{"id":6328,"date":"2017-01-23T15:50:23","date_gmt":"2017-01-23T23:50:23","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/01\/23\/news-166\/"},"modified":"2017-01-23T15:50:23","modified_gmt":"2017-01-23T23:50:23","slug":"news-166","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2017\/01\/23\/news-166\/","title":{"rendered":"Kovter becomes almost file-less, creates a new file type, and gets some new certificates"},"content":{"rendered":"

Trojan:Win32\/Kovter<\/a> is a well-known click-fraud malware which is challenging to detect and remove because of its file-less persistence on infected PCs. In this blog, we will share some technical details about the latest changes we have seen in Kovter\u2019s persistence method and some updates on their latest malvertising campaigns.<\/p>\n

New persistence method<\/h2>\n

Since June 2016, Kovter has changed their persistence method to make remediation harder for antivirus software.<\/p>\n

Upon installation, Kovter will generate and register a new random file extension (for example, .<\/em><\/strong>bbf5590fd) and define a new shell open<\/em> verb to handle this specific extension by setting the following registry keys:<\/p>\n

\"Registry<\/a><\/p>\n

Figure 1: Registry setup for Kovter <\/em><\/p>\n

With this setup, every time a file with the custom file extension (.<\/strong>bbf5590fb) is opened, the malicious Kovter command contained in the registry key is executed via the shell extension open<\/em> verb.<\/p>\n

Therefore, all Kovter needs to do to run on infected machines is open a file with their custom file extension .<\/em><\/strong>bbf5590fb \u2013 causing the malicious shell open<\/em> command to run. This in turn runs a command using mshta<\/em>.<\/p>\n

Mshta<\/em> is a clean tool that is used by Kovter to execute malicious JavaScript. This JavaScript then loads the main payload from another registry location, HKCUsoftware67f1a6b24cd0db239<\/em>. To trigger this shell open<\/em> command on a regular basis, Kovter drops several garbage files with its custom file extension in different locations, for example:<\/p>\n