Description
Win32/Tesllar.P is a trojan that uses a malicious kernel-mode device driver to stealth its presence on a compromised machine. This malware cannot install itself on a machine, but rather depends on another executable for installation and instruction.
Tesllar.P implements a rootkit technique by modifying the System Service Descriptor Table (SSDT) and hooking the following kernel functions:
NTClose/ZwClose
NTCreateKey/ZwCreateKey
NTDeleteKey/ZwDeleteKey
NTDeleteValueKey/ZwDeleteValueKey
NTLoadKey/ZwLoadKey
NTOpenKey/ZwOpenKey
NTQueryValueKey/ZwQueryValueKey
NTReplaceKey/ZwReplaceKey
NTRestoreKey/ZwRestoreKey
NTSetValueKey/ZwSetValueKey
This allows the trojan to restore itself and related registry modifications if a user attempts to remove or delete it.
Analysis by Methusela Ferrer