[fatdcuk]

Not had chance to to run deeper analysis so unknown vintage/family.

Attached is recovered driver + file i believe downloaded it :)

Downloader>>>
http://www.virustotal.com/file-scan/rep ... 1283061408
.sys file>>>
http://www.virustotal.com/file-scan/rep ... 1281542208

[xqrzd]

I was unable to get it to load a driver. All it did was drop 1.tmp into C:\Windows\System32\Spool\prtprocs\w32x86, and then load it into spoolsv.exe, then it had spoolsv.exe add the original dropper to the registry startup list. Maybe it detected my VM?
Here is 1.tmp. It is almost exactly the same as the dropper.

[vaber]

Probably this is a new Pundex/Cutwail rootkit.

[Alex]

Thanks for this sample fatdcuk.

There are few screens from some tools (driver loaded under VmWare 6.5):

Hidden driver with replaced ObjectType:


Attached device:


Hooked object types procedures:


System threads:


Hooked IRP's handlers of Beep driver:


I'm not sure that all modification have been done by this driver because I tested other malware using this snapshot...

Alex

[NOP]

Maybe it detected my VM?

It can detect VM's.

Code: Select all

VIRTUALBOX..VideoBiosVersion....HARDWARE\DESCRIPTION\System.\\.\PhysicalDrive%d.VIRTUAL.VBOX....VMWARE..QEMU

It also tries to detect Sandboxie, CWSandbox(which always loads pstorec.dll) and Wireshark.

Code: Select all

SbieDll.dll.pstorec.dll.wireshark.exe