Hoping that someone may provide the missing info of Barrotes variants that still have not been triggered yet...
I did not have so much study on DOS opcodes so I do not know the meaning of most of the opcodes, but at least I learned something useful from the Barrotes.1463 virus, which is failed to activate due to a programming error, by comparing the current day in month with a value of 22h (34d), it is impossible to trigger, right?
This value follows a pair of codes "80 FA", I checked the meaning of "80", it refers to a comparasion statement, meanwhile the "FA" is referring to date or something similar else.
While inspecting a sample of Barrotes.840, instead of "80 FA", "81 FA" is found, with data "05 01". This pair of codes refers to check d…Read more >