Procedure examples

POWERSTATS can upload files from compromised hosts.

POWERSTATS can retrieve IP, network adapter configuration information, and domain from compromised hosts.

POWERSTATS uses character replacement, PowerShell environment variables, and XOR encoding to obfuscate code. POWERSTATS's backdoor code is a multi-layer obfuscated, encoded, and compressed blob. POWERSTATS has used PowerShell code with custom string obfuscation

POWERSTATS has used useless code blocks to counter analysis.

POWERSTATS can sleep for a given number of seconds.

POWERSTATS has the ability to identify the username on the compromised host.

POWERSTATS has created a scheduled task named "MicrosoftEdge" to establish persistence.

POWERSTATS can use WMI queries to retrieve data from compromised hosts.

POWERSTATS has established persistence through a scheduled task using the command ”C:\Windows\system32\schtasks.exe” /Create /F /SC DAILY /ST 12:00 /TN MicrosoftEdge /TR “c:\Windows\system32\wscript.exe C:\Windows\temp\Windows.vbe”.

POWERSTATS has used get_tasklist to discover processes on the compromised host.

POWERSTATS uses PowerShell for obfuscation and execution.

POWERSTATS can use VBScript (VBE) code for execution.

POWERSTATS can use JavaScript code for execution.

POWERSTATS can delete all files on the C:\, D:\, E:\ and, F:\ drives using PowerShell Remove-Item commands.

POWERSTATS can retrieve OS name/architecture and computer/domain name information from compromised hosts.

POWERSTATS can retrieve usernames from compromised hosts.

POWERSTATS has connected to C2 servers through proxies.

POWERSTATS can retrieve and execute additional PowerShell payloads from the C2 server.

POWERSTATS can retrieve screenshots from compromised hosts.

POWERSTATS encoded C2 traffic with base64.

POWERSTATS can deobfuscate the main backdoor code.

POWERSTATS can use Mshta.exe to execute additional payloads on compromised hosts.

POWERSTATS has detected security tools.

POWERSTATS can use DCOM (targeting the 127.0.0.1 loopback address) to execute additional payloads on compromised hosts.

POWERSTATS can use DDE to execute additional payloads on compromised hosts.

POWERSTATS has encrypted C2 traffic with RSA.

POWERSTATS can disable Microsoft Office Protected View by changing Registry keys.