Empire A/B Virus (15-July-1991)
Entry...............: Empire-A Virus
Alias(es)...........: ---
Virus Strain........: Major variant of: Stoned = Marijuana Virus
Known Variant.......: Empire-B Virus 
Virus detected when.: April 1991
              where.: Alberta Canada (?)
Classification......: Memory resident Boot + Partition table infector,
                         Stealth virus,undergoing detection mechanisms
Length of Virus.....: Empire-A: 2,048 Bytes in Memory, 2 sector(floppy)
                      Empire-B: 1,024 Bytes in Memory, 1 sector(floppy)
--------------------- Preconditions -----------------------------------
Operating System(s).: MSDOS
Version/Release.....: 2.xx upward (not tested)
Computer model(s)...: IBM-PC, XT, AT and compatibles
--------------------- Attributes -------------------------------------
Easy Identification.: Memory size reduced: CHKDSK will return 653,312
                         "total bytes memory" on a 640k machine.
                      Check first four bytes of MBR or Boot sector 
                      for "EA 9F 01 C0",common to Empire-A/B variants.
Scan signature......: When booted from a clean floppy disk, virus can
                      be detected using the string 
                         "A3 08 7C A1 13 04 48" (Empire-A)
Type of infection...: Boot sector virus, related to Stoned; virus
                         consists of 2 sectors, the first of which
                         contains its executable code and replaces 
                         MBR on a harddisk or BR on floppy. 
                      On floppy, the original boot record is stored 
                         on track 0 head 1 sector 2, and the message 
                         is stored on the next sector, in simply
                         encrypted form. 
                      On harddisk, the original MBR is stored on 
                         cyl 0 head 0 sector 6, with the message on 
                         the next sector.
                      Stealth mechanism: when virus is active in
                         memory,  any request for the MBR will be 
                         intercepted by the virus and the real MBR 
                         will be returned. Similarly, any attempt 
                         to write to the MBR will be changed 
                         to a reset by the virus.
Infection Trigger...: ---
Interrupts hooked...: --- 
Damage..............: Permanent Damage: Problems on Harddisk/Floppy:
                         High density floppies may experience failures
                           resulting from storage of two original 
                           sectors on track 0 head 1 sectors 2-3. 
                         Low density floppies with over 80 directory
                           entries may also have problems; these can 
                           occur even long after the floppy is dis-
                           infected if the directory is not restored.
                         Harddisk: a disk without "hidden sectors" 
                           will probably experience FAT failures, as
                           the sectors to which the original boot
                           sectors have been stored are assumed to
                           be in the "hidden sector" area. 
                      Transient Damage = Memory reduction, Message:
                         1)Active Empire-A virus reduces total memory
                           by 2,048 bytes (CHKDSK will return 653,312 
                           "total bytes memory" on a 640k machine)
                         2)The following message ( where each sentence 
                           is a single line and relies on text-
                           wrapping by terminal for legibility) is
                           displayed:
                            "I'm becoming a little confused as 
                             to where the "evil empire" is these days.
                             If we paid attention, if we cared, 
                             we would realize just how unethical 
                             this impending war with Iraq is, 
                             and how impure the American motives are 
                             for wanting to force it.
                             It is ironic that when Iran held 
                             American hostages, for a few lives 
                             the Americans were willing to drag 
                             negotiation on for months; yet when oil 
                             is held hostage, they are willing 
                             to sacrifice hundreds of thousands of 
                             lives, and refuse to negotiate ......."
Damage Trigger......: Message display is triggered by function of
                         realtime clock (details to be analysed)
Particularities.....: Virus tries to avoid reverse analysis: a "cute"
                         at the start will throw a researcher off if
                         a standard STONED opening is expected. 
Similarities........: Basically Stoned (I), with major deviations
Known Variant.......: Empire-B, with following major differences:
                         1) Virus occupies 1,024 Bytes in Memory
                         2) Text sector is not used, no message 
                         3) Virus uses encryption with different 
                            algorithm on each infection, based 
                            on time hack
                         4) When resident on fixed disk, the original
                            partition table is stored at sector 3 
                            head 0 cyl 0. On floppy, sector 3, head 1, 
                            track 0 is used.    
                      EMPIRE and EMPIRE-B avoid cross infection by 
                         signature checking the first four bytes of 
                         MBR or Boot sector for "EA 9F 01 C0".
Remark..............: Other common characteristics indicate that both
                         Empire-A and -B were written by the same 
                         person or by two people sharing notes. 
--------------------- Agents -----------------------------------------
Countermeasures.....: Detection: CHKDSK, F-DISKINF, DISKSECURE 
                                 (SCAN v76C does not pick this up)
Countermeasures successful: Detection: CHKDSK, F-DISKINF, DISKSECURE
Standard means......: 
--------------------- Acknowledgement --------------------------------
Location............: Virus Test Center, University Hamburg, Germany
Classification by...: Klaus Brunnstein
Documentation by....: A.Padgett Peterson, Computer Network Security,
                                          Orlando, Florida
Date................: April 18, 1991
Information source..: A.Padgett Peterson

.