PowerShower

PowerShower is a malware variant that emerged as a significant threat due to its ability to exploit and damage computer systems. It was first observed in attacks against European targets in October 2018, where it exploited the CVE-2017-11882 vulnerability. The malware, written in PowerShell, was downloaded through RTF templates and acted as an initial reconnaissance foothold. Its primary function was to download and execute a secondary payload with a more advanced set of features. Interestingly, PowerShower was named for its meticulous cleanup process after each operation, reducing traces of its activity. By December 2022, cybersecurity firms Check Point and Positive Technologies reported multi-stage attack sequences leading to the deployment of PowerShower. The malware was stored on disk using simple obfuscation techniques such as Base64-encoding and string concatenation. The versions of PowerShower observed during this period were less complex than earlier ones but maintained essential backdoor functions like HttpRequestG, HttpRequestP, and dec64. Notably, these functions could be tracked across different versions, indicating a consistent modus operandi. The PowerShower malware allowed attackers to communicate with a server they controlled, providing them with a powerful tool for cyber espionage or disruption. The malware first checked if Microsoft Word was running; if so, it would initiate a series of operations. The payload for the exploits was VBScript in an OLE package object, which decoded and executed PowerShower. Communication between the malware and the attacker's server was facilitated in XML format, further complicating detection efforts. In summary, PowerShower represented a sophisticated and evolving threat, demonstrating the persistent challenges in cybersecurity.