⚠️ Overview

Power Loader is a modular downloader malware first publicly documented in May 2018 by Trend Micro, primarily operated by the financially motivated threat group tracked as TA505 (also known as FIN11). It falls under the category of a downloader and loader that delivers secondary payloads such as Clop ransomware, FlawedAmmy RAT, and Get2. Power Loader is often distributed via malicious Microsoft Office documents attached to spear-phishing emails or hosted on compromised sites.

🔧 Technical Capabilities

Power Loader uses PowerShell scripts to download and execute encrypted or obfuscated payloads from remote command-and-control (C2) servers. It employs a multi-stage infection chain: the initial dropper is typically a VBA macro or a Windows Script Host file that invokes PowerShell to decode a base64-encoded loader binary. The loader then contacts hardcoded C2 domains using HTTP GET requests with User-Agent strings mimicking legitimate browser versions. Persistence is achieved by creating scheduled tasks or adding Registry run keys under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. Evasion techniques include checking for sandbox environments, disabling Windows Defender through WMI calls, and sleeping for random intervals before beaconing. Once the loader retrieves an encrypted payload, it decrypts it using XOR or RC4 and injects it into a legitimate Windows process such as rundll32.exe or notepad.exe.

📜 History & Notable Incidents

First observed in 2018, Power Loader gained prominence in late 2019 when TA505 used it to deploy the Get2 backdoor and later the FlawedAmmy RAT against financial, healthcare, and retail sectors. In August 2020, Trend Micro reported a high-volume campaign distributing Clop ransomware via Power Loader, targeting organizations in North America and Europe. No specific CVEs are directly associated with Power Loader itself, but it exploits CVE-2017-0199 and CVE-2018-0802 in Microsoft Office to enable initial infection. Law enforcement actions have not directly taken down the malware, but the arrest of TA505 affiliates in 2021 reduced its activity temporarily.

🔍 Detection Indicators

Behavioral signatures include PowerShell spawning with elevated privileges and making HTTP connections to suspicious domains ending in .xyz or .club. Network indicators include HTTP POST requests to C2 endpoints with URLs containing base64-encoded strings. Registry indicators: HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunMSUpdate and HKCU...RunJavaUpdate. Known mutex names include GlobalPowerLoaderMutex and GlobalUpdateMutex. YARA rules published by Trend Micro (e.g., rule PowerLoader_01) detect the loader’s embedded C2 lists. File hashes vary per sample; one SHA256 from a 2019 campaign is 8f8e1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0 (publicly indexed on VirusTotal).

☠️ Risk & Impact

Power Loader frequently leads to full ransomware deployment (Clop), resulting in massive data exfiltration and encryption. Affected sectors include healthcare (e.g., hospital networks), finance (banking IT systems), and manufacturing. In 2020, a single Clop ransomware campaign delivered via Power Loader caused estimated losses exceeding $17 million globally, including ransom payments and recovery costs.

🛡️ Mitigation

Defenses should block macro execution in Office documents from untrusted sources and deploy EDR rules that detect anomalous PowerShell spawning from Office applications. Apply Microsoft patches for CVE-2017-0199 and CVE-2018-0802. Network-level blocks on .xyz and .club TLDs can reduce C2 communication, and organizations should implement application whitelisting to prevent unauthorized script interpreters.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.