There the Kaspersky team found that the attackers were using a shell script to install a malicious service in the computer’s registry.īaumgartner said that while AV programs that look for signatures on a computer’s hard disk won’t find this malware, it can still be found. The team was able to get to the server, in this case a domain controller, before the computer was rebooted, which allowed them to find the malware. Kaspersky Lab principal security researcher Kurt Baumgartner said that its research teams first found the malware in a bank in Russia. Rebooting the computer will erase the malware, which in turn means that forensic analysis has nothing to look for. The malware is hard to find because it exists only in a computer’s memory, which means that the victim’s anti-malware software needs to scan memory while the computer is still running with the infection still resident. That tunnel is the route for exfiltration. Once the malware starts collecting the targeted data, it uses the unusual :4444 port address to access the tunnel. The actual malware stays in memory where it uses Windows PowerShell scripts to gain administrator passwords set up tunnels and then start gathering information. Furthermore the malware hides inside of other applications making it practically invisible to antivirus packages and whitelisting services used by many firewalls.Īccording to an entry by Kaspersky on the Securelist blog, the process works by temporarily placing an installation utility on the computer’s hard drive, which installs the malware directly into memory using a standard Windows MSI file before erasing the utility.
Once the malware is running inside of Windows it erases all traces of its existence, and resides in the memory of the server it’s infected only long enough to exfiltrate the information it’s been sent to steal and then it erases itself.īecause the new malware examples, which Kaspersky has named MEM: and MEM:, reside in memory, they can’t be found by standard antivirus packages that scan a computer’s hard disk. This is malware that uses legitimate-frequently open-source-software to infect a system, then uses commonly used Windows services for implementation and operation. A new breed of malware found by Kaspersky Lab may seem like a nightmare for system administrators and IT managers.
0 kommentar(er)
