POWELIKS: Malware Hides In Windows Registry

Minimalist · Aug 2, 2014

hrough a NULL registry value, users cannot see the content of the registry key with null value. Although there is an option to delete the registry key, deleting it will just result to an error due to the null value. However, the specific data will still execute during the system’s restart without any problem. To put simply, users cannot see and therefore, delete the entry thus when they reboot the system, the malware will still run.
It also creates another registry entry that contains the malware code.
Click to expand...

http://blog.trendmicro.com/trendlab...e/poweliks-malware-hides-in-windows-registry/

MrBrian · Aug 2, 2014

Thanks for posting .

RegDelNull

Minimalist · Aug 2, 2014

Thanks for link MrBrian.

siljaline · Aug 4, 2014

Windows Registry-infecting malware has no files, survives reboots

Minimalist · Aug 5, 2014

This is a pretty interesting use of the Windows Registry and reminds me a little of the transient drive-by malware used last year against Internet Explorer that left no files either. The main difference being, that wasn’t persistent and as it lived in RAM, it wouldn’t survive a reboot. This time, it’s based in the Registry (which technically is stored on the file system) – so it does survive a reboot and is pretty well hidden.
Click to expand...

http://www.darknet.org.uk/2014/08/windows-registry-infecting-malware-files/

Minimalist · Nov 20, 2014

Poweliks levels up with new autostart mechanism

Last August, we wrote about POWELIKS’s malware routines that are known for hiding its malicious codes in the registry entry as part of its evasion tactics.

In the newer samples we spotted, malware detected as TROJ_POWELIKS.B employed a new autostart mechanism and removes users’ privileges in viewing the registry’s content. As a result, users won’t be able to suspect that their systems are already infected by the POWELIKS malware. This new autostart technique is fairly new to the threat landscape, a technique that is not currently covered by Autoruns for Windows. This Windows utility shows all files and registries that will execute upon Windows startup.
Click to expand...

http://blog.trendmicro.com/trendlab...eliks-levels-up-with-new-autostart-mechanism/

Log in or Sign up

POWELIKS: Malware Hides In Windows Registry

Minimalist Registered Member

MrBrian Registered Member

Minimalist Registered Member

siljaline Registered Member

Minimalist Registered Member

Minimalist Registered Member

Log in or Sign up

POWELIKS: Malware Hides In Windows Registry

Minimalist Registered Member

MrBrian Registered Member

Minimalist Registered Member

siljaline Registered Member

Minimalist Registered Member

Minimalist Registered Member

Useful Searches