. .___________ _|_ ______________________________. | | | : bOONDOCKS · oNE oF tHE fASTEST iN eUROPE | . _______ __ _|_ ____ ______ ________ : _____ _|_\_ / . | . \_ __ ______\_. \ ______ _\_. /__| ___ / __/__ | / / | : | / \| / l \/ . \ l___/\_ |/ /___ / : \ \______|______/ \ /_________/ | \________/ / _/_______/_ _l______/sc : _/ \____/ \__________/ _/ \___) | | . \_____| \______| | | : | |hELLFiRE & lSD wHQ!·tRISTAR & rED^SECTOR iNC., sUNFLEX iNC. & lFC aMIGA eHQ!| | tRiSTAR & rEDSECTOR iNC. cONSOLE aND gERMAN cONSOLE sYNDICATE wHQ! | | sNEAKERS eUROPEAN hQ | | tRiSTAR & rED^SECTOR iNC. /X-iNNOVATiON wORLD diSTRiBUTiON sITE | | cLASSIC^qUARTEX hQ! · dREAMCHARTS, dEViOUS dEZiGNS & dATA dIVISION dHQ! | | -g^sTYLE! & tWISTED wHQ! · pRO aRTS & rOADHOGZ eHQ! | | | | mASTERS aRE: | | -·>s/\L-oNE!·mARIO·sECTORCHARGER·cOLONEL·gAZ P·eCS<·- | | | | rUNNING oN aN aMIGA 4ooo wITH a cYBERSTORM o6o/5o mHZ/22 mB! | | 2 * cREDITZ fOR mAJORS! 3 * cREDITZ fOR mAJORS fROM yOUR oWN gROUP! | | | | +31-(o)-548-54O-653 +31-(o)-548-521-716/521-848 +tEL-NET | | -·>16k8 dUAL<·- -·>33k6 dUALS!<·- 23:30-06:00 gMT +1 | | | l_________._ _ _ _._________| ________ | -·>nO nEW uSER pASSWORD aND/oR sYSTEM pASSWORd!<·- | ________ |________|| ||________| : uPLOADEd bY SHALLoW oN nODE #02 : . tIME aND dATE oF tHE uPLOAD: 07:27:46 , 12-11-1996 . å --------------------------------^ aDDs ^----------------------------------- ---------- ----------- tHE fILE `STS-EP16.DMS' "abyss-ex.exe" iS iNFECTED bY HitchHiker 3.00 Virus ---------- ----------- STS-EP16.DMS 747221 ___ ____. __ ____. __. ___ __/ _/____\___l__(_/__\__ l__\ l_____/ _/___ \___ __/ l/ __/ \___ __ l ___ \l____ ___/ __ l ___ l __ (_____) (__\g®m(___) /____)(_____) (_____) . : Purple Haze / Saints'96 is proud to ¦ presents · | «« e a s y p a c k nO.16! »» : l___ Including music by SH1 ^ Hyperia ___| - --------------------------------------------------------------------- - STS-EP16.DMS List: DF2:Libs/explode.library DF2:Libs/req.library DF2:S/Startup-Sequence DF2:Stuff4YOU!/unpackme!.lha vwlha:saints-archivez/Purple_Haze.IFF.info vwlha:saints-archivez/Purple Haze4 38x22 vwlha:saints-archivez/Purple Haze3 76x19 vwlha:saints-archivez/Purple_Haze.IFF vwlha:saints-archivez/nOp!-iZz-KoOL.txt vwlha:saints-archivez/ISCadd.04.txt vwlha:saints-archivez/Dweep-Saints.tXt vwlha:saints-archivez/Addy_eXe02.txt DF2:Stuff4YOU!/AMIGA!.txt DF2:Stuff4YOU!/tFt^rNo!.2 DF2:Stuff4YOU!/Chriz_45x11 DF2:Stuff4YOU!/eLT^mSV.mAZE.sMALL DF2:Stuff4YOU!/Primal_Rage!.exe DF2:Stuff4YOU!//!fEEDBACk-vOTESHEEt! DF2:Stuff4YOU!//Top30.VoteSheet DF2:Stuff4YOU!//Norwegian-Charts_Votesheet.txt DF2:Stuff4YOU!/fK!_Ad74x12.t×t DF2:Stuff4YOU!/Add-Styles.S2.pp DF2:Stuff4YOU!/sd-advert5.txt DF2:credz DF2:presents DF2:presents2 DF2:easypack DF2:menu DF2:BONUS! ;)/analyse.txt DF2:BONUS! ;)/sih-res!.txt DF2:BONUS! ;)/ult-seek.txt DF2:BONUS! ;)/giannasi.lha DF2:BONUS! ;)/mod.himalay.pp DF2:mod.easypacktewn.pp DF2:C/Wait DF2:C/PlayIt DF2:C/Type3 DF2:C/Border DF2:C/Cls DF2:C/PTP DF2:C/Type2 DF2:C/Type DF2:C/Click DF2:Devs/system-configuration DF2:Files/irs-pma.lha vwlha:file_id.diz vwlha:PartyMania.exe DF2:Files/lfc-ufop.lha vwlha:File_Id.Diz vwlha:UFO-PATCH/UFO_Patch.exe DF2:Files/m_ephe.lha vwlha:mod.rhythmoasis vwlha:mod.confuzed vwlha:m_ephe.nfo vwlha:m_1996.rel vwlha:file_id.diz DF2:Files/hos-watr.txt DF2:Files/scf-pws.txt DF2:Files/abyss-ex.exe <---- HitchHiker 3.00 Virus Infected DF2:Files/afsund14.lha vwlha:file_id.diz vwlha:MUI-AFS-UndeleteV1.4/MUI AFS-Undelete.info vwlha:MUI-AFS-UndeleteV1.4/MUI AFS-Undelete.guide.info vwlha:MUI-AFS-UndeleteV1.4/MUI AFS-Undelete vwlha:MUI-AFS-UndeleteV1.4.info DF2:Files/hf-y123u.lha vwlha:file_id.diz vwlha:YAGG/Yagg_v1.23 vwlha:YAGG/YAGG_v1.23.info vwlha:YAGG/YAGG.guide.ita.info vwlha:YAGG/YAGG.guide.ita vwlha:YAGG/YAGG.guide.eng.info vwlha:YAGG/YAGG.guide.eng vwlha:YAGG/Y3Dpreview.png.info vwlha:YAGG/Y3Dpreview.png vwlha:YAGG/Developer.ita vwlha:YAGG/Developer.eng DF2:Files/hftros.lha vwlha:fILE_iD.dIZ vwlha:HF/README.TXT vwlha:HF/hf&lsd.exe vwlha:HF/Hellfire_Trainer3.exe vwlha:HF/Hellfire_Trainer2.exe vwlha:HF/Hellfire_Trainer.exe vwlha:HF/Hellfire9.exe vwlha:HF/Hellfire8.exe vwlha:HF/Hellfire7.exe vwlha:HF/Hellfire6.exe vwlha:HF/Hellfire5.exe vwlha:HF/Hellfire4.exe vwlha:HF/Hellfire3.exe vwlha:HF/Hellfire2.exe vwlha:HF/Hellfire14.exe vwlha:HF/Hellfire13.exe vwlha:HF/Hellfire12.exe vwlha:HF/Hellfire11.exe vwlha:HF/Hellfire10.exe vwlha:HF/Hellfire.exe ---------- ----------- fOUND wITH dA gREAT vIRUS wORKSHOP 6.3 bY fLAKE/tRSI 10-Dec-96 20:22:16 ---------- ----------- Entry...............: Hitch Hiker 3.00 Alias(es)...........: none Virus Strain........: - Virus detected when.: 13.07.1996 where.: Germany, USA, ISRAEL Classification......: Linkvirus,memory-resident, not reset-resident Length of Virus.....: 1. Length on storage medium: ca. 3020 Bytes (uses a polymorphic technic) 2. Length in RAM: 8000 Bytes --------------------- Preconditions ------------------------------------ Operating System(s).: AMIGA-DOS Version/Release.....: 2.04 and above (V37+) Computer model(s)...: all models/processors (MC68000-MC68060) --------------------- Attributes --------------------------------------- Easy Identification.: none Type of infection...: Self-identification method in files: - none Self-identification method in memory: - searches for $FAB4FAB4 at LastAlert(Exec) System infection: - infects the following functions: Dos LoadSeg(), Dos Write() (librarychecksum will be recalculated and it will be tried to cheat some viruskillers) Infection preconditions: - HUNK_HEADER and HUNK_CODE are found - device is validated - 10 free blocks on the device - hunk_code must contain the same length as in the header. - File must be between $1f40 and $20000 bytes (not working) Infection Trigger...: Accessing files via LoadSeg() or Write() It`s a typical infector. It cannot be rated as fast infector as it only infects at the above mentioned operations. Storage media affected: all DOS-devices Interrupts hooked...: None Damage..............: Permanent damage: - Due to a adressacess behind the viruscode it`s possible that trashed code results out of an infection. Transient damage: - none Damage Trigger......: Permanent damage: - none Transient damage: - None Particularities.....: The crypt/decrypt routines are partly aware of processor caches. The cryptroutine are polymorphic and consists of some logical stuff. The virus uses some special things at the fileinfection (buggy) and at the library offsetcode. Similarities........: Link-method is comparable to the method invented with the infiltrator-virus and the first HitchHiker viruses. Stealth.............: no stealth function found. the only things to mention is the library negoffset value. Armouring...........: The virus is heavily armoured with a $100 byte long polymorphic decryptor. Not only the registers are changing, even the operations will be mixed. This polymorphic routine can be seen right now as one of the best available routine for the AMIGA. The routine mixes a lot of codes and uses a normal polymorphic scheme. No slow polymorphism code was found. The decrypt header is static $100 bytes long and initialises a circular decryption. The decryption code uses anti heuristik stuff and only a full implented code emulation would be able to crack this one. The polymorphism is working in the normal scheme (with $dff006 and $dff007 usage) and uses not the modern technics like slow polymorphism. ("White paper" analyse of this engine can be obtained from me or from the Virus Test Center in Hamburg. We need special information about you before we give such information away.) Comments............: Maybe interesting for the reader is that the programmer of the virus wrote some more text in it than in the last ones: 'The Hitch-Hiker Generation: 00000308 - Version 3.00' 'Last in series. "Dedicated to Heiner Markus ZIB and Georg" It would be interesting to know, who this ZIB is. --------------------- Agents ------------------------------------------- Countermeasures.....: VT 2.86 and VW 6.2ß above Standard means......: - --------------------- Acknowledgement ---------------------------------- Location............: Hannover, Germany 17.07.1996. Classification by...: Markus Schmall and Heiner Schneegold Documentation by....: Markus Schmall (C) Date................: July, 17. 1996 Information Source..: Reverse engineering of original virus Copyright...........: This document is copyrighted and may be not used in any SHI publication iNFO tAKEN fROM vIRUSWORKSHOP gUIDE bY Flake/Trsi ---------- ----------- ... SHALLoW/sAD·lFC·rKM·fIX·sLT·cB4 @BEGIN_FILE_ID.DIZ · ___________________________ .-// / / / / __ / / / ___/ //-------. | / / / / / _/ / /___ / / ·22· | | \____/__/__/__/_____/_____/ · | | | | hITCHhIKER vIRUS fOUND iN sTS-eP16.dMS | | | `------------------------------------------' @END_FILE_ID.DIZ --------------------------------v aDDs v----------------------------------- ¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯ -( [ bOONDOCKS! ] [ oNE oF tHE fASTEST iN eUROPE ] )- ________________________________________________________________________ __/ __ __/ _ __/ _ __/ _ __/ ___ __/ _ __/ ____/ / __/ ____/ \_ _ \_ / \_ / \_ / \_ / \_ / \_ / \_ _ \_____ \_ / / ¯¯/ _/ / _/ / / / _/ / _/ / _/ / / ¯¯/ _/ / /___ \__ \__ \__/ \__ \__ \__ \__/ \__ \ sAl1 \/______\/ \/______\/ \/______\/ \/______\/ \ / \ /________\ / \ /________\ / / \ / \ / [·hELLFIRE&lSD wHQ!·tRISTAR aND rED^sECTOR ¡NC.·sUNFLEX iNC.&lFC aMIGA eHQ!·] [·tRiSTAR & rED^SECTOR iNC. cONSOLE·&·gERMAN cONSOLE sYNDICATE wHQ!·] [·tRISTAR & rED^sECTOR ¡NC! /X-iNNOVATION wORLD dISTRIBUTION sITE!·] [·cLASSIC^qUARTEX hQ!·] [·dREAMCHARTS·dEVIOUS dEZIGNS·&·dATA dIVISION dHQ!·] [·-g^sTYLE!·&·tWISTED wHQ!·] [·pRO ARTS·&·rOADHOGZ eHQ!·] [·sYSOPS: s/\L-oNE!·mARIO·sECTORCHARGER·cOLONEL·gAZ P·eCS·] rUNNING oN aN aMIGA 4OOO wITH a cYBERSTORM O6O/5O mHZ/22 mB 2 * cREDITZ fOR mAJORS! 3 * cREDITZ fOR mAJORS fROM yOUR oWN gROUP! --»> lATEST aMIEXPRESS vERSION 4.xX! <«-- ---»> nO nEW uSER pASSWORD aND/oR sYSTEM pASSWORD! <«--- +31-(O)-548-54O-653 +31-(O)-548-521-716/521-848 +tEL-NET -[ 16k8 dUAL ]- -[ 33k6 dUALS ]- -[ 23:30-06:00 gMT +1 ]- [-[[ uPLOADEd bY: SHALLoW ]]-]--[-[[ nODE: 02 ]]-] [-[[ tIME aND dATE oF tHE uPLOAD: ]]---[[ 07:27:46, 12-11-1996 ]]-]