Fandom

Malware Wiki

Ukraine

1,335pages on
this wiki
Add New Page
Comment1 Share

Virus.DOS.Ukraine is a dangerous memory resident parasitic encrypted virus on DOS.

There are 12 variants in 4 versions, represented by the following:

  • Virus.DOS.Ukraine.3201
  • Virus.DOS.Ukraine.3400
  • Virus.DOS.Ukraine.3426.b
  • Virus.DOS.Ukraine.3537

Behavior

When the virus is loaded into memory, it hooks INT 21h to infect any executable that is run. No file size change can be observed as long as the virus stays in memory.

The virus might corrupt files during infection that a system hang may cause when an infected program is run.

Ukraine.3400 does not infect EXE files.

Memory usage

The following table shows the memory usage of the variants.

Variant Memory usage in bytes
Ukraine.3201 (A and C) 3,664
Ukraine.3201.b ?
Ukraine.3206.a 3,680
Ukraine.3215 3,680
Ukraine.3300 3,904
Ukraine.3400 3,968
Ukraine.3404 3,968
Ukraine.3426.b 4,000
Ukraine.3537 4,112
Ukraine.3627 4,192
Ukraine.3633 4,192

Payload

The virus activates on 24th day in any month, except Ukraine.3426.b and 3537.

When any program is run when the virus is in memory, a full screen ASCII image of Ukrainian flag with the Tryzub (Ukrainian for "Trident", the symbol in the coat of arms of said nation) is displayed and the national anthem of Ukraine (Shche ne vmerla Ukraina) is played in the 8 bit style.

After a while, a text is displayed at the bottom of the screen:

24 СЕРПНЯ - ДЕНЬ НЕЗАЛЕЖНОСТІ УКРАІНИ !!!

Translation (from Ukrainian):

24 August - INDEPENDENCE DAY of UKRAINE!!!

And then it erases the disk sectors.

Ukraine.3400 display another text instead.

Ukraine.3426.b activates on 24th of September and December only. Ukraine.3537 activates on 24th in every month except February, June, August and October.

Variants

This family has 12 variants in total:

  • Virus.DOS.Ukraine.3201 (A, B and C)
  • Virus.DOS.Ukraine.3206.a
  • Virus.DOS.Ukraine.3215
  • Virus.DOS.Ukraine.3300
  • Virus.DOS.Ukraine.3400
  • Virus.DOS.Ukraine.3404
  • Virus.DOS.Ukraine.3426.b
  • Virus.DOS.Ukraine.3537
  • Virus.DOS.Ukraine.3627
  • Virus.DOS.Ukraine.3633

Other details

Ukraine.3400 is a cracked version of the virus.

The infection size of Ukraine.3633 is 3,624 bytes instead of 3,633 bytes.

Videos

Virus.DOS03:15

Virus.DOS.Ukraine

Ukraine virus review by danooct1

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.