SYMBOLCOMMON_NAMEaka. SYNONYMS
ps1.powerton (Back to overview)

POWERTON

Actor(s): APT33

There is no description at this point.

References
2020-07-13 ⋅ FireEye ⋅ Aaron Stephens, Andrew Thompson
SCANdalous! (External Detection Using Network Scan Data and Automation)
POWERTON QUADAGENT PoshC2
2020-06-18 ⋅ Microsoft ⋅ Microsoft Threat Protection Intelligence Team
Inside Microsoft Threat Protection: Mapping attack chains from cloud to endpoint (APT33/HOLMIUM)
POWERTON
2020-02-12 ⋅ Telsy ⋅ Telsy
Meeting POWERBAND: The APT33 .NET POWERTON Variant
POWERTON POWERBAND
2020-01-01 ⋅ Secureworks ⋅ SecureWorks
COBALT TRINITY
POWERTON pupy Imminent Monitor RAT Koadic Nanocore RAT NetWire RC PoshC2 APT33
2019-07-22 ⋅ One Night in Norfolk ⋅ Kevin Perlow
APT33 PowerShell Malware
POWERTON
2019-06-24 ⋅ Symantec ⋅ Benjamin Moench
Backdoor.Powerton
POWERTON
2018-12-21 ⋅ FireEye ⋅ Alex Orleans, Andrew Thompson, Geoff Ackerman, Nick Carr, Rick Cole
OVERRULED: Containing a Potentially Destructive Adversary
POWERTON PoshC2 pupy
Yara Rules
[TLP:WHITE] ps1_powerton_w0 (20190903 | No description)
rule ps1_powerton_w0 {
    meta:
        author = "jeFF0Falltrades"
        hash = "6bea9a7c9ded41afbebb72a11a1868345026d8e46d08b89577f30b50f4929e85"
        source = "https://github.com/jeFF0Falltrades/IoCs/blob/master/APT/powerton_apt_33.md"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.powerton"
        malpedia_version = "20190903"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    strings:
        $str_wmi = "Adding wmi persist ..." wide ascii
        $str_registery = "Poster \"Registery Value With Name" wide ascii
        $str_upload = "(New-Object Net.WebClient).UploadFile(\"$SRVURL$address\", \"$fullFilePath" wide ascii
        $str_pass = "jILHk{Yu1}2i0h^xe|t,d+Cy:KBv!l?7" wide ascii
        $str_addr = "$address=\"/contact/$BID$($global:rndPost)/confirm" wide ascii
        $str_png = "$env:temp + \"\\\" + $(date -format dd-m-y-HH-mm-s) + \".png" wide ascii
        $str_msg = "/contact/msg/$BID$($global:rndPost)" wide ascii
        $str_ua = "Mozilla/5.0 (Windows NT $osVer; rv:38.0) Gecko/20100101 Thunderbird/38.1.0 Lightning/4.0.2" wide ascii
        $domain = "backupaccount.net" wide ascii

    condition:
        2 of ($str*) or $domain
}
Download all Yara Rules