Registry-infecting reboot-resisting malware has NO FILES


Userlevel 7
Badge +54
This one could prove to be awkward and hopefull not  sign of things to come.
 

Anti-virus doesn't stand a chance becuase there's nothing for it to scan

By Darren Pauli, 4 Aug 2014
 
Researchers have detailed a rare form of malware that maintains infection on machines and steals data without installing files.
The malware resides in the computer registry only and is therefore not easy to detect.
 It code reaches machines through a malicious Microsoft Word document before creating a hidden encoded autostart registry key, malware researcher and black hat exterminator Paul Rascagneres (@r00tbsd) says. It then creates and executes shellcode and a payload Windows binary.
 


 
Full Article

12 replies

Userlevel 7
Good article, this appears to be a really nasty malware. No doubt we need a quick fix on this one.
Userlevel 6
Thank you Jasper,
 
If I understand correctly, the same code designed to prevent documents from being copied, a security measure, is used as an attacker. Never ending battle.
 
 
 
 
 
 
Userlevel 7
Badge +56
I've alerted our Threat team to this one, and they're looking into it.  They're confident we'll be able to block this once they can get a sample to investigate.
Userlevel 7
Badge +54
Thank you Nic, that is good to know.
Userlevel 6
@ wrote:
I've alerted our Threat team to this one, and they're looking into it.  They're confident we'll be able to block this once they can get a sample to investigate.
Thank you Nic!
 
I was waiting to hear from you on this, you are the best!
Userlevel 7
Badge +54
In the lead article this malware did not have a name.
 
By Lucian Constantin  Aug 4, 2014
 
A new malware program called Poweliks attempts to evade detection and analysis by running entirely from the system registry without creating files on disk, security researchers warn.
 
The concept of “fileless” malware that only exists in the system’s memory is not new, but such threats are rare because they typically don’t survive across system reboots, when the memory is cleared. That’s not the case for Poweliks, which takes a rather new approach to achieve persistence while remaining fileless, according to malware researchers from G Data Software.
When it infects a system, Poweliks creates a startup registry entry that executes the legitimate rundll32.exe Windows file followed by some encoded JavaScript code. This triggers a process similar in concept to a Matryoshka Russian nesting doll, said Paul Rascagnères, senior threat researcher at G Data, in a blog post.
 
Full Article
Userlevel 6
Really an interesting kind of malware; I wonder why this kind of behaviour wasn't used earlier.

WSA would probably not prevent an infection through the DOC file (or similar) but I'm sure that later during the payload the heuristics will detect the suspicious behaviour.
Userlevel 7
Badge +56
Just got confirmation from Threat that we do catch this.  It does eventually try to run a payload dll, which we'll catch and stop.
Userlevel 7
Badge +54
Thank you for the update Nic, that is great news and just what I expected.
Userlevel 7
Very cool that WSA does the business...but a very interesting attack vector...whatever will they come up next. :@
Userlevel 6
@ wrote:
Very cool that WSA does the business...but a very interesting attack vector...whatever will they come up next. :@
Your guess is as good as anyones, but they are bound to come up with something!
Userlevel 6
@ wrote:
Just got confirmation from Threat that we do catch this.  It does eventually try to run a payload dll, which we'll catch and stop.
Thats a relif! Thank you NIc!

Reply