Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\NtmsLibSvc] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\NtmsLib] 'Start' = '00000002'
Substitutes the following executable system files:
- <SYSTEM32>\dllcache\rdpwd.sys with <SYSTEM32>\dllcache\rdpwd.sys.new
- <DRIVERS>\rdpwd.sys with <DRIVERS>\rdpwd.sys.tmp
Malicious functions:
Creates and executes the following:
- '%TEMP%\~FB1.tmp' 60 <Full path to virus>
Executes the following:
- '<SYSTEM32>\svchost.exe' -k NtmsLib
Hooks the following functions in System Service Descriptor Table (SSDT):
- NtEnumerateValueKey, handler: NtmsLib.sys
- NtQueryDirectoryFile, handler: NtmsLib.sys
- NtDeviceIoControlFile, handler: NtmsLib.sys
- NtEnumerateKey, handler: NtmsLib.sys
Modifies file system :
Creates the following files:
- %TEMP%\~FB1.tmp
- <SYSTEM32>\NtmsLib\log.ini
- <DRIVERS>\NtmsLib.sys.tmp
- <SYSTEM32>\NtmsLib.dll
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\NtmsLib.dll
Deletes the following files:
- <DRIVERS>\rdpwd.sys
Moves the following files:
- from <DRIVERS>\rdpwd.sys.new to <DRIVERS>\rdpwd.sys
- from <DRIVERS>\NtmsLib.sys.tmp to <DRIVERS>\NtmsLib.sys
Deletes itself.
