Technical Information
Malicious functions:
Hooks the following functions in System Service Descriptor Table (SSDT):
- NtSetSystemInformation, handler: <Auxiliary name>.sys
- NtSuspendThread, handler: <Auxiliary name>.sys
- NtQueueApcThread, handler: <Auxiliary name>.sys
- NtSetContextThread, handler: <Auxiliary name>.sys
- NtSystemDebugControl, handler: <Auxiliary name>.sys
- NtUnmapViewOfSection, handler: <Auxiliary name>.sys
- NtWriteVirtualMemory, handler: <Auxiliary name>.sys
- NtTerminateProcess, handler: <Auxiliary name>.sys
- NtTerminateThread, handler: <Auxiliary name>.sys
- NtProtectVirtualMemory, handler: <Auxiliary name>.sys
- NtCreateProcessEx, handler: <Auxiliary name>.sys
- NtCreateSymbolicLinkObject, handler: <Auxiliary name>.sys
- NtAllocateVirtualMemory, handler: <Auxiliary name>.sys
- NtCreateProcess, handler: <Auxiliary name>.sys
- NtCreateThread, handler: <Auxiliary name>.sys
- NtMakeTemporaryObject, handler: <Auxiliary name>.sys
- NtMapViewOfSection, handler: <Auxiliary name>.sys
- NtFreeVirtualMemory, handler: <Auxiliary name>.sys
- NtLoadDriver, handler: <Auxiliary name>.sys
