Registry-Residing Malware Creates No File for Antivirus to Scan

A new form of persistent malware has been discovered, one which does not create any file on the disk and stores all activities in the registry.

In a blog posted at the end of July, security researcher Paul Rascagneres of GData details the particularities of the new type of malware, dubbed Poweliks, whose methods he labels as “rather rare and new,” since everything is performed in the memory of the computer system and there are several layers of code to get through in order to avoid analysis.

The attack vector is an email with a malcrafted Microsoft Word document attached. The vulnerability leveraged by the attackers is CVE-2012-0158, which affects Office and several other Microsoft products. It is not new, but many users are still using old versions of the software that could be compromised.

Once the file is launched, the cybercriminals turn on the persistency feature of the malware by creating an encoded autostart key in the registry. It seems that the encoding technique used by the malware was originally created by Microsoft to safeguard their source code from being altered.

More details & screenshot -
http://news.softpedia.com/news/Regi...es-No-File-for-Antivirus-To-Scan-453374.shtml