Threat Intelligence Directory

Malware family identifying ps1.quadagent. Origin and technical characteristics tracked via Malpedia.

Malware family identifying ps1.ptero_graphin. Origin and technical characteristics tracked via Malpedia.

The family is adding a fake root certificate authority, sets a proxy.pac-url for local browsers and redirects infected users to fake banking applications (currently targeting Poland). Based on information shared, it seems the PowerShell script is dropped by an exploit kit.

Malware family identifying ps1.powruner. Origin and technical characteristics tracked via Malpedia.

DLL loader that decrypts and runs a powershell-based downloader.

Malware family identifying ps1.power_rat. Origin and technical characteristics tracked via Malpedia.

Malware family identifying ps1.power_magic. Origin and technical characteristics tracked via Malpedia.

PowerZure is a PowerShell project created to assess and exploit resources within Microsoft’s cloud platform, Azure. PowerZure was created out of the need for a framework that can both perform reconnaissance and exploitation of Azure, AzureAD, and the associated resources.

Malware family identifying ps1.powerware. Origin and technical characteristics tracked via Malpedia.

This PowerShell written malware is an in-memory dropper used by FIN7 to execute the included/embedded payload. According to Mandiant's blog article: "POWERTRASH is a uniquely obfuscated iteration of a shellcode invoker included in the PowerSploit framework available on GitHub."

Malware family identifying ps1.powerton. Origin and technical characteristics tracked via Malpedia.

POWERSTATS is a backdoor written in powershell. It has the ability to disable Microsoft Office Protected View, fingerprint the victim and receive commands.

Malware family identifying ps1.powerstar. Origin and technical characteristics tracked via Malpedia.

Malware family identifying ps1.powerspritz. Origin and technical characteristics tracked via Malpedia.

POWERSOURCE is a heavily obfuscated and modified version of the publicly available tool DNS_TXT_Pwnage. The backdoor uses DNS TXT requests for command and control and is installed in the registry or Alternate Data Streams.

Malware family identifying ps1.powershower. Origin and technical characteristics tracked via Malpedia.

Malware family identifying ps1.powershortshell. Origin and technical characteristics tracked via Malpedia.

Malware family identifying ps1.powershell_web_backdoor. Origin and technical characteristics tracked via Malpedia.

This powershell code is a PowerShell written backdoor used by FIN7. Regarding to Mandiant that is was revealed to be a "vast backdoor framework with a breadth of capabilities, depending on which modules are delivered from the C2 server."

Malware family identifying ps1.powerpipe. Origin and technical characteristics tracked via Malpedia.

Malware family identifying ps1.powerpepper. Origin and technical characteristics tracked via Malpedia.

According to Insikt Group, PowerNet is a custom Powershell loader that decompresses and executes NetSupport RAT.

PowerHarbor is a modular PowerShell-based malware that consists of various modules. The primary module maintains constant communication with the C2 server, executing and deleting additional modules received from it. Currently, the communication with the C2 server is encrypted using RSA encryption and hardcoded key data. Moreover, the main module incorporates virtual machine (VM) detection capabilities. The StealData module employs the Invoke-Stealer function as its core, enabling the theft of system information, browser-stored credentials, cryptocurrency wallet details, and credentials for various applications like Telegram, FileZilla, and WinSCP.

Malware family identifying ps1.powerbrace. Origin and technical characteristics tracked via Malpedia.

Malware family identifying ps1.poshspy. Origin and technical characteristics tracked via Malpedia.

Malware family identifying ps1.phonyc2. Origin and technical characteristics tracked via Malpedia.

Malware family identifying ps1.oilrig. Origin and technical characteristics tracked via Malpedia.

The author describes Octopus as an "open source, pre-operation C2 server based on python which can control an Octopus powershell agent through HTTP/S." It is different from the malware win.octopus written in Delphi and attributed to DustSquad by Kaspersky Labs.

According to ESET Research, this malware is used by LongNosedGoblin and executes a chain of obfuscated commands passed to a spawned PowerShell process as one long command line argument, meaning that the script is not stored on disk. Every subsequent stage is encoded with base64, where the last one is additionally deflated with gzip. The second stage bypasses AMSI. In this case, NosyDownloader uses Matt Graeber’s reflection method and disabling script logging techniques made available on GitHub to bypass AMSI.

According to Bleeping Computer and Vitali Kremez, LightBot is a compact reconnaissance tool suspected to be used to identify high-value targets for potential follow-up ransomware attacks.

Malware family identifying ps1.lazywiper. Origin and technical characteristics tracked via Malpedia.

Malware family identifying ps1.lazyscripter. Origin and technical characteristics tracked via Malpedia.

According to EclecticIQ, Kalambur is designed to gather local system information, then download a repackaged TOR binary inside a ZIP file and retrieve additional tools from what is likely an attacker-controlled TOR onion site.

Malware family identifying ps1.jasperloader. Origin and technical characteristics tracked via Malpedia.

The author describes this open source shell as follows. HTTP-Shell is Multiplatform Reverse Shell. This tool helps you to obtain a shell-like interface on a reverse connection over HTTP. Unlike other reverse shells, the main goal of the tool is to use it in conjunction with Microsoft Dev Tunnels, in order to get a connection as close as possible to a legitimate one. This shell is not fully interactive, but displays any errors on screen (both Windows and Linux), is capable of uploading and downloading files, has command history, terminal cleanup (even with CTRL+L), automatic reconnection, movement between directories and supports sudo (or sudo su) on Linux-based OS.

According to TRAC Labs, the GhostWeaver backdoor not only maintains continuous, authenticated communication with its command-and-control server but also includes functionalities to generate DGA domains (using a fixed-seed algorithm based on the week number and year), deliver additional payloads via remote commands and bypass certificate validation by leveraging a RemoteCertificateValidationCallback that always returns true. Multiple delivered plugins are designed to target sensitive information - including credentials from popular browsers (Brave, Chrome, Firefox, Edge), Outlook data, and cryptocurrency wallets. The Formgrabber plugin includes web injection methods by dynamically manipulating HTML content, modifying JA3 fingerprints via cipher suite reordering, and employing a man-in-the-middle proxy setup to intercept the traffic. GhostWeaver’s and plugins’ delivery on systems that are not part of an Active Directory domain suggests that attackers are extending their reach beyond typical corporate targets, aligning with a financially motivated agenda that exploits environments with weaker security controls.

Malware family identifying ps1.ghostminer. Origin and technical characteristics tracked via Malpedia.

The malware ftcode is a ransomware which encrypts files and changes their extension into .FTCODE. It later asks for a ransom in order to release the decryption key, mandatory to recover your files. It is infamous for attacking Italy pretending to be a notorious telecom provider asking for due payments.

Loader used to deliver FRat (see family windows.frat)

Malware family identifying ps1.flowerpower. Origin and technical characteristics tracked via Malpedia.