Blackbat
Blackbat
Type File virus
Creator Rohitab
Date Discovered 1999
Place of Origin Kurukshetra, India
Source Language Assembly
Platform MS Windows
File Type(s) .exe
Infection Length ~2,800 bytes

Blackbat is a virus by Rohitab. It appeared in issue 6 of the 29A magazine. Blackbat is a Windows 9x file infector, whose siginture is Rohitab's birth date.

Table of Contents

Behavior

The virus checks if it is already memory, searching for the value 0AD75h. If WIN.SYS is found in the root of drive C:, it will not become memory resident or infect files. If neither of these conditions exists, the virus becomes memory resident. It infects any Windows Portable Executable. Blackbat avoids infecting files with "AV", "AN", and "F-" in their names, effectively preventing it from attacking antivirus products. It appends its code to the end of the file.

On December 8, the virus delivers a payload, displaying the message box "Happy BirthDay :-)".

Origin

Blackbat was written by Rohitab, who published it in issue 6 of 29A magazine. Its copyright date is 1999, but no more specific date was given. In addition, Issue 6 of 29A was released in 2004. Its location of origin is in all likelihood India, as during 1999, Rohitab was in his last semester at Kurukshetra University and later working at DCM Technologies, according to his resume.

Sources

Rohitab. Rohitab.com, BlackBat Virus – Non Destructive.

-. -, Blackbat Virus Source Code

Unless otherwise stated, the content of this page is licensed under Creative Commons Attribution-NonCommercial-ShareAlike 3.0 License