TF-MAL-ps1.powerton

Description

ThreatFox malware family `ps1.powerton`. Printable name: POWERTON.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (1)

• ThreatFox: IOCs for this family ThreatFox Malwares

• POWERTON, Software S0371 | MITRE ATT&CK®
  web:attack.cloudfall.cn

  POWERTON is a custom PowerShell backdoor first observed in 2018. It has typically been deployed as a late-stage backdoor by APT33. At least two variants of the backdoor have been identified, with the later version containing improved functionality. [1] ID: S0371 ⓘ Type: MALWARE ⓘ Platforms: Windows Version: 1.1 Created: 16 April 2019 Last Modified: 25 March 2020 ATT&CK® Navigator Layers ...

  2026-05-22 05:31 UTC
• POWERTON, Software S0371 | MITRE ATT&CK®
  web:attack.mitre.org

  POWERTON is a custom PowerShell backdoor first observed in 2018. It has typically been deployed as a late-stage backdoor by APT33. At least two variants of the backdoor have been identified, with the later version containing improved functionality. [1]

  2026-05-22 05:31 UTC
• FBI warns of ATM jackpotting surge | Cybernews
  web:cybernews.com

  The FBI warns of a surge in ATM jackpotting attacks, with more than 700 incidents in 2025 alone. Hackers use Ploutus malware to force machines to dispense cash.

  2026-05-22 05:31 UTC
• POWERTON (Malware Family) - Fraunhofer
  web:malpedia.caad.fkie.fraunhofer.de

  Details for the POWERTON malware family including references, samples and yara signatures.

  2026-05-22 05:31 UTC
• Open Hunting - Threat Library
  web:openhunting.io

  POWERTON is designed to support multiple persistence mechanisms, including WMI and auto-run registry key. Communications with the C2 are over TCP/HTTP (S) and leverage AES encryption for communication traffic to and from the C2. POWERTON typically gets deployed as a later stage backdoor and is obfuscated several layers.

  2026-05-22 05:31 UTC
• S0371 Powerton
  web:redteam.y-security.de

  S0371 POWERTON POWERTON is a custom PowerShell backdoor first observed in 2018. It has typically been deployed as a late-stage backdoor by APT33. At least two variants of the backdoor have been identified, with the later version containing improved functionality. 1

  2026-05-22 05:31 UTC
• Technical Approaches to Uncovering and Remediating Malicious ... - CISA
  web:www.cisa.gov

  It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.

  2026-05-22 05:31 UTC
• POWERTON - Malware - Cyber Threat Intelligence
  web:www.giovannicarrieri.it

  Tecniche Associate (6) ID ATT&CK Tattiche T1003.002 Security Account Manager - T1059.001 PowerShell - T1071.001 Web Protocols - T1546.003 Windows Management Instrumentation Event Subscription - T1547.001 Registry Run Keys / Startup Folder - T1573.001 Symmetric Cryptography -

  2026-05-22 05:31 UTC
• Trojan:PowerShell/Powerton.A - microsoft.com
  web:www.microsoft.com

  Understand how this virus or malware spreads and how its payloads affects your computer. Protect against this threat, identify symptoms, and clean up or remove infections.

  2026-05-22 05:31 UTC
• Meeting POWERBAND: The APT33 .Net POWERTON variant - Telsy
  web:www.telsy.com

  The variant under analysis shares similarity with well known APT33 late-stage backdoor which is referred with the name of POWERTON (sha256: f45a8844c575e3fcc1f7a05dadfdfc293a53d0142f1a9b7d76a8f3aed5b5b0a6).

  2026-05-22 05:31 UTC

Only Available for Registered Users. Sign in to view.