Registry-infecting reboot-resisting malware has NO FILES

Good article, this appears to be a really nasty malware. No doubt we need a quick fix on this one.

Thank you Jasper,
 
If I understand correctly, the same code designed to prevent documents from being copied, a security measure, is used as an attacker. Never ending battle.
 
 
 
 
 
 

I've alerted our Threat team to this one, and they're looking into it.  They're confident we'll be able to block this once they can get a sample to investigate.

Thank you Nic, that is good to know.

@ wrote:
I've alerted our Threat team to this one, and they're looking into it.  They're confident we'll be able to block this once they can get a sample to investigate.

Thank you Nic!
 
I was waiting to hear from you on this, you are the best!

In the lead article this malware did not have a name.
 
By Lucian Constantin  Aug 4, 2014
 
A new malware program called Poweliks attempts to evade detection and analysis by running entirely from the system registry without creating files on disk, security researchers warn.
 
The concept of “fileless” malware that only exists in the system’s memory is not new, but such threats are rare because they typically don’t survive across system reboots, when the memory is cleared. That’s not the case for Poweliks, which takes a rather new approach to achieve persistence while remaining fileless, according to malware researchers from G Data Software.
When it infects a system, Poweliks creates a startup registry entry that executes the legitimate rundll32.exe Windows file followed by some encoded JavaScript code. This triggers a process similar in concept to a Matryoshka Russian nesting doll, said Paul Rascagnères, senior threat researcher at G Data, in a blog post.
 
Full Article

Really an interesting kind of malware; I wonder why this kind of behaviour wasn't used earlier.

WSA would probably not prevent an infection through the DOC file (or similar) but I'm sure that later during the payload the heuristics will detect the suspicious behaviour.

Just got confirmation from Threat that we do catch this.  It does eventually try to run a payload dll, which we'll catch and stop.

Thank you for the update Nic, that is great news and just what I expected.

Very cool that WSA does the business...but a very interesting attack vector...whatever will they come up next. :@

@ wrote:
Very cool that WSA does the business...but a very interesting attack vector...whatever will they come up next. :@

Your guess is as good as anyones, but they are bound to come up with something!

@ wrote:
Just got confirmation from Threat that we do catch this.  It does eventually try to run a payload dll, which we'll catch and stop.

Thats a relif! Thank you NIc!