Loading malware…
PowerLoader is a Windows downloader/loader written in C++ that is designed to operate largely filelessly in order to evade endpoint detection. It has been associated with process-injection tradecraft, including the Extra Window Memory Injection technique that abuses Explorer’s Shell_TrayWnd window structures to redirect execution into another process. More recent reporting links PowerLoader to criminal delivery chains used by the Fluffy Wolf threat actor, where it was introduced as a new malware-as-a-service component and used to launch hidden PowerShell instances, retrieve additional scripts from command infrastructure, and stage follow-on malware. In observed campaigns, PowerLoader formed part of phishing-driven intrusions against Russian organizations in sectors including construction, consulting, manufacturing, engineering, retail, and e-commerce, ultimately facilitating deployment of payloads such as PureCrypter, PureLogs, PureRAT, and Pay2Key ransomware. Its role is primarily as a stealthy execution and delivery component rather than the final payload, with emphasis on in-memory execution, defense evasion, and process injection on Windows systems.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
PowerLoader is an undocumented C++ downloader that executes almost entirely filelessly to bypass standard endpoint defenses like Windows Defender.
6 distinct techniques documented for this family, organized by ATT&CK tactic.
Security researchers have uncovered a series of highly sophisticated Fluffy Wolf phishing attacks targeting Russian organizations across various critical sectors.
Using highly deceptive tactics, the attackers send emails masquerading as legitimate corporate communications regarding outstanding debts, reconciliation statements, or legal claims. To bypass modern email security gateways, the attackers heavily rely on malicious RAR attachments...
EXTRA WINDOW MEMORY INJECTION (EWMI) VIA SETWINDOWLONG EWMI relies on injecting into Explorer tray window’s extra window memory... | Process injection is a widespread defense evasion technique employed often within malware and fileless adversary tradecraft, and entails running custom code within the address space of another process.
EXTRA WINDOW MEMORY INJECTION (EWMI) VIA SETWINDOWLONG EWMI relies on injecting into Explorer tray window’s extra window memory... | Process injection is a widespread defense evasion technique employed often within malware and fileless adversary tradecraft, and entails running custom code within the address space of another process.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Malware-as-a-Service C++ downloader used by Fluffy Wolf that operates largely filelessly, spawns hidden PowerShell to fetch scripts from C2, and deploys final payloads including Pay2Key, PureLogs, and PureRAT.
Новый загрузчик на C++, запускающий PowerShell в скрытом режиме и получающий скрипты с управляющего сервера; затем скачивает и запускает PureCrypter.
Malware shown using extra window memory injection into the Explorer shell tray window via SetWindowLong and SendNotifyMessage.
Malware shown using extra window memory injection into the Explorer shell tray window.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.