DarkWatchman malware detected in Windows registry
Photo: Tadas Sar / Unsplash
Specialists of the Prevailion agency have discovered a dangerous new virus for Windows, which hides in the OS registry after installation. It is reported by the Bleeping Computer edition.
A virus program called DarkWatchman is phishing software that spreads via email. Judging by the content of the letters, the virus could have been created by Russian-speaking hackers, or it was intended for a Russian audience. A zip file is attached to a virus-infected message, which is imitated as a text document.
An error is displayed when opening a document, but the program is installed in the background. The malware is JavaScript-based and weighs only about 32 kilobytes. Experts noted that DarkWatchman is not loaded onto a computer disk, but is stored in the Windows registry, where it is extremely difficult for an inexperienced user to find it.
The program runs every time the user turns on the device. The virus code contains a list of ten domains through which the software is controlled remotely. Also, the program generates up to 500 domains every day, which allows it to remain active even when a number of servers are blocked. Prevailion experts advised PC owners to use antivirus and not open suspicious emails.
In mid-September, security experts from SentinelLabs spoke about the emergence of a new version of the dangerous banking Trojan ZLoader. Due to the presence of a fake security certificate, the virus can disable the built-in antivirus.