Power Stager Analysis
Summary: Unit 42 analyzed PowerStager, a Python-based builder that generates Windows executables from C source and chains seven layers of obfuscated PowerShell to inject shellcode, noting an uptick in in-the-wild use around December 2017. As of December 29, 2017, Palo Alto Networks had observed 502 unique PowerStager samples, with identified targets belonging to Western European media and wholesale organizations and many others tied to testing and sales proof-of-concept demonstrations.
What's compelling: The tool's randomized file names, XOR keys, and camel-case arguments defeat signature scanning, yet its static Manifest fields - a fixed Description and a Company Name always ending in ' INC.' - remain a reliable way to characterize the 502 samples already in circulation.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026