Sample viewer

vx.netlux.org/Trojan.DOS.Driver

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:45:39.429393574Z 48 PC: 191fc | Get DOS version
2018-12-17T22:45:39.430998596Z 74 PC: 1924c | Reallocate memory
2018-12-17T22:45:39.432903819Z 48 PC: 192b0 | Get DOS version
2018-12-17T22:45:39.434398103Z 53 PC: 192b8 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:45:39.435968712Z 37 PC: 192ca | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:45:39.43738839Z 53 PC: 1bf62 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:45:39.438458125Z 37 PC: 1bf72 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:45:39.444127065Z 53 PC: 1bf77 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:45:39.445512401Z 37 PC: 1bf87 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:45:39.447003378Z 53 PC: 19cb6 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:45:39.448764582Z 53 PC: 19cb6 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:45:39.450018504Z 53 PC: 19cb6 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:45:39.45124146Z 53 PC: 19cb6 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:45:39.452931637Z 53 PC: 19cb6 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:45:39.45505467Z 53 PC: 19cb6 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:45:39.457021189Z 53 PC: 19cb6 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:45:39.462750447Z 53 PC: 19cb6 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:45:39.46387371Z 53 PC: 19cb6 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:45:39.465018186Z 53 PC: 19cb6 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:45:39.46705219Z 53 PC: 19cb6 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:45:39.468295928Z 37 PC: 19ce5 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:45:39.469375055Z 37 PC: 19ce5 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:45:39.471431579Z 37 PC: 19ce5 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:45:39.473234695Z 37 PC: 19ce5 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:45:39.474612628Z 37 PC: 19ce5 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:45:39.476537765Z 37 PC: 19ce5 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:45:39.477603993Z 37 PC: 19ce5 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:45:39.47860235Z 37 PC: 19ce5 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:45:39.480444315Z 37 PC: 19cec | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:45:39.481443379Z 37 PC: 19cf1 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:45:39.482756356Z 68 PC: 1935b | I/O control for devices (Set for = '�')
2018-12-17T22:45:39.484992114Z 68 PC: 1935b | I/O control for devices (Set for = '/S /B /O:-D >TXT')
2018-12-17T22:45:39.486500837Z 68 PC: 1935b | I/O control for devices (Set for = '���t� ')
2018-12-17T22:45:39.487934008Z 68 PC: 1935b | I/O control for devices (Set for = 'k� ')
2018-12-17T22:45:39.490067365Z 68 PC: 1935b | I/O control for devices (Set for = 'k� ')
2018-12-17T22:45:39.492021781Z 53 PC: 16646 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:45:39.493374868Z 53 PC: 16653 | Get interrupt vector (Interrupt = '4' AKA 'Auxiliary output')
2018-12-17T22:45:39.495341848Z 53 PC: 16660 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:45:39.496503627Z 37 PC: 16675 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:45:39.497557031Z 37 PC: 1667d | Set interrupt vector (Interrupt = '4' AKA 'Auxiliary output')
2018-12-17T22:45:39.499647441Z 37 PC: 16685 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:45:39.500881689Z 53 PC: 17104 | Get interrupt vector (Interrupt = '239' AKA 'UNKNOWN!')
2018-12-17T22:45:39.50262797Z 53 PC: 17111 | Get interrupt vector (Interrupt = '240' AKA 'UNKNOWN!')
2018-12-17T22:45:39.504614566Z 53 PC: 17120 | Get interrupt vector (Interrupt = '9' AKA 'Display string')
2018-12-17T22:45:39.505920142Z 37 PC: 1712d | Set interrupt vector (Interrupt = '239' AKA 'UNKNOWN!')
2018-12-17T22:45:39.507053898Z 53 PC: 17134 | Get interrupt vector (Interrupt = '8' AKA 'Console input without echo')
2018-12-17T22:45:39.508784982Z 37 PC: 17141 | Set interrupt vector (Interrupt = '240' AKA 'UNKNOWN!')
2018-12-17T22:45:39.510064635Z 53 PC: 1714d | Get interrupt vector (Interrupt = '28' AKA 'Get allocation info for specified drive')
2018-12-17T22:45:39.51434599Z 48 PC: 1720f | Get DOS version
2018-12-17T22:45:39.516669171Z 74 PC: 15311 | Reallocate memory
2018-12-17T22:45:39.518742807Z 74 PC: 15311 | Reallocate memory
2018-12-17T22:45:39.52050113Z 68 PC: 165bc | I/O control for devices (Set for = ' ')
2018-12-17T22:45:39.527065149Z 68 PC: 165bc | I/O control for devices (Set for = '')
2018-12-17T22:45:39.528770874Z 51 PC: 165da | Get or set Ctrl-Break
2018-12-17T22:45:39.529931726Z 51 PC: 165e6 | Get or set Ctrl-Break
2018-12-17T22:45:39.533504422Z 42 PC: 14c36 | Get date 0x14c36: pop bx
0x14c37: mov al, dh
0x14c39: call 0x14d27
0x14c3c: mov al, 0x2d
0x14c3e: call 0x14d2f
0x14c41: mov al, dl
0x14c43: call 0x14d27
0x14c46: mov al, 0x2d
0x14c48: call 0x14d2f
0x14c4b: sub cx, 0x76c
0x14c4f: cmp cl, 0x64
0x14c52: mov ch, 0x13
0x14c54: jb 0x14c5b
0x14c56: sbb cl, 0x64
0x14c59: inc ch
0x14c5b: mov al, ch
0x14c5d: call 0x14d27
0x14c60: mov al, cl
0x14c62: call 0x14d27
0x14c65: pop ax
2018-12-17T22:45:39.538711878Z 37 PC: 173df | Set interrupt vector (Interrupt = '28' AKA 'Get allocation info for specified drive')
2018-12-17T22:45:39.540128011Z 53 PC: 173e6 | Get interrupt vector (Interrupt = '239' AKA 'UNKNOWN!')
2018-12-17T22:45:39.54269832Z 37 PC: 173f3 | Set interrupt vector (Interrupt = '9' AKA 'Display string')
2018-12-17T22:45:39.544129444Z 37 PC: 173fe | Set interrupt vector (Interrupt = '239' AKA 'UNKNOWN!')
2018-12-17T22:45:39.545584935Z 37 PC: 17409 | Set interrupt vector (Interrupt = '240' AKA 'UNKNOWN!')
2018-12-17T22:45:39.548066107Z 51 PC: 165f1 | Get or set Ctrl-Break
2018-12-17T22:45:39.5493135Z 37 PC: 16873 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:45:39.550744096Z 37 PC: 1687d | Set interrupt vector (Interrupt = '4' AKA 'Auxiliary output')
2018-12-17T22:45:39.552358449Z 37 PC: 16887 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:45:39.553776604Z 37 PC: 19d01 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:45:39.555678455Z 37 PC: 19d01 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:45:39.557648424Z 37 PC: 19d01 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:45:39.55893294Z 37 PC: 19d01 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:45:39.560261669Z 37 PC: 19d01 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:45:39.562449962Z 37 PC: 19d01 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:45:39.563777628Z 37 PC: 19d01 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:45:39.565023602Z 37 PC: 19d01 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:45:39.567063434Z 37 PC: 19d01 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:45:39.56848791Z 37 PC: 19d01 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:45:39.569845948Z 37 PC: 19d01 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:45:39.572068709Z 37 PC: 1bf96 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:45:39.57348179Z 37 PC: 1940c | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:45:39.574830814Z 76 PC: 193f5 | Terminate with return code (Return code = '0')