{"id":3767,"date":"2014-08-04T23:41:28","date_gmt":"2014-08-04T15:41:28","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=3767"},"modified":"2015-09-09T19:36:47","modified_gmt":"2015-09-09T11:36:47","slug":"windows-registry-infecting-malware-files","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2014\/08\/windows-registry-infecting-malware-files\/","title":{"rendered":"Windows Registry Infecting Malware Has NO Files"},"content":{"rendered":"

This is a pretty interesting use of the Windows Registry and reminds me a little of the transient drive-by malware used last year against Internet Explorer that left no files either – Another IE 0-Day Hole Found & Used By In-Memory Drive By Attacks<\/a>.<\/p>\n

The main difference being, that wasn’t persistent and as it lived in RAM, it wouldn’t survive a reboot. This time, it’s based in the Registry (which technically is stored on the file system) – so it does survive a reboot and is pretty well hidden.<\/p>\n

\"Registry<\/p>\n

The malware itself is stored in the registry in a non-ASCII key (to hide it from autostart) and an encoded entry that can’t be properly read by Regedit.<\/p>\n

Researchers have detailed a rare form of malware that maintains infection on machines and steals data without installing files.<\/p>\n

The malware resides in the computer registry only and is therefore not easy to detect.<\/p>\n

It code reaches machines through a malicious Microsoft Word document before creating a hidden encoded autostart registry key, malware researcher and black hat exterminator Paul Rascagneres (@r00tbsd) says. It then creates and executes shellcode and a payload Windows binary.<\/p>\n

“All activities are stored in the registry. No file is ever created,” Rascagneres said in a post. “So, attackers are able to circumvent classic anti-malware file scan techniques with such an approach and are able to carry out any desired action when they reach the innermost layer of [a machine] even after a system re-boot.<\/p>\n

“To prevent attacks like this, anti-virus solutions have to either catch the initial Word document before it is executed (if there is one), preferably before it reached the customer’s email inbox.”<\/p>\n

Windows Regedit cannot read or open the non-ASCII key entry. Rascagneres said the feature set was akin to a Matryoshka Doll due to its subsequent and continual ‘stacked’ execution of code.<\/p><\/blockquote>\n