Power Loader
MITRE ATT&CK: S0177 View on attack.mitre.org
- Malware type
- downloader, loader
- Family
- Malware family
- Related IoCs
- 8 (6 malicious)
- Last IoC activity
- 2026-10-06 14:59:01
- Profile updated
- 2026-07-07 15:16:12
Targeted industries: financial-services
Context
Power Loader is modular code sold in the cybercrime market used as a downloader in malware families such as Carberp, Redyms and Gapz.
Recent IoC activity
6 malicious indicators in Maltiverse are attributed to Power Loader (S0177). The 6 most recently updated:
| Type | Indicator | Updated | Sources |
|---|---|---|---|
| file sample | 1e6e0a791010d255b9209b71b8e5d66f9da0035cb1b6a830398dc4779870524e | 2026-10-06 | 1 |
| file sample | 4709bfc0f1c220009ef45f182f8ae5a3f6844dac62646f1b2da3f43ebfd52db1 | 2026-10-05 | 1 |
| URL | http://176.46.152.47/bot.exe | 2025-11-02 | 2 |
| URL | http://176.46.152.46/bot.exe | 2025-11-02 | 2 |
| URL | http://176.46.152.47/dropper64.exe | 2025-09-01 | 1 |
| URL | http://176.46.152.46/dropper64.exe | 2025-09-01 | 2 |
Detection coverage
- 1 Sigma rules
Malware & tools used
- Extra Window Memory Injection (attack-pattern)
Reports & references
- malwaretech.com — Powerloader Injection Something Truly (report)
- MITRE ATT&CK — S0177 (report)
- ESET — Gapz And Redyms Droppers Based On Power Loader Code (report)