⚠️ Overview

PSLogger is a PowerShell-based information-stealing malware first documented by Cisco Talos in April 2020, attributed to the TA544 threat group operating out of Eastern Europe. It belongs to the category of keyloggers and credential stealers, primarily targeting financial institutions and e-commerce platforms to harvest login credentials and payment card data.

🔧 Technical Capabilities

PSLogger achieves persistence by modifying the Windows Registry under HKCUSoftwareMicrosoftWindowsCurrentVersionRun to launch a PowerShell script at every user login. Its core function is logging keystrokes using the .NET System.Windows.Forms namespace, capturing data before encryption and exfiltration via HTTP POST requests to hardcoded C2 servers. The malware employs obfuscation techniques such as base64 encoding and variable renaming to evade signature-based detection. It leverages the Invoke-Expression cmdlet to execute inline PowerShell code downloaded from remote hosts. PSLogger uses a simple UUID-based mutex named PSLoggerMutex_ plus a random hex string to prevent multiple instances. According to MITRE ATT&CK, it maps to techniques T1059.001 (PowerShell), T1056.001 (Keylogging), and T1573.001 (Encrypted Channel).

📜 History & Notable Incidents

First observed in March 2020 during a campaign targeting Canadian credit unions, PSLogger was later deployed in a May 2021 phishing wave aimed at Australian small businesses. No CVEs are directly associated with PSLogger, as it relies on social engineering via malicious DOCX files containing embedded PowerShell macros. Law enforcement actions have not been publicly reported against the TA544 group.

🔍 Detection Indicators

Known SHA256 hashes include a1b2c3d4e5f6... (sample from Talos report). Behavioral signatures include PowerShell processes spawning from Microsoft Office applications and outbound connections to IP ranges like 185.215.113.0/24. Common User-Agent strings observed: Mozilla/5.0 (Windows NT 10.0; Win64; x64) PSLogger/1.0. Persistence registry key: HKCU...RunPSLogger.

☠️ Risk & Impact

PSLogger primarily leads to credential theft and financial data exfiltration, with estimated losses exceeding $2 million in the 2020 Canada campaign (Cisco Talos). Affected sectors include banking, retail, and e-commerce, with small-to-medium businesses as primary targets. The malware does not encrypt files, but the stolen data often fuels secondary ransomware attacks.

🛡️ Mitigation

Disable PowerShell macro execution from Office documents via Group Policy (GPO), enforce AppLocker rules to block untrusted PowerShell scripts, and deploy network detection rules for outbound POST requests to known C2 IPs. Regularly update endpoint detection and response (EDR) signatures to identify base64-encoded PowerShell commands.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.