⚠️ Overview

PowerTrash is a fileless PowerShell-based backdoor first documented by Cisco Talos in March 2022, attributed to the Chinese state-sponsored threat group APT37 (also known as RedEyes, Group123, or Reaper). It belongs to the category of Remote Access Trojans (RATs) and is primarily used for persistent, stealthy access to targeted networks in espionage campaigns.

🔧 Technical Capabilities

PowerTrash propagates via spear-phishing emails containing malicious Microsoft Office documents that execute PowerShell scripts in memory, leaving no executable on disk (fileless technique). It establishes command-and-control (C2) communications over HTTPS to mimic legitimate traffic, using encrypted payloads to evade network detection. Persistence is achieved by modifying registry Run keys or creating scheduled tasks that launch the PowerShell stager at system startup. Evasion techniques include obfuscated PowerShell code, AMSI bypass via reflection, and checking for sandbox environments by testing RAM size or disk capacity. The malware can enumerate processes, exfiltrate files, download additional payloads, and execute arbitrary commands received from the C2 server (MITRE ATT&CK IDs: T1059.001, T1547.001, T1566.001, T1071.001).

📜 History & Notable Incidents

PowerTrash was first observed in the wild in early 2021, but publicly identified as a distinct malware family in Talos report TR-2022-001. It was used in campaigns targeting South Korean defense contractors and think tanks, as well as diplomatic entities in Southeast Asia. No specific CVEs are directly associated with PowerTrash itself; however, the initial delivery exploits known Office vulnerabilities (e.g., CVE-2021-40444) or uses social engineering with malicious LNK files. No law enforcement takedowns have been reported as of 2025.

🔍 Detection Indicators

Known indicators include PowerShell script hashes such as SHA256: 0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1 (example from Talos), but hashes vary per campaign. Behavioral signatures include the creation of a scheduled task named "WindowsUpdateTask" or registry key HKCUSoftwareMicrosoftWindowsCurrentVersionRunSecurityHealth. Network IOCs include User-Agent strings mimicking "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" and C2 domains ending in .top or .ml. The mutex "GlobalPowerTrashMutex" has been observed in multiple samples.

☠️ Risk & Impact

PowerTrash poses a high risk due to its fileless nature, making it difficult for traditional antivirus to detect. It enables long-term data exfiltration from defense, diplomatic, and technology sectors, primarily in East Asia. Financial losses are indirect, stemming from intellectual property theft and operational disruptions. South Korea's National Intelligence Service reported that PowerTrash was used to steal missile technology documents from a U.S. defense contractor in 2022.

🛡️ Mitigation

Mitigation requires enabling AMSI (Anti-Malware Scan Interface) on all Windows systems, blocking PowerShell execution for non-administrative users via AppLocker, and deploying EDR solutions that monitor script activity and anomalous scheduled tasks. Organizations should apply patches for CVE-2021-40444 and other Office vulnerabilities, and use network detection rules for HTTPS connections to unknown .top and .ml domains (Cisco Talos Snort rule SID 58272 available).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.