Malware
SilentPrism
According to Trend Micro, SilentPrism is a backdoor malware designed to achieve persistence, dynamically execute shell commands, and maintain unauthorized remote control of compromised systems.
SilentPrism is a PowerShell malware family operated by Larva-208.
Background
Trend Micro characterizes SilentPrism as a backdoor built to persist on a host, run shell commands on demand, and keep operators in covert remote control of infected machines. Its persistence approach varies by privilege level: when running as a standard user it writes auto-run entries to the Windows registry that use mshta.exe with VBScript to pull down and run remote payloads, while administrative contexts instead get scheduled tasks performing the same kind of execution. The backdoor pulls extra payloads and instructions from a C&C server for modular operation, and protects that traffic with AES encryption and Base64 encoding. Incoming commands are decrypted and run in several ways, including direct PowerShell execution, on-the-fly script block creation, or job-based execution, with each task assigned a unique identifier so progress can be tracked and results returned. To frustrate analysis, SilentPrism checks for virtual machines and inserts randomized pauses of 300 to 700 milliseconds between actions, and it continually polls the C&C server so operators can steer compromised systems in real time.
Source: Malpedia (Fraunhofer FKIE).