PowerPunch is a lightweight downloader that has been used by Gamaredon Group since at least 2021.[1]

ID: S0685
Platforms: Windows
Version: 1.0
Created: 18 February 2022
Last Modified: 15 April 2022

Techniques Used

Domain ID Name Use
Enterprise T1059 .001 Command and Scripting Interpreter: PowerShell

PowerPunch has the ability to execute through PowerShell.[1]

Enterprise T1480 .001 Execution Guardrails: Environmental Keying

PowerPunch can use the volume serial number from a target host to generate a unique XOR key for the next stage payload.[1]

Enterprise T1105 Ingress Tool Transfer

PowerPunch can download payloads from adversary infrastructure.[1]

Enterprise T1027 Obfuscated Files or Information

PowerPunch can use Base64-encoded scripts.[1]

Groups That Use This Software

ID Name References
G0047 Gamaredon Group