“Fileless Malware” with a New Form of Cover-Up

Researchers have discovered a new malicious campaign using a never-before-seen technique for injecting Fileless malware on target systems.

Fileless malware are far from traditional malware that exploits executive files to infect systems, while the Fileless malware infiltrates servers’ Random Access Memory (RAM) of the targeted systems.

Flow of Fileless malware

The initial step was to lure the target to download the zipped archive of the purported security testing tools – Cobalt Strike and Silent Break.

The threat actors then use these security tools to inject more modules into windows trusted software to run malicious codes in the system.

“What piqued our attention was the very targeted nature of the campaign and the vast set of tools in use, including commercial ones.” Said Researcher, Denis Legezo

There were several anti-detection techniques involved but the most innovative technique is to hide the next stage malware as “8KB blocks of divided parts” in the binary part of Windows Event logs.

Next, a launcher is dropped into the Windows Tasks directory. “At the entry point, a separate thread combines all the aforementioned 8KB pieces into a complete shellcode and runs it,” the researcher wrote.

The other anti-detection decryptors were different compilers, Digital certificates-without legitimate software signature.

The final step is a Trojan with two communication mechanism,

• HTTP-based
• Named pipes-based 

The attacks made by fileless malware leave no trace on the systems they infect, as all malicious activity is performed directly in RAM and no files are written to the hard drive.

With no trace left behind, the threat actor is able to evade the detection of signature-based antivirus software and many other security solutions.

“Along with the aforementioned custom modules and techniques, several commercial pentesting tools like Cobalt Strike and SilentBreak’s toolset are used.” Said Researcher Legezo.

Mitigations

• Use a reliable endpoint security solution.
• Install anti-APT and EDR solutions.
• Provide your security team with the latest threat intelligence and training.
• Integrate endpoint protection and employ dedicated services that can help protect against high-profile attacks.

Indicators Of Compromise

Dropper

Logs code launcher

HTTP Trojan

Named pipes trojan and similar

Anti-detection Wrappers / Decryptors / Launchers, not malicious by themselves

Conclusion

For the reason aforementioned, the researchers have yet to determine the identity of the attackers. Also the researcher assured to update a name for this Fileless malware, if any new modules appeared.

The researcher concluded “the actor behind this campaign is quite capable.” “the code is quite unique, with no similarities to known malware.”