FANDOM


Virus.DOS.Ukraine is a dangerous memory resident parasitic encrypted virus on DOS.

There are 12 variants in 4 versions, represented by the following:

  • Virus.DOS.Ukraine.3201
  • Virus.DOS.Ukraine.3400
  • Virus.DOS.Ukraine.3426.b
  • Virus.DOS.Ukraine.3537

Behavior

When the virus is loaded into memory, it hooks INT 21h to infect any executable file that is run. No file size change can be observed as long as the virus stays in memory.

The virus might corrupt files during infection that may hang the system when an infected program is run.

Ukraine.3400 does not infect EXE files.

Advanced details

The following table shows the memory usage of the variants.

Variant Memory usage in bytes
Ukraine.3201 (A and C) 3,664
Ukraine.3201.b ?
Ukraine.3206.a 3,680
Ukraine.3215 3,680
Ukraine.3300 3,904
Ukraine.3400 3,968
Ukraine.3404 3,968
Ukraine.3426.b 4,000
Ukraine.3537 4,112
Ukraine.3627 4,192
Ukraine.3633 4,192

MD5 hashes:

Variant Hash
Ukraine.3201.a fb799389538cb1f5762549bbaf44e302
Ukraine.3201.b ed04bfb8c7179ed2874f061aa91a6008
Ukraine.3201.c db5193d58f9075299cae9b5222bc3882
Ukraine.3206.a faeea240e2e70e7e874ee7fbb0d54423
Ukraine.3215 01a65e3cc5c6eca6a783ae6e1e5edb48
Ukraine.3300 d960704e76e4a9ffbecdbd53de76a11a
Ukraine.3400 39e50656ab7f7fa59199a74fc3cac55f
Ukraine.3404 86942f3e16099d7784319b1b3a82ede0
Ukraine.3426.b 21d496ca09075c005eea0d3bf3a5d775
Ukraine.3537 426e685807061ecb4c210b0d21429ae0
Ukraine.3627 7aa3a217cc37d3a658a41eacb9c946d8
Ukraine.3633 b1746b8585efebc732e217e529284d09

Payload

The virus activates on 24th day in any month, except Ukraine.3426.b and 3537.

When any program is run when the virus is in memory, a full screen ASCII image of Ukrainian flag with the Tryzub (Ukrainian for "Trident", the symbol in the coat of arms of said nation) is displayed and the national anthem of Ukraine (Shche ne vmerla Ukraina) is played in the 8 bit style.

After a while, a text is displayed at the bottom of the screen:

24 СЕРПНЯ - ДЕНЬ НЕЗАЛЕЖНОСТІ УКРАІНИ !!!

Translation (from Ukrainian):

24 August - INDEPENDENCE DAY of UKRAINE!!!

And then it erases the disk sectors.

Ukraine.3400 display another text instead.

Ukraine.3426.b activates on 24th of September and December only. Ukraine.3537 activates on 24th in every month except February, June, August and October.

Variants

This family has 12 variants in total:

  • Virus.DOS.Ukraine.3201 (A, B and C)
  • Virus.DOS.Ukraine.3206.a
  • Virus.DOS.Ukraine.3215
  • Virus.DOS.Ukraine.3300
  • Virus.DOS.Ukraine.3400
  • Virus.DOS.Ukraine.3404
  • Virus.DOS.Ukraine.3426.b
  • Virus.DOS.Ukraine.3537
  • Virus.DOS.Ukraine.3627
  • Virus.DOS.Ukraine.3633

Other details

Ukraine.3400 is a cracked version of the virus.

The infection size of Ukraine.3633 is 3,624 bytes instead of 3,633 bytes.

References

  1. List of variants of the Ukraine virus on VX Heaven

Videos

Virus.DOS

Virus.DOS.Ukraine

Ukraine virus review by danooct1