Sample viewer

vx.netlux.org/Trojan.DOS.Grab

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:35:32.739372466Z 53 PC: 1aa56 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:35:32.74072685Z 53 PC: 1aa56 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:35:32.741710037Z 53 PC: 1aa56 | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:35:32.742769608Z 53 PC: 1aa56 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:35:32.744308993Z 53 PC: 1aa56 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:35:32.745274988Z 53 PC: 1aa56 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:35:32.746138228Z 53 PC: 1aa56 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:35:32.74772143Z 53 PC: 1aa56 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:35:32.748729392Z 53 PC: 1aa56 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:35:32.749704975Z 53 PC: 1aa56 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:35:32.751314829Z 53 PC: 1aa56 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:35:32.752673337Z 53 PC: 1aa56 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:35:32.753780655Z 53 PC: 1aa56 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:35:32.755496818Z 53 PC: 1aa56 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:35:32.756762745Z 53 PC: 1aa56 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:35:32.757923736Z 53 PC: 1aa56 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:35:32.75950791Z 53 PC: 1aa56 | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:35:32.760628331Z 53 PC: 1aa56 | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:35:32.761687011Z 37 PC: 1aa6b | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:35:32.76297867Z 37 PC: 1aa73 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:35:32.764043188Z 37 PC: 1aa7b | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:35:32.765254736Z 37 PC: 1aa83 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:35:32.767050612Z 68 PC: 1b5be | I/O control for devices (Set for = '')
2018-12-17T22:35:32.838858623Z 37 PC: 1a487 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:35:32.857773103Z 44 PC: 1b2cc | Get time 0x1b2cc: mov word ptr [0x282], cx
0x1b2d0: mov word ptr [0x284], dx
0x1b2d4: retf
0x1b2d5: push di
0x1b2d6: cld
0x1b2d7: mov bx, ax
0x1b2d9: or dx, dx
0x1b2db: jge 0x1b2ea
0x1b2dd: not bx
0x1b2df: not dx
0x1b2e1: add bx, 1
0x1b2e4: adc dx, 0
0x1b2e7: mov al, 0x2d
0x1b2e9: stosb byte ptr es:[di], al
0x1b2ea: mov si, 0x917
0x1b2ed: mov cl, 9
0x1b2ef: cmp dx, word ptr cs:[si + 2]
0x1b2f3: jb 0x1b2fc
0x1b2f5: ja 0x1b303
0x1b2f7: cmp bx, word ptr cs:[si]