PowerHarbor
- First seen
- 2022-03-15 00:00:00
- Malware type
- credential-stealer, backdoor, spyware
- Family
- Malware family
- Profile updated
- 2026-07-07 14:38:52
Targeted industries: financial-services technology-and-telecommunications government-and-public-sector
Context
PowerHarbor is a modular PowerShell-based malware that consists of various modules. The primary module maintains constant communication with the C2 server, executing and deleting additional modules received from it. Currently, the communication with the C2 server is encrypted using RSA encryption and hardcoded key data. Moreover, the main module incorporates virtual machine (VM) detection capabilities. The StealData module employs the Invoke-Stealer function as its core, enabling the theft of system information, browser-stored credentials, cryptocurrency wallet details, and credentials for various applications like Telegram, FileZilla, and WinSCP.
Reports & references
- malpedia.caad.fkie.fraunhofer.de — Ps1.Powerharbor (report)
- insight-jp.nttsecurity.com — Steelcloverpowerharbor (report)