Fandom

Malware Wiki

Arriba

1,328pages on
this wiki
Add New Page
Comments0 Share

Virus.DOS.Arriba is a memory resident parasitic virus on DOS.

There are 2 variants:

  • Virus.DOS.Arriba.1590 (A and B)

BehaviorEdit

When the virus is loaded into memory, it hooks INT 21h and 24h to infect any executable that is run.

The virus behaves stealthy when MEM is run so that the actual memory comsumption of the virus will not be shown, but the size change of the infected files is still visible.

Memory usageEdit

The following table shows the memory usage of the variants.

Variant Memory usage in bytes
Arriba.1590 (A and B) 9,000

PayloadEdit

Arriba.1590.aEdit

This variant activates on November 20th. It displays a marquee in high speed, followed by hanging the system:

Cara al sol con la camisa nueva
que tu bordaste rojo ayer
hallaras la muerte si te llega
y no te vuelvo a ver
formare junto a mis compañeros
que hacen guardia sobre los luceros
impasible el ademan y están presentes
en nuestro afan
si te dicen que cai me fui al puesto que tengo alli
volveran banderas victoriosas al paso alegre
de la paz y seran prendidas cinco rosas las flechas de mi paz
volvera a reir la primavera que por cielo y tierra y mar
esperan arriba a España y a vencer, que en España empieza
a AMANECER
20-N-90 Spain Jaws & Shark ARRIBA ESPAÑA

Translation (from Spanish):

Face to the sun with the new shirt
Your red embroider on yesterday
You will find death if it comes to you
And I never see you again
I will train with my partners
Who stand guard over the stars
Impassible motion and are present
In our eagerness
If they tell you to fall I went to the post I have there
Will return victorious flags to the merry step
Of peace and five roses will be caught the arrows of my peace
Spring will laugh again than by sky and land and sea
They wait up to Spain and to overcome, that in Spain begins

Arriba.1590.bEdit

This variant activates on May 19th, it would also display a marquee but failed:

Tres Anillos para los Reyes Elfos bajo el cielo.
Siete para los Señores Enanos en palacios de piedra.
Nueve para los Hombres Mortales condenados a morir.
Uno para el Señor Oscuro sobre el trono oscuro en la Tierra de Mordor donde se extienden las Sombras.
Un Anillo para gobernarlos a todos.
Un Anillo para encontrarlos, un Anillo para atraerlos a todos y atarlos en las tinieblas en la Tierra de Mordor donde se extienden las Sombras.
Extracto de "El Señor de los Anillos" de J.R.R. TOLKIEN. 1955
Virus Tolkien vK&S. (c) IMV, STi, K&S 1995.
Created in Chiba City. The Spock's Mutation Factory are the fast in the world. We are professionals. Thanks to Central Point for their PC Tools Deluxe R4.20. Use your Debugger.

Translation (from Spanish):

Three Rings for the Elven Kings under the sky.
Seven for the Dwarf Lords in stone palaces.
Nine for the mortal men doomed to die.
One for the Dark Lord on the dark throne in the Land of Mordor where the Shadows extend.
One Ring to rule them all.
A Ring to find them, a Ring to lure them all and tie them in the darkness in the Land of Mordor where the Shadows extend.
Extract from "The Lord of the Rings" by J.R.R. TOLKIEN. 1955
(The rest are in English)

Other detailsEdit

According to the text strings in Arriba.1590.b, debugging is required in order to activate the payload.

VideosEdit

Arriba02:01

Arriba.Arriba -Arriba DOS Virus-

Arriba virus review by Alles Sandro

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.