MITRE ATT&CKsoftware (malware)

S0145 POWERSOURCE

Published 2017-05-31 Modified 2025-04-16 Official page ↗
Domain
enterprise
Platforms
Windows
Aliases
DNSMessenger
Version
1.1
Created
2017-05-31

Description

POWERSOURCE is a PowerShell backdoor that is a heavily obfuscated and modified version of the publicly available tool DNS_TXT_Pwnage. It was observed in February 2017 in spearphishing campaigns against personnel involved with United States Securities and Exchange Commission (SEC) filings at various organizations. The malware was delivered when macros were enabled by the victim and a VBS script was dropped.

Related

Uses · MITRE ATT&CK (6)

  • T1071.004 DNS sub-technique
  • T1564.004 NTFS File Attributes sub-technique
  • T1059.001 PowerShell sub-technique
  • T1547.001 Registry Run Keys / Startup Folder sub-technique
  • T1012 Query Registry technique
  • T1105 Ingress Tool Transfer technique

Referenced by MITRE ATT&CK · uses (1)

References