. .___________ _|_ ______________________________. | | | : bOONDOCKS · oNE oF tHE fASTEST iN eUROPE | . _______ __ _|_ ____ ______ ________ : _____ _|_\_ / . | . \_ __ ______\_. \ ______ _\_. /__| ___ / __/__ | / / | : | / \| / l \/ . \ l___/\_ |/ /___ / : \ \______|______/ \ /_________/ | \________/ / _/_______/_ _l______/sc : _/ \____/ \__________/ _/ \___) | | . \_____| \______| | | : | |hELLFiRE & lSD wHQ!·tRISTAR & rED^SECTOR iNC., sUNFLEX iNC. & lFC aMIGA eHQ!| | tRiSTAR & rEDSECTOR iNC. cONSOLE aND gERMAN cONSOLE sYNDICATE wHQ! | | sNEAKERS eUROPEAN hQ | | tRiSTAR & rED^SECTOR iNC. /X-iNNOVATiON wORLD diSTRiBUTiON sITE | | cLASSIC^qUARTEX hQ! · dREAMCHARTS, dEViOUS dEZiGNS & dATA dIVISION dHQ! | | -g^sTYLE! & tWISTED wHQ! · pRO aRTS & rOADHOGZ eHQ! | | | | mASTERS aRE: | | -·>s/\L-oNE!·mARIO·sECTORCHARGER·cOLONEL·gAZ P·eCS<·- | | | | rUNNING oN aN aMIGA 4ooo wITH a cYBERSTORM o6o/5o mHZ/22 mB! | | 2 * cREDITZ fOR mAJORS! 3 * cREDITZ fOR mAJORS fROM yOUR oWN gROUP! | | | | +31-(o)-548-54O-653 +31-(o)-548-521-716/521-848 +tEL-NET | | -·>16k8 dUAL<·- -·>33k6 dUALS!<·- 23:30-06:00 gMT +1 | | | l_________._ _ _ _._________| ________ | -·>nO nEW uSER pASSWORD aND/oR sYSTEM pASSWORd!<·- | ________ |________|| ||________| : uPLOADEd bY SHALLoW oN nODE #02 : . tIME aND dATE oF tHE uPLOAD: 07:09:57 , 12-23-1996 . å - --------------------------------------------------------------------- - fOUND wITH dA gREAT vIRUS wORKSHOP 6.3 bY fLAKE/tRSI 22-Dec-96 14:57:07 ---------- ----------- Entry...............: Ebola Virus Alias(es)...........: E1116 (to stay CAROconform) Virus Strain........: - Virus detected when.: 9/1995 where.: Germany Classification......: Linkvirus,memory-resident, not reset-resident Length of Virus.....: 1. Length on storage medium: 1116 Bytes 2. Length in RAM: 3300 Bytes --------------------- Preconditions ------------------------------------ Operating System(s).: AMIGA-DOS Version/Release.....: 2.04 and above (V37+) Computer model(s)...: all models/processors (MC68000-MC68060) --------------------- Attributes --------------------------------------- Easy Identification.: none Type of infection...: Self-identification method in files: - Searches for $ab1590ef at the end of the first Hunk. Self-identification method in memory: - Checks for $213f at offset -2 of the loadseg() function System infection: - non RAM resident, infects the following functions: Dos LoadSeg(), Exec FindTask() and Exec OpenResource() Infection preconditions: - File to be infected is bigger then 2500 bytes and smaller then 130000 bytes - First hunk contains a $4eaexxxx command in the 16 bit range to the end of the file (test for the first entry) - the file is not already infected (the at long of the end of the hunk) - HUNK_HEADER and HUNK_CODE are found Infection Trigger...: Accessing files via LoadSeg() Storage media affected: all DOS-devices Interrupts hooked...: None Damage..............: Permanent damage: - None Transient damage: - none Damage Trigger......: Permanent damage: - None Transient damage: - None Particularities.....: The crypt/decrypt routines are partly aware of processor caches. The cryptroutine are non polymorphic and only consists of some logical stuff. The virus uses some simple retro technics to stop viruskillers searching for Draco and possible for the HochOfen (Trabbi) Virus. Similarities........: Link-method is comparable to the method invented with the infiltrator-virus Stealth.............: No stealth abilities Armouring...........: The virus uses only a single armouring technique to confuse people. It only crypts it`s code based on the position of the rasterbeam. Comments............: The name EBOLA is the name of a virus, which humans can get infected with. CARO rules say, that no names of persons etc. may be used to call a virus, but I spoke to other persons and they already recognized this virus in this way. --------------------- Agents ------------------------------------------- Countermeasures.....: VW5.5 and VT 2.76 Countermeasures successful: All of the above Standard means......: - --------------------- Acknowledgement ---------------------------------- Location............: Hannover, Germany 03.09.1995. Classification by...: Markus Schmall and Heiner Schneegold Documentation by....: Markus Schmall (C) Date................: September,03. 1995 Information Source..: Reverse engineering of original virus Copyright...........: This document is copyrighted and may be not used in any SHI publication iNFO tAKEN fROM vIRUSWORKSHOP gUIDE bY Flake/Trsi ---------- ----------- ... SHALLoW/sAD·lFC·rKM·fIX·sLT·cB4 @BEGIN_FILE_ID.DIZ · ___________________________ .-// / / / / __ / / / ___/ //-------. | / / / / / _/ / /___ / / ·24· | | \____/__/__/__/_____/_____/ · | | | | eBOLA lINK-vIRUS fOUND iN pET-sUS5.dMS | | | `------------------------------------------' @END_FILE_ID.DIZ --------------------------------v aDDS v----------------------------------- ¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯ -( [ bOONDOCKS! ] [ oNE oF tHE fASTEST iN eUROPE ] )- ________________________________________________________________________ __/ __ __/ _ __/ _ __/ _ __/ ___ __/ _ __/ ____/ / __/ ____/ \_ _ \_ / \_ / \_ / \_ / \_ / \_ / \_ _ \_____ \_ / / ¯¯/ _/ / _/ / / / _/ / _/ / _/ / / ¯¯/ _/ / /___ \__ \__ \__/ \__ \__ \__ \__/ \__ \ sAl1 \/______\/ \/______\/ \/______\/ \/______\/ \ / \ /________\ / \ /________\ / / \ / \ / [·hELLFIRE&lSD wHQ!·tRISTAR aND rED^sECTOR ¡NC.·sUNFLEX iNC.&lFC aMIGA eHQ!·] [·tRiSTAR & rED^SECTOR iNC. cONSOLE·&·gERMAN cONSOLE sYNDICATE wHQ!·] [·tRISTAR & rED^sECTOR ¡NC! /X-iNNOVATION wORLD dISTRIBUTION sITE!·] [·cLASSIC^qUARTEX hQ!·] [·dREAMCHARTS·dEVIOUS dEZIGNS·&·dATA dIVISION dHQ!·] [·-g^sTYLE!·&·tWISTED wHQ!·] [·pRO ARTS·&·rOADHOGZ eHQ!·] [·sYSOPS: s/\L-oNE!·mARIO·sECTORCHARGER·cOLONEL·gAZ P·eCS·] rUNNING oN aN aMIGA 4OOO wITH a cYBERSTORM O6O/5O mHZ/22 mB 2 * cREDITZ fOR mAJORS! 3 * cREDITZ fOR mAJORS fROM yOUR oWN gROUP! --»> lATEST aMIEXPRESS vERSION 4.xX! <«-- ---»> nO nEW uSER pASSWORD aND/oR sYSTEM pASSWORD! <«--- +31-(O)-548-54O-653 +31-(O)-548-521-716/521-848 +tEL-NET -[ 16k8 dUAL ]- -[ 33k6 dUALS ]- -[ 23:30-06:00 gMT +1 ]- [-[[ uPLOADEd bY: SHALLoW ]]-]--[-[[ nODE: 02 ]]-] [-[[ tIME aND dATE oF tHE uPLOAD: ]]---[[ 07:09:57, 12-23-1996 ]]-]