Fileless malware example

preview_player
Показать описание
Fileless malware is a variant of computer related malicious software that exists exclusively as a computer memory-based artefact for example in RAM.

Credit Robert P

Strings

ghidra

base64

Please subscribe, ring the bell and share this video.
(and comment)

This Video brought to you by the Virus Doctor. You will get a 15% discount on a course if you use coupon code Mickyj15.

Help give this channel a fighting chance !
Please share in your community, forums, user groups and blogs !

** To help fund this adventure, here are some of the products I recommend. **

Tools used
- virustotal
- Hybrid-analysis
- HexRays /IDA
- Process Hacker
- Process Monitor
- Wireshark
- many more specific to each video

..........: About the music :..........

Music Provided by the Following

  1. Michael Jenkin
  2. Malware
  3. virus
  4. virustotal
  5. analysis
  6. detect
Рекомендации по теме
Intellesec - Fileless 0:03:59

Intellesec - Fileless Malware Attack Demonstration

Fileless Ransomware: Powershell 0:07:22

Fileless Ransomware: Powershell Netwalker

Fileless malware example 0:25:33

Fileless malware example

Fileless Malware: How 0:20:42

Fileless Malware: How It Works

What is Fileless 0:05:04

What is Fileless Malware? : Simply Explained

Fileless PowerShell Attack 0:01:21

Fileless PowerShell Attack Demo

Quick Learn Fileless 0:00:53

Quick Learn Fileless Malware Attack by Nano Skillz

ESET cybersecurity tips 0:02:56

ESET cybersecurity tips & tricks: Fileless malware attacks

What is fileless 0:00:18

What is fileless malware

Demo 17 - 0:06:49

Demo 17 - Fileless Malware Attack Chain - VBA, WMI, and PowerShell

Fileless Malware Analysis 0:26:42

Fileless Malware Analysis & PowerShell Deobfuscation

Fileless Malware 0:01:09

Fileless Malware

Demo Fileless malware 0:01:08

Demo Fileless malware Detection (follina attack)

FileLess Malware Analysis 0:00:16

FileLess Malware Analysis Tutorial / Powershell

Tutorial: Fileless Malware 0:25:48

Tutorial: Fileless Malware Removal

Testing Fileless Malware 0:14:17

Testing Fileless Malware that works on Every Operating System

Ransomware Attack Simulation 0:09:39

Ransomware Attack Simulation

Introduction To Fileless 0:45:02

Introduction To Fileless Malware by Juan Araya

Fileless malwre Demo 0:03:15

Fileless malwre Demo

Fileless Malware 0:14:47

Fileless Malware

How to Analyze 0:11:15

How to Analyze a Malicious Powershell Script & Fileless Malware

FileLess Malware Infections 0:01:51

FileLess Malware Infections - Demo code hiding in directory names

Fileless Malware Infection 0:44:26

Fileless Malware Infection And Linux Process Injection In Linux OS - Hendrik Adrian

Malware Minute: Analyzing 0:01:19

Malware Minute: Analyzing a Powershell Attack

Комментарии
Автор

Personal Plea: As you can appreciate, it is very hard to get noticed on YouTube. I am doing my best to educate other IT people (MSP's, Technicians, engineers, resellers, VARs and hobbiests) so that we can know the tricks and fight back against malware.


The more education out there, the better our lives will be (and data safer).


I am an IT engineer. I am not a vlogger, a picture editor, a graphics artist or audio engineer. I make mistakes and am learning. Youtube is a tricky platform to navigate and to be heard.


I appreciate every subscriber I get but what I really need ... is your feedback, your comments, your suggestions, video ideas and if you like a video, link it on your Facebook, Twitter, Forums, Reddit or other social media. Spread the word. I can only make this channel effective if people know about it.


If you find this helpful, insightful or engaging, let others know. If you hate the format, let me know. every new video is made from advice from the last video.


Thanks everyone. You have all been great !

MichaelJenkin
Автор

Thank you for posting this. People like you are helping me learn more about these tactics. After I was hit with a nasty file less malware suite (the hacker surely bought this on the dark web and spent good money on it because it was insanely sophisticated) I had the worst few weeks of my life securing my network, rebuilding it, and then securing my online accounts. This software was robust and even had the ability to remain persistent after a reformat. Later I found out my TP-Link router's FW was hacked. The led lights on the front were set to shut off so I couldn't see that wi-fi was still enabled even if I hit the button to disable it. I'm sure it also hijacked my DNS requests as well.

Another thing it did after infecting my phone was create dummy wi-fi hotspots with the same exact names as the ones I used. I assume they did this to hack my WPA2 private key using some new warped man in the middle attack that works on anything but the latest routers.

I've been building and configuring computers for years. I'm a hardware guy but I'm decent with software. I am no programmer yet I've learned a little over the years and definitely use the command shell to automate a lot of tasks. But I've never known the damage powershell can cause, which is why I am doing everything I can to learn more about it. Powershell does need more security I believe, other than just app-guard and the ridiculous execution policy command that can be bypassed by anyone that can read and type.

slamscaper
Автор

Wow, that was intense and informative. Nice detective work Micky

TechDoctorTV
Автор

Has anyone else had fileless malware experiences ? This was my first

MichaelJenkin
Автор

Great video! I've analyzed a few poweliks/kovter variants. Pretty interesting stuff. Fileless malware seems to have relatively similar indicators in the registry and/or scheduled tasks that were shown in your demo. Would you be able to share the memdump? I'd be interested in reversing it myself.

trich
Автор

Interesting. It seems the part described in the video is merely the delivery mechanism that installs the payload into memory and schedules it for execution. Still unclear how the base64-encoded "payload" found its way into the registry in the first place.

JohnFHolliday
Автор

Great video. I've never encountered fileless malware, but this video is inspiring. Do you have a link from where I can download this malware? I want to study it with your video's help and write it up.

kad
Автор

Was this malware used in an attack? What’s the method of infection? And do you have a link to a report if it was used in an attack?

SideRocketeer
Автор

I would argue to the media that %SystemRoot%\System32\Config and ntuser.dat are files at the end of the day. I think the name fileless malware is a little too hyped lol!

Anon-tjqb