Kaspersky Labs uncovers "RAM based malware"
Kaspersky researchers have uncovered malware which does not install any files onto a victims machine - Describing the malware as both “unique” and “very rare”, the malware "uses its payload to inject an encrypted DLL from the web directly into the memory of the javaw.exe process.” they say.
Once infected, the malware tries to attack Windows User Account Control and installs the Lurk Trojan which then connects to an associated botnet. This installation attempt is the key to the malware's success as anything living in RAM is obviously not going to survive a reboot. The researchers found the malware being served off an ad website specifically catering to Russian surfers and was trying to exploit a known Java vulnerability (CVE-2011-3544) - one which has long since been patched.
