GNAT

Alias:
Strain:	-
detected when:
where:
Classification:	EXE-infector, resident
Length:	832
Preconditions
Operating System(s):	MS-DOS
Version/Release:	All models
Computer model(s):	PC's
Caroname:	GNAT
Attributes
Easy identification:
Type of Infection:	The virus appends itself to the files Selfrec in memory: memw[0000h:0086h] > 0350h {SEG(INT 21) > 0350h} Selfrec on disk: (file[0014h] = 03h) AND (file[0015h] = 01h) {EXE-IP = 0103h}
Infection Technique:
Infection Trigger:	(Exec OR Load w/o Exec) AND (memw[0000h:004Eh] <= 0300h){SEG(INT 13)<=0300h} AND (file[4] >= 1) {Length>=512} AND(file[4] = ((Length SHR 9)+(1; IF Length MOD 512 = 0)))
Storage Media affected:
Interrupts hooked:	1C, 21/4B00, 21/4B02, 24(while in INT 21 ISR)
Stealth:
Tunneling/Selfprot:
Oligo/Polymorphism:	- the virus uses variable encryption with a variable decryptor, but the decryptor can be detected with a wildcard string.
Encoding Method:
Damage:	Transient: mirror screen horizontally and vertically Permanent: -
Damage Trigger:	Transient: (Date = Oct. 11.) AND (BIOS_timer_low = 0FFFFh) ANDat least one new infection this day Permanent: -
Particularities:	The virus resides above the last MCB Not displayed text: "GNAT 1.0" ;encrypted sets file r/w for infection;restores original file attributes, date & timeafter infection;hooking interrupts by direct memory access;while running the INT 21h ISR temporarily storing theINT 21 vector saved on infection back to IVT;slightly self modifying code;the en-/decryption key is the low byte of the new CS valuein the EXE-file-header;no TSR-call, just jumps to original program at it's end
Similarities:
Agents
Countermeasures:
Standard means:
Acknowledgements
Location:	Virus Test Center, University Hamburg, FRG
Classification by:	Dirk Haratz, VTC, University of Rostock, Germany
Documentation by:	Dirk Haratz, dharatz@informatik.uni-rostock.de
Date:	1993-07-23
Information Source:	Caroentry (autom.converter by S.Freitag)

GNAT

Preconditions

Attributes

Agents

Acknowledgements