This cheeky new malware strain hides in the Windows Registry

(Image credit: Shutterstock)

Cybersecurity researchers from Pavilion have recently uncovered a new malware entrada in which Russian malicious actors allegedly target other Russians.

As reported by researchers Matt Stafford and Sherman Smith, in early on November, the company spotted a lightweight, but highly potent JavaScript Remote Access Trojan (RAT), that was being deployed together with a C# keylogger which it has called "DarkWatchman".

It is being distributed in a similar fashion to well-nigh malware today - through phishing emails. An email with a Null attachment would be sent out, containing what seems to be a text certificate. In reality, yet, the file is a self-installing WinRAR archive that deploys both the RAT and the keylogger.

DarkWatchman is quite cheeky, the researchers further explained, as it does not store logged keys on the disk, simply rather uses the Windows Registry fileless storage. The Trojan sets up a scheduled task, to run itself every time the victim logs into Windows.

Enabling ransomware attacks

Later logging, it will execute a PowerShell script to compile the keylogger and launch information technology into memory.

"The keylogger is distributed as obfuscated C# source code that is processed and stored in the registry as a Base64-encoded PowerShell control. When the RAT is launched, information technology executes this PowerShell script which, in turn, compiles the keylogger (using CSC) and executes it," the ii researchers explained.

"The keylogger itself does not communicate with the C2 or write to disk. Instead, information technology writes its keylog to a registry key that information technology uses as a buffer. During its operation, the RAT scrapes and clears this buffer before transmitting the logged keystrokes to the C2 server."

Speaking of the C2 server, DarkWatchman uses domain generation algorithms (DGA), generating up to 500 domains every twenty-four hours. That, the researchers explained, makes them highly resilient to domain seizure, and resistant to communication monitoring.

DarkWatchman has a very specific apply example, Prevailion researchers believe. According to them, the RAT was designed by ransomware operators and distributed to third parties, who are then tasked with compromising target networks. Once the RAT is deployed, installing the actual malware becomes a lot easier.