ATT&CK SoftwarePowerPunch

PowerPunch

S0685

Malware.View on attack.mitre.org

About this malware

PowerPunch is a lightweight downloader that has been used by Gamaredon Group since at least 2021.

Techniques used4

Execution1

T1059.001PowerShell

Stealth2

T1027.010Command Obfuscation T1480.001Environmental Keying

Command and Control1

T1105Ingress Tool Transfer

Procedure examples4

Technique	Procedure example
T1027.010 Command Obfuscation	PowerPunch can use Base64-encoded scripts. Microsoft Actinium February 2022
T1059.001 PowerShell	PowerPunch has the ability to execute through PowerShell. Microsoft Actinium February 2022
T1105 Ingress Tool Transfer	PowerPunch can download payloads from adversary infrastructure. Microsoft Actinium February 2022
T1480.001 Environmental Keying	PowerPunch can use the volume serial number from a target host to generate a unique XOR key for the next stage payload. Microsoft Actinium February 2022

Groups that use it1

Gamaredon Group

Campaigns0

None recorded.

References1

Microsoft Actinium February 2022 Open source
Microsoft Threat Intelligence Center. (2022, February 4). ACTINIUM targets Ukrainian organizations. Retrieved February 18, 2022.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.