Registry run key value used to execute the malicious JavaScript In a fileless infection, Kovter adds a value to one or more of the registry run keys to execute JavaScript using the legitimate MSHTA program.įigure 1. If no internet access is available at the time of infection, then Kovter reverts to being a more traditional file-based malware.

If PowerShell is not found on the computer and internet access is available, then the Trojan downloads a version of the framework. During initial infection, Kovter checks to see if PowerShell is already installed on the compromised computer. Similar to Poweliks, Kovter (version 2.0.3 onwards) has memory-resident, fileless capabilities and uses several techniques to persist in the registry. However, Kovter itself is known to perform click-fraud activities. The threat rose to prominence in 20 thanks to its association with traditional ransomware ( ) which locks a victim’s computer screen and displays a message demanding a fine for illegal activity. The Kovter malware family has been around since at least 2013 and has evolved over time. The threat is also memory resident and uses the registry as a persistence mechanism to ensure it is loaded into memory when the infected computer starts up. It accomplishes this by using registry tricks in an attempt to evade detection. When the new Kovter variant compromises a computer, the Trojan has the ability to reside only in the registry and not maintain a presence on disk. A variant of Kovter ( Trojan.Kotver), first seen in May 2015, looks to be one of the first to incorporate techniques from Poweliks in order to evade detection and remain persistent on the compromised computer.

This technique had not been seen before Poweliks ( Trojan.Poweliks) arrived, but it was only a matter of time until other malware authors adopted it. Poweliks made headlines in 2014 as the first persistent, fileless, registry-based malware.

Symantec trojan poweliks removal tool