{"id":588,"date":"2016-10-21T14:48:57","date_gmt":"2016-10-21T14:48:57","guid":{"rendered":"http:\/\/www.adlice.com\/?p=588"},"modified":"2022-12-21T10:36:05","modified_gmt":"2022-12-21T10:36:05","slug":"fileless-malware-using-powershell","status":"publish","type":"post","link":"https:\/\/www.adlice.com\/es\/fileless-malware-using-powershell\/","title":{"rendered":"Fileless Malware using Powershell: Analysis & Removal"},"content":{"rendered":"\n

Fileless malware has always been popular<\/strong> and widely covered (Example: Poweliks<\/a>), because it really changes the classic Antimalware concept of scanning disks for malware<\/strong>. Fileless malware used to hide in the registry in the past<\/strong>, but today we will study a new (at least for us) technique to do so, by using a scheduled task<\/strong>.<\/p>\n\n\n\n


Potentially<\/del> Unwanted<\/h2>\n\n\n\n

The malware using that task is called “System Healer”<\/strong>, and is classified as PUP (Potentially Unwanted Program) by many antiviruses. We classify as Adware, and totally unwanted, since it’s clearly trying to avoid detection from antiviruses<\/strong>.<\/p>\n\n\n\n

That malware opens advertising and hijacks the web browsers<\/strong> startup page and search page. Unfortunately we don’t have any hash to share since the task file was sent to us without any other attachment.<\/p>\n\n\n\n


Scheduled Task<\/h2>\n\n\n\n

The task used to store the malware is looking like the following picture. It’s using Powershell to start a VB script encoded in base64<\/strong> with help of the -EncodedCommand switch<\/a>.<\/p>\n\n\n\n

\"task\"<\/a><\/figure>\n\n\n\n


Payload<\/h2>\n\n\n\n

After having decoded the base64 payload<\/strong> (with any online service) we found it was a Visual Basic script with very poor obfuscation<\/strong> intended to download the actual malware (another Powershell script) from a link and execute it with the Invoke-Expression command<\/strong>.<\/p>\n\n\n\n

That way, the malware is executed in memory<\/strong> without the need of having a file, just a scheduled task. We haven’t been beyond this point because the URL hardcoded in the payload was already shutdown<\/strong> by the provider.<\/p>\n\n\n\n

\"decoded\"<\/a><\/figure>\n\n\n\n


Detection and Removal<\/h2>\n\n\n\n

RogueKiller (as of version 12.7.4)<\/a> is able to parse<\/strong> the task parameters, extract and decode the payload, as well as classify the task as malicious and remove it<\/strong>.<\/p>\n\n\n\n

\"system_healer\"<\/a><\/figure>\n\n\n\n

Links<\/h2>\n\n\n\n