Power Loader

Executive Summary

Power Loader is a modular downloader used to deploy various ransomware families such as Carberp, Redyms and Gapz. It downloads additional malicious modules from HTTP/HTTPS C2 servers, establishes persistence, and evades many standard detection techniques. Attackers rely on it for initial infection before delivering the final payload.

Power Loader is a modular downloader malware first documented in 2012 and widely sold on cyber‑crime forums as an off‑the‑shelf dropper. It serves as the initial infection vector for several high‑profile ransomware families such as Carberp, Redyms, and Gapz, downloading additional malicious modules from remote servers over HTTP/HTTPS. The code is highly extensible: a core loader binary receives configuration in JSON or XML format, determines which modules to deploy, then unpacks and executes them in memory without leaving persistent files on disk whenever possible. The malware’s architecture includes several advanced capabilities that allow it to evade detection and maintain persistence. It utilizes obfuscated scripts, custom TLS certificates, and mirrors for resiliency against takedowns. Power Loader can create autostart entries via registry run keys or scheduled tasks, enabling it to execute on system boot across multiple platforms, predominantly Windows. Operationally, attackers use the downloader to establish a foothold and then drop ransomware payloads that encrypt victims’ data, demanding payment for decryption. Because its modular nature allows quick integration of new modules, Power Loader can be rapidly repurposed by threat actors for phishing, banking Trojans, or other malware families.

Key Capabilities

• Downloads arbitrary files over HTTPS
• Uses obfuscated scripts and custom TLS certificates to evade analysis
• Creates autostart entries via registry / scheduled tasks for persistence
• Acts as a modular dropper that can deploy additional ransomware or banking Trojans
• Supports remote configuration in JSON/XML via C2 server

ATT&CK Techniques

Recommended Actions

• Block outbound HTTP/HTTPS traffic to known Power Loader command‑and‑control domains and IPs identified in threat feeds
• Use file integrity monitoring to detect new processes named PowerLoader.exe and suspicious DLL injections
• Deploy anti‑malware solutions that look for known hash signatures of Power Loader binaries
• Employ EDR solutions with activity baselines to flag unusual download and execution patterns
• Keep system patches up to date and disable unnecessary network services to limit C2 connectivity

Suggested Tags