Sample viewer

vx.netlux.org/Trojan.DOS.KillCMOS.d

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:41:31.26734857Z 53 PC: 12b76 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:41:31.269705323Z 53 PC: 12b76 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:41:31.271196702Z 53 PC: 12b76 | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:41:31.272717338Z 53 PC: 12b76 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:41:31.274567158Z 53 PC: 12b76 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:41:31.27671682Z 53 PC: 12b76 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:41:31.278029557Z 53 PC: 12b76 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:41:31.27944539Z 53 PC: 12b76 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:41:31.281750199Z 53 PC: 12b76 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:41:31.283280811Z 53 PC: 12b76 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:41:31.284802671Z 53 PC: 12b76 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:41:31.28678041Z 53 PC: 12b76 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:41:31.288211381Z 53 PC: 12b76 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:41:31.289562482Z 53 PC: 12b76 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:41:31.292728791Z 53 PC: 12b76 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:41:31.293866522Z 53 PC: 12b76 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:41:31.294891546Z 53 PC: 12b76 | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:41:31.296612358Z 53 PC: 12b76 | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:41:31.300829467Z 37 PC: 12b8b | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:41:31.302187166Z 37 PC: 12b93 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:41:31.303656577Z 37 PC: 12b9b | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:41:31.304657075Z 37 PC: 12ba3 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:41:31.306076652Z 68 PC: 12ee8 | I/O control for devices (Set for = '')
2018-12-17T22:41:31.308433312Z 42 PC: 12ab7 | Get date 0x12ab7: xor ah, ah
0x12ab9: les di, ptr [bp + 6]
0x12abc: stosw word ptr es:[di], ax
0x12abd: mov al, dl
0x12abf: les di, ptr [bp + 0xa]
0x12ac2: stosw word ptr es:[di], ax
0x12ac3: mov al, dh
0x12ac5: les di, ptr [bp + 0xe]
0x12ac8: stosw word ptr es:[di], ax
0x12ac9: xchg ax, cx
0x12aca: les di, ptr [bp + 0x12]
0x12acd: stosw word ptr es:[di], ax
0x12ace: pop bp
0x12acf: retf 0x10
0x12ad2: push bp
0x12ad3: mov bp, sp
0x12ad5: mov cx, word ptr [bp + 0xa]
0x12ad8: mov dh, byte ptr [bp + 8]
0x12adb: mov dl, byte ptr [bp + 6]
0x12ade: mov ah, 0x2b
2018-12-17T22:41:31.310745265Z 64 PC: 12feb | Write file or device (Write 0 bytes on handle 1)
2018-12-17T22:41:31.312378791Z 37 PC: 12c85 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:41:31.313825698Z 37 PC: 12c85 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:41:31.315204565Z 37 PC: 12c85 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:41:31.316619556Z 37 PC: 12c85 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:41:31.318490822Z 37 PC: 12c85 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:41:31.3196235Z 37 PC: 12c85 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:41:31.320686133Z 37 PC: 12c85 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:41:31.326490371Z 37 PC: 12c85 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:41:31.327743688Z 37 PC: 12c85 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:41:31.328746089Z 37 PC: 12c85 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:41:31.329905992Z 37 PC: 12c85 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:41:31.331100695Z 37 PC: 12c85 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:41:31.331942234Z 37 PC: 12c85 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:41:31.332866355Z 37 PC: 12c85 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:41:31.334767873Z 37 PC: 12c85 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:41:31.335742341Z 37 PC: 12c85 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:41:31.336711215Z 37 PC: 12c85 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:41:31.33869016Z 37 PC: 12c85 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:41:31.339897483Z 76 PC: 12cc4 | Terminate with return code (Return code = '0')