{"id":321614,"date":"2019-09-30T09:30:04","date_gmt":"2019-09-30T07:30:04","guid":{"rendered":"https:\/\/mybroadband.co.za\/news\/?p=321614"},"modified":"2019-09-30T09:32:00","modified_gmt":"2019-09-30T07:32:00","slug":"new-malware-uses-existing-programs-to-control-pcs","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/security\/321614-new-malware-uses-existing-programs-to-control-pcs.html","title":{"rendered":"New malware uses existing programs to control PCs"},"content":{"rendered":"

Microsoft<\/strong><\/a> and Cisco’s Talos<\/strong><\/a> have uncovered a new form of malware known as Divergent which lets malicious parties use the victim’s PC for illegal activities such as click fraud.<\/p>\n

Divergent uses existing programs to achieve its malicious goals, such as those already present in Windows or downloaded from third parties.<\/p>\n

“This threat uses NodeJS \u2014 a program that executes JavaScript outside of a web browser \u2014 as well as the legitimate open-source utility WinDivert to facilitate some of the functionality in the Divergent malware,” said Talos.<\/p>\n

Talos added that the use of NodeJS is not something commonly seen across malware families, which makes Divergent an interesting development.<\/p>\n

However, it shares many similarities with other popular fileless malware families, including Kovter.<\/p>\n

How it works<\/h3>\n

“When first delivered and executed on a victim’s machine, the malware is in the portable executable (PE) format. Its first task, however, is to install itself to the system in a less suspicious form, namely as an HTML Application (HTA) that will load the malware from the registry,” said Talos.<\/p>\n

Once installed, a series of events occur:<\/p>\n