POWERTON
Description
(FireEye) POWERTON is a backdoor written in PowerShell; FireEye has not yet identified any publicly available toolset with a similar code base, indicating that it is likely custom-built. POWERTON is designed to support multiple persistence mechanisms, including WMI and auto-run registry key. Communications with the C2 are over TCP/HTTP(S) and leverage AES encryption for communication traffic to and from the C2. POWERTON typically gets deployed as a later stage backdoor and is obfuscated several layers.
Names
| Name |
|---|
| POWERTON |
Category
Malware
Type
- Backdoor
Information
Mitre Attack
Malpedia
Alienvault Otx
Other Information
Uuid
cdb68988-cc6c-4324-9767-7bffc666d6de
Last Card Change
2020-04-22