 PC: 12a8a | Read file or device (Read 2 bytes on handle 5)
2018-12-17T22:33:46.717901338Z 44 PC: 12ade | Get time 0x12ade: xor dh, dh
0x12ae0: and dl, 7
0x12ae3: cmp dx, 6
0x12ae6: jg 0x12ada
0x12ae8: push dx
0x12ae9: add dx, 0x343
0x12aed: mov si, dx
0x12aef: mov dl, byte ptr cs:[si]
0x12af2: mov byte ptr [0x103], dl
0x12af6: pop dx
0x12af7: push dx
0x12af8: add dx, 0x358
0x12afc: mov si, dx
0x12afe: mov dl, byte ptr cs:[si]
0x12b01: mov byte ptr [0x100], dl
0x12b05: mov ah, 0x2c
0x12b07: int 0x21
0x12b09: xor dh, dh
0x12b0b: and dl, 7
0x12b0e: cmp dx, 6
2018-12-17T22:33:46.720725642Z 44 PC: 12b09 | Get time 0x12b09: xor dh, dh
0x12b0b: and dl, 7
0x12b0e: cmp dx, 6
0x12b11: jg 0x12b05
0x12b13: pop ax
0x12b14: push ax
0x12b15: cmp ax, dx
0x12b17: je 0x12b05
0x12b19: pop ax
0x12b1a: push dx
0x12b1b: add dx, 0x34a
0x12b1f: mov si, dx
0x12b21: mov dl, byte ptr cs:[si]
0x12b24: mov byte ptr [0x104], dl
0x12b28: pop dx
0x12b29: add dx, 0x351
0x12b2d: mov si, dx
0x12b2f: mov dl, byte ptr cs:[si]
0x12b32: mov byte ptr [0x106], dl
0x12b36: mov ax, 0x4200
2018-12-17T22:33:46.723541999Z 44 PC: 12b09 | Get time 0x12b09: xor dh, dh
0x12b0b: and dl, 7
0x12b0e: cmp dx, 6
0x12b11: jg 0x12b05
0x12b13: pop ax
0x12b14: push ax
0x12b15: cmp ax, dx
0x12b17: je 0x12b05
0x12b19: pop ax
0x12b1a: push dx
0x12b1b: add dx, 0x34a
0x12b1f: mov si, dx
0x12b21: mov dl, byte ptr cs:[si]
0x12b24: mov byte ptr [0x104], dl
0x12b28: pop dx
0x12b29: add dx, 0x351
0x12b2d: mov si, dx
0x12b2f: mov dl, byte ptr cs:[si]
0x12b32: mov byte ptr [0x106], dl
0x12b36: mov ax, 0x4200
2018-12-17T22:33:46.727483848Z 44 PC: 12b09 | Get time 0x12b09: xor dh, dh
0x12b0b: and dl, 7
0x12b0e: cmp dx, 6
0x12b11: jg 0x12b05
0x12b13: pop ax
0x12b14: push ax
0x12b15: cmp ax, dx
0x12b17: je 0x12b05
0x12b19: pop ax
0x12b1a: push dx
0x12b1b: add dx, 0x34a
0x12b1f: mov si, dx
0x12b21: mov dl, byte ptr cs:[si]
0x12b24: mov byte ptr [0x104], dl
0x12b28: pop dx
0x12b29: add dx, 0x351
0x12b2d: mov si, dx
0x12b2f: mov dl, byte ptr cs:[si]
0x12b32: mov byte ptr [0x106], dl
0x12b36: mov ax, 0x4200
2018-12-17T22:33:46.738851423Z 44 PC: 12b09 | Get time 0x12b09: xor dh, dh
0x12b0b: and dl, 7
0x12b0e: cmp dx, 6
0x12b11: jg 0x12b05
0x12b13: pop ax
0x12b14: push ax
0x12b15: cmp ax, dx
0x12b17: je 0x12b05
0x12b19: pop ax
0x12b1a: push dx
0x12b1b: add dx, 0x34a
0x12b1f: mov si, dx
0x12b21: mov dl, byte ptr cs:[si]
0x12b24: mov byte ptr [0x104], dl
0x12b28: pop dx
0x12b29: add dx, 0x351
0x12b2d: mov si, dx
0x12b2f: mov dl, byte ptr cs:[si]
0x12b32: mov byte ptr [0x106], dl
0x12b36: mov ax, 0x4200
2018-12-17T22:33:46.741457481Z 44 PC: 12b09 | Get time 0x12b09: xor dh, dh
0x12b0b: and dl, 7
0x12b0e: cmp dx, 6
0x12b11: jg 0x12b05
0x12b13: pop ax
0x12b14: push ax
0x12b15: cmp ax, dx
0x12b17: je 0x12b05
0x12b19: pop ax
0x12b1a: push dx
0x12b1b: add dx, 0x34a
0x12b1f: mov si, dx
0x12b21: mov dl, byte ptr cs:[si]
0x12b24: mov byte ptr [0x104], dl
0x12b28: pop dx
0x12b29: add dx, 0x351
0x12b2d: mov si, dx
0x12b2f: mov dl, byte ptr cs:[si]
0x12b32: mov byte ptr [0x106], dl
0x12b36: mov ax, 0x4200
2018-12-17T22:33:46.750351914Z 44 PC: 12b09 | Get time 0x12b09: xor dh, dh
0x12b0b: and dl, 7
0x12b0e: cmp dx, 6
0x12b11: jg 0x12b05
0x12b13: pop ax
0x12b14: push ax
0x12b15: cmp ax, dx
0x12b17: je 0x12b05
0x12b19: pop ax
0x12b1a: push dx
0x12b1b: add dx, 0x34a
0x12b1f: mov si, dx
0x12b21: mov dl, byte ptr cs:[si]
0x12b24: mov byte ptr [0x104], dl
0x12b28: pop dx
0x12b29: add dx, 0x351
0x12b2d: mov si, dx
0x12b2f: mov dl, byte ptr cs:[si]
0x12b32: mov byte ptr [0x106], dl
0x12b36: mov ax, 0x4200
2018-12-17T22:33:46.752850831Z 44 PC: 12b09 | Get time 0x12b09: xor dh, dh
0x12b0b: and dl, 7
0x12b0e: cmp dx, 6
0x12b11: jg 0x12b05
0x12b13: pop ax
0x12b14: push ax
0x12b15: cmp ax, dx
0x12b17: je 0x12b05
0x12b19: pop ax
0x12b1a: push dx
0x12b1b: add dx, 0x34a
0x12b1f: mov si, dx
0x12b21: mov dl, byte ptr cs:[si]
0x12b24: mov byte ptr [0x104], dl
0x12b28: pop dx
0x12b29: add dx, 0x351
0x12b2d: mov si, dx
0x12b2f: mov dl, byte ptr cs:[si]
0x12b32: mov byte ptr [0x106], dl
0x12b36: mov ax, 0x4200
2018-12-17T22:33:46.755442078Z 44 PC: 12b09 | Get time 0x12b09: xor dh, dh
0x12b0b: and dl, 7
0x12b0e: cmp dx, 6
0x12b11: jg 0x12b05
0x12b13: pop ax
0x12b14: push ax
0x12b15: cmp ax, dx
0x12b17: je 0x12b05
0x12b19: pop ax
0x12b1a: push dx
0x12b1b: add dx, 0x34a
0x12b1f: mov si, dx
0x12b21: mov dl, byte ptr cs:[si]
0x12b24: mov byte ptr [0x104], dl
0x12b28: pop dx
0x12b29: add dx, 0x351
0x12b2d: mov si, dx
0x12b2f: mov dl, byte ptr cs:[si]
0x12b32: mov byte ptr [0x106], dl
0x12b36: mov ax, 0x4200
2018-12-17T22:33:46.758516029Z 44 PC: 12b09 | Get time 0x12b09: xor dh, dh
0x12b0b: and dl, 7
0x12b0e: cmp dx, 6
0x12b11: jg 0x12b05
0x12b13: pop ax
0x12b14: push ax
0x12b15: cmp ax, dx
0x12b17: je 0x12b05
0x12b19: pop ax
0x12b1a: push dx
0x12b1b: add dx, 0x34a
0x12b1f: mov si, dx
0x12b21: mov dl, byte ptr cs:[si]
0x12b24: mov byte ptr [0x104], dl
0x12b28: pop dx
0x12b29: add dx, 0x351
0x12b2d: mov si, dx
0x12b2f: mov dl, byte ptr cs:[si]
0x12b32: mov byte ptr [0x106], dl
0x12b36: mov ax, 0x4200
2018-12-17T22:33:46.761131095Z 44 PC: 12b09 | Get time 0x12b09: xor dh, dh
0x12b0b: and dl, 7
0x12b0e: cmp dx, 6
0x12b11: jg 0x12b05
0x12b13: pop ax
0x12b14: push ax
0x12b15: cmp ax, dx
0x12b17: je 0x12b05
0x12b19: pop ax
0x12b1a: push dx
0x12b1b: add dx, 0x34a
0x12b1f: mov si, dx
0x12b21: mov dl, byte ptr cs:[si]
0x12b24: mov byte ptr [0x104], dl
0x12b28: pop dx
0x12b29: add dx, 0x351
0x12b2d: mov si, dx
0x12b2f: mov dl, byte ptr cs:[si]
0x12b32: mov byte ptr [0x106], dl
0x12b36: mov ax, 0x4200
2018-12-17T22:33:46.763693245Z 44 PC: 12b09 | Get time 0x12b09: xor dh, dh
0x12b0b: and dl, 7
0x12b0e: cmp dx, 6
0x12b11: jg 0x12b05
0x12b13: pop ax
0x12b14: push ax
0x12b15: cmp ax, dx
0x12b17: je 0x12b05
0x12b19: pop ax
0x12b1a: push dx
0x12b1b: add dx, 0x34a
0x12b1f: mov si, dx
0x12b21: mov dl, byte ptr cs:[si]
0x12b24: mov byte ptr [0x104], dl
0x12b28: pop dx
0x12b29: add dx, 0x351
0x12b2d: mov si, dx
0x12b2f: mov dl, byte ptr cs:[si]
0x12b32: mov byte ptr [0x106], dl
0x12b36: mov ax, 0x4200
2018-12-17T22:33:46.766535483Z 44 PC: 12b09 | Get time 0x12b09: xor dh, dh
0x12b0b: and dl, 7
0x12b0e: cmp dx, 6
0x12b11: jg 0x12b05
0x12b13: pop ax
0x12b14: push ax
0x12b15: cmp ax, dx
0x12b17: je 0x12b05
0x12b19: pop ax
0x12b1a: push dx
0x12b1b: add dx, 0x34a
0x12b1f: mov si, dx
0x12b21: mov dl, byte ptr cs:[si]
0x12b24: mov byte ptr [0x104], dl
0x12b28: pop dx
0x12b29: add dx, 0x351
0x12b2d: mov si, dx
0x12b2f: mov dl, byte ptr cs:[si]
0x12b32: mov byte ptr [0x106], dl
0x12b36: mov ax, 0x4200
2018-12-17T22:33:46.769800299Z 44 PC: 12b09 | Get time 0x12b09: xor dh, dh
0x12b0b: and dl, 7
0x12b0e: cmp dx, 6
0x12b11: jg 0x12b05
0x12b13: pop ax
0x12b14: push ax
0x12b15: cmp ax, dx
0x12b17: je 0x12b05
0x12b19: pop ax
0x12b1a: push dx
0x12b1b: add dx, 0x34a
0x12b1f: mov si, dx
0x12b21: mov dl, byte ptr cs:[si]
0x12b24: mov byte ptr [0x104], dl
0x12b28: pop dx
0x12b29: add dx, 0x351
0x12b2d: mov si, dx
0x12b2f: mov dl, byte ptr cs:[si]
0x12b32: mov byte ptr [0x106], dl
0x12b36: mov ax, 0x4200
2018-12-17T22:33:46.773000211Z 44 PC: 12b09 | Get time 0x12b09: xor dh, dh
0x12b0b: and dl, 7
0x12b0e: cmp dx, 6
0x12b11: jg 0x12b05
0x12b13: pop ax
0x12b14: push ax
0x12b15: cmp ax, dx
0x12b17: je 0x12b05
0x12b19: pop ax
0x12b1a: push dx
0x12b1b: add dx, 0x34a
0x12b1f: mov si, dx
0x12b21: mov dl, byte ptr cs:[si]
0x12b24: mov byte ptr [0x104], dl
0x12b28: pop dx
0x12b29: add dx, 0x351
0x12b2d: mov si, dx
0x12b2f: mov dl, byte ptr cs:[si]
0x12b32: mov byte ptr [0x106], dl
0x12b36: mov ax, 0x4200
2018-12-17T22:33:46.790014741Z 66 PC: 12b3f | Move file pointer
2018-12-17T22:33:46.791588732Z 44 PC: 12b44 | Get time 0x12b44: mov word ptr [0x109c], dx
0x12b48: mov si, 0x2ee
0x12b4b: mov di, 0x10a4
0x12b4e: mov cx, 0x1a
0x12b51: rep movsb byte ptr es:[di], byte ptr [si]
0x12b53: call 0x139e4
0x12b56: mov ah, 0x3e
0x12b58: int 0x21
0x12b5a: mov ah, 0x2c
0x12b5c: int 0x21
0x12b5e: xor dh, dh
0x12b60: and dl, 0x3f
0x12b63: cmp dx, 0x69
0x12b66: jg 0x12b5a
0x12b68: mov ah, 9
0x12b6a: add dx, dx
0x12b6c: add dx, 0x35f
0x12b70: mov si, dx
0x12b72: mov dx, word ptr cs:[si]
0x12b75: int 0x21
2018-12-17T22:33:46.795145088Z 64 PC: 139f6 | Write file or device (Write 4000 bytes on handle 5)
2018-12-17T22:33:46.815237734Z 62 PC: 12b5a | Close file
2018-12-17T22:33:46.825923539Z 44 PC: 12b5e | Get time 0x12b5e: xor dh, dh
0x12b60: and dl, 0x3f
0x12b63: cmp dx, 0x69
0x12b66: jg 0x12b5a
0x12b68: mov ah, 9
0x12b6a: add dx, dx
0x12b6c: add dx, 0x35f
0x12b70: mov si, dx
0x12b72: mov dx, word ptr cs:[si]
0x12b75: int 0x21
0x12b77: int 0x20
0x12b79: mov ah, 0xf
0x12b7b: int 0x10
0x12b7d: xor ah, ah
0x12b7f: int 0x10
0x12b81: mov ah, 1
0x12b83: mov cx, 0x2607
0x12b86: int 0x10
0x12b88: mov ax, 0xb800
0x12b8b: mov es, ax
2018-12-17T22:33:46.828943414Z 9 PC: 12b77 | Display string (String= 'Cannot start COMMAND, exiting ')