PowerStallion

Malware & Tools · PowerStallion

· MalwareS0393 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

PowerStallion is a lightweight PowerShell backdoor used by Turla, possibly as a recovery access tool to install other backdoors.(Citation: ESET Turla PowerShell May 2019)

Tactic Coverage

stealth (2)discovery (1)execution (1)command and control (1)

Used By (1 groups)

G0010TurlaIRON HUNTER, Group 88

Techniques (5)

T1027Obfuscated Files or Information

stealth

T1057Process Discovery

discovery

T1059.001PowerShell

execution

T1070.006Timestomp

stealth

T1102.002Bidirectional Communication

command and control

References

https://attack.mitre.org/software/S0393 https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/