Poweliks: The file-less little malware that could

[Nikos751]

Content source

http://blog.emsisoft.com/2014/08/06/poweliks-the-file-less-little-malware-that-could/

When you think about malware, you probably imagine a nasty little file that’s been installed on your computer. When you think about anti-malware, you probably imagine some sort of program that can remove that nasty file, and help you go about your day, malware-free. Malware doesn’t always need files though. And anti-malware can’t always do its job through file detection alone.

New research has uncovered a malware called Poweliks that can infect your computer without creating any files on your hard drive.

Instead, Poweliks creates a blank registry entry that automatically runs when you boot up your computer. This registry entry will check if your computer has Windows PowerShell installed, and initiate a download of the scripting program if it doesn’t. Once the presence of PowerShell is confirmed, Poweliks will then run a script that injects a malicious DLL into system memory. This DLL then connects your computer to a command and control server, which can be used to collect personal information or to load more malware onto an infected PC.

Poweliks is particularly evasive for two reasons: it does not create files on the hard drive and, according to reports, it creates a blank registry entry using a non-ASCII character. Both of these measures ensure that manual detection by user or even malware researcher are difficult. Poweliks’ file-less nature also means that antivirus products that rely on file-based detection alone will not find it.

For the full story on Poweliks, see PC Magazine. For technical analysis, see Malware Don’t Need Coffee.

Have a great (malware-free) day!

- See more at: http://blog.emsisoft.com/2014/08/06...ttle-malware-that-could/#sthash.IvKCJajx.dpuf

 

[Cowpipe]

When will this be patched Unicode registry entries don't show up in regedit, or standard scanning tools and can cause problems for anti-virus programs when scanning, because APIs will return that the registry key doesn't exist (despite it physically existing).

Many years ago I released one of the first malware to exploit this bug and expected it to be patched pretty soon after. Sadly it hasn't, and malware authors are still using it Makes me very sad.

Back on topic, I think that fileless malware is going to be the way to go. DOS malware was memory resident and could run even if the original file was deleted. I think we're going to be seeing more of that kind of thinking in the future. Another example of a very old idea getting a new lease of life in the virus writing scene.

 

[WinXPert]

More than a year ago, I found a strain of malware that saves a copy of it's binaries in the registry (If you copy/paste that value and save it as an executable you get the exact copy of the malware file). Now malware writers moves this thing up a notch.

Yup remember the DOS days, virus stays resident even if you remove the diskette where the file originally came from.