⚠️ Overview

Poweliks is a fileless malware first documented in August 2014 by Symantec, classified as a trojan that operates entirely within the Windows registry without writing executable files to disk. It is believed to be operated by an Eastern European cybercriminal group known as the "Poweliks gang" and falls under the category of a backdoor trojan used for credential theft and secondary payload delivery.

🔧 Technical Capabilities

Poweliks propagates via malicious email attachments (typically JavaScript or Microsoft Word documents with embedded scripts) that launch a fileless infection chain. The initial dropper writes a base64-encoded JavaScript payload into the Windows registry key HKCUSoftwareMicrosoftWindowsCurrentVersionRun under a randomly named subkey, achieving persistence without creating a physical file. Upon each reboot, the registry-stored script executes via rundll32.exe or PowerShell (mapped to MITRE ATT&CK technique T1059.001), decoding and running the main payload in memory. The malware uses Windows Management Instrumentation (WMI) for system reconnaissance and can fetch additional modules from command-and-control (C2) servers over HTTP. It evades detection by avoiding disk writes, encrypting its registry data with a simple XOR cipher, and employing periodic C2 communication intervals to blend into normal traffic.

📜 History & Notable Incidents

Poweliks first appeared in targeted phishing campaigns against financial institutions and government agencies in late 2014, as reported by Symantec in a detailed analysis (available at symantec.com/connect/blogs/poweliks-fileless-malware). In 2015, researchers at Trend Micro observed Poweliks used in conjunction with the Dyre banking trojan to steal online banking credentials. No specific CVEs are associated with Poweliks, as it exploits user interaction rather than software vulnerabilities. Law enforcement actions have not been publicly attributed to this malware family, and the group behind it remains active as of 2023, though its prevalence has declined due to improved detection of fileless attacks.

🔍 Detection Indicators

Behavioral signatures include the creation of unique registry entries under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with names like "{random hex string}" containing base64-encoded JavaScript. Network IOCs include HTTP requests to domains such as "bigboos[.]com" and "truereport[.]org" documented in Symantec's threat report. The malware uses the User-Agent string "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727)" and creates a mutex named "GlobalPoweliksMutex" for single-instance enforcement.

☠️ Risk & Impact

Poweliks poses a high risk due to its fileless nature, enabling it to bypass traditional antivirus that relies on file scanning. It exfiltrates sensitive data such as browsing history, FTP credentials, and email account passwords by injecting into svchost.exe and monitoring network traffic. Financial institutions and online retail sectors were most impacted in early campaigns, with individual losses estimated at tens of thousands per incident based on Symantec victim reports.

🛡️ Mitigation

Defenders should deploy application whitelisting to block unauthorized script hosts like PowerShell and rundll32.exe, enable Windows Defender Attack Surface Reduction (ASR) rules, and monitor registry run keys for anomalous changes using Sysmon (Event ID 13). Regular patching of Microsoft Office and enabling macro security policies reduces the initial infection vector.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.