Spyware
Ntospy
Ntospy is a credential stealer leveraging a well-established technique of abusing the Windows Network Provider interface, a method documented as early as 2004 and exemplified by tools like NPPSpy.
Ntospy is a Windows spyware.
Background
Ntospy is a credential stealer that abuses the Windows Network Provider interface, a long-standing technique documented as far back as 2004 and seen in tools such as NPPSpy. Masquerading as a legitimate Network Provider DLL, it inserts itself into the Windows authentication flow and hijacks logon attempts to capture user credentials. It does so by registering a rogue Network Provider, generally called "credman," which intercepts authentication requests and routes them to its malicious DLL.
Rather than exfiltrating right away, Ntospy stores what it captures locally, writing the credentials in cleartext to files disguised as benign Microsoft Update packages bearing the .msu extension. Such files are frequently dropped into system folders under plausible names like "c:/programdata/package cache/windows10.0-kb5009543-x64.msu" to further hide their intent.
For added stealth, Ntospy applies obfuscation to dodge detection, including innocuous-looking DLL filenames that often imitate core system files such as "ntoskrnl.dll." Certain variants go further still, encrypting the path to the credential store inside the DLL so that uncovering the full behavior requires analysis and decryption.
Source: Malpedia (Fraunhofer FKIE).