TF-MAL-ps1.powersource

Description

ThreatFox malware family `ps1.powersource`. Printable name: POWERSOURCE.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (1)

• ThreatFox: IOCs for this family ThreatFox Malwares

• ClarAVy: A Tool for Scalable and Accurate Malware Family Labeling
  web:arxiv.org

  Abstract. Determining the family to which a malicious file belongs is an essential component of cyberattack investigation, attribution, and remediation . Performing this task manually is time consuming and requires expert knowledge. Automated tools using that label malware using antivirus detections lack accuracy and/or scalability, making them insufficient for real-world applications. Three ...

  2026-05-22 05:31 UTC
• POWERSOURCE, Software S0145 | MITRE ATT&CK®
  web:attack.mitre.org

  POWERSOURCE is a PowerShell backdoor that is a heavily obfuscated and modified version of the publicly available tool DNS_TXT_Pwnage. It was observed in February 2017 in spearphishing campaigns against personnel involved with United States Securities and Exchange Commission (SEC) filings at various organizations. The malware was delivered when macros were enabled by the victim and a VBS script ...

  2026-05-22 05:31 UTC
• Remediate vulnerabilities with Microsoft Defender Vulnerability ...
  web:learn.microsoft.com

  Remediate security weaknesses discovered through security recommendations, and create exceptions if needed, in Defender Vulnerability Management.

  2026-05-22 05:31 UTC
• POWERSOURCE (Malware Family) - Fraunhofer
  web:malpedia.caad.fkie.fraunhofer.de

  POWERSOURCE is a heavily obfuscated and modified version of the publicly available tool DNS_TXT_Pwnage. The backdoor uses DNS TXT requests for command and control and is installed in the registry or Alternate Data Streams.

  2026-05-22 05:31 UTC
• PR25-00002 - Information and Privacy Commissioner of Ontario
  web:norma.lexum.com

  The subcontractor had elevated privileges to access PowerSource and through it, the institutions' individual SIS environments where institutions had enabled remote maintenance support [29] connections by selecting the "always on" option.

  2026-05-22 05:31 UTC
• RESURGE Malware and CVE-2025-0282: Critical Threats and Defender ...
  web:windowsforum.com

  The emergence of RESURGE signals more than just another entry in a long line of malware threats. According to CISA, RESURGE contains advanced persistence features inherited from the SPAWNCHIMERA malware family—a group notorious for its ability to survive system reboots and avoid simplistic remediation .

  2026-05-22 05:31 UTC
• Advancing Malware Family Classification with MOTIF - Booz Allen Hamilton
  web:www.boozallen.com

  The ability to quickly pin down the family of malware used during a cyber attack can be a massive boon to an incident responder. Not only does family classification provide immediate insights about the characteristics and behaviors of a malware sample, but it is a core part of the triage, remediation , and attribution efforts.

  2026-05-22 05:31 UTC
• Malware Incident Response: The 7-Step Playbook for 2025 - Breachsense
  web:www.breachsense.com

  Complete malware remediation now requires addressing both the infected endpoint and the stolen authentication data. Your malware incident response playbook must account for both.

  2026-05-22 05:31 UTC
• Technical Approaches to Uncovering and Remediating Malicious ... - CISA
  web:www.cisa.gov

  It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.

  2026-05-22 05:31 UTC
• Mitigating malware and ransomware attacks - The National Cyber Security ...
  web:www.ncsc.gov.uk

  This guidance helps private and public sector organisations deal with the effects of malware (which includes ransomware). It provides actions to help organisations prevent a malware infection, and also steps to take if you're already infected. Following this guidance will reduce: the likelihood of becoming infected the spread of malware throughout your organisation the impact of the infection

  2026-05-22 05:31 UTC

Only Available for Registered Users. Sign in to view.