Monday, May 27, 2024

Fileless malware that uses PowerShell scripts from Window’s registry leading to Click Fraud Malware Campaign

Nowadays Hackers Distributing Advanced Fileless Malware with Evasion capabilities which are very Difficult to Detect. These types of malware sit in the system registry and making hard for Antivirus hard to identify the infection.

The security researchers from Quick Heal Security Labs detected as Fileless malware which uses PowerShell scripts stored in the windows registry.

Also read A Complete Fileless Malware “JS_POWMET” with Highly Sophisticated Evasion Technique

This malware has been distributed through a Click Fraud Malware Campaign from malicious Russian website ‘”, in the further analysis they found it triggered in numerous computer at the same time and it resides on windows registry. They have published a detailed Technical analysis of malware in the runtime environment.

Malware found on the runtime entry HKCU\Software\Microsoft\Windows\CurrentVersion\Run\{CLSID} and then it contains following codes to execute malware.

C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle hidden -NoLogo -NonInteractive -ep bypass -nop iex ([Text.Encoding]::ASCII.GetString([Convert]::FromBase64String((gp ‘HKCU:\Software\Classes\HZMUQQOTHEK’).QJBBSZWJ)));

The malware uses ‘CreateRemoteThread’ and API such as, ‘VirtualAlloc’, ‘VirtualAllocEx’, ‘WriteProcessMemory’, and ‘ReadProcessMemory’ to do so.

To avoid interception script launched in non-interactive and bypass mode. Once executed malware maintains a continuous interaction with the domain and it leads to perform a Click Fraud Activity.

Malware injection Process

Recently we read Fileless ransomware SOREBRECT’s and code injection capabilities that encrypt the files on the local machine and network shares by inject the svhost.exe process and execute the payload.

Security researchers from quick heal say it likely an outcome of malicious spam emails and exploit kits as like the couple of Fileless malware that appeared before.

Common Defence’s to stay safe

  • Don’t open the attachments that you are not expecting.
  • Patch or Update your software.
  • Use a reputable security suite.
  • Download applications from Reputed sites.
  • Stay strict with CIA Cycle.

Latest articles

Kesakode: A Remote Hash Lookup Service To Identify Malware Samples

Today marks a significant milestone for Malcat users with the release of version 0.9.6,...

Cisco Firepower Vulnerability Let Attackers Launch SQL Injection Attacks

 A critical vulnerability has been identified in Cisco Firepower Management Center (FMC) Software's web-based...

Hackers Exploit WordPress Plugin to Steal Credit Card Data

Hackers have exploited an obscure WordPress plugin to inject malware into websites, specifically targeting...

Google Patches Chrome Zero-Day: Type Confusion in V8 JavaScript

Google has released a patch for a zero-day exploit in its Chrome browser.The...

Hackers Created Rogue VMs in Recent MITRE’s Cyber Attack

State-sponsored hackers recently exploited vulnerabilities in MITRE's Networked Experimentation, Research, and Virtualization Environment (NERVE).They...

Hackers Weaponizing Microsoft Access Documents To Execute Malicious Program

In multiple aggressive phishing attempts, the financially motivated organization UAC-0006 heavily targeted Ukraine, utilizing...

Microsoft Warns Of Storm-0539’s Aggressive Gift Card Theft

Gift cards are attractive to hackers since they provide quick monetization for stolen data...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles