Trusted Design

PowerSniff Malware Used in Macro-based Attacks

概要

The concept of file-less malware is not a new one. Families like Poweliks, which abuse Microsoft’s PowerShell, have emerged in recent years and have garnered extensive attention due to their ability to compromise a system while leaving little or no trace of their presence to traditional forensic techniques. Typically, file-less malware has been observed in the context of Exploit Kits such as Angler. Palo Alto Networks has observed a recent high-threat spam campaign that is serving malicious macro documents used to execute PowerShell scripts which injects malware similar to the Ursnif family directly into memory. We call the malware PowerSniff.

Created: 2026-02-23

Indicators

• FileHash-SHA256 - 2c21dafcb4f50cae47d0d4314810226cba3ee4e61811f5c778353c8eac9ba7dc -
• domain - letterinklandoix.net -
• FileHash-SHA256 - 247511ab6d7d3820b9d345bb899a7827ce62c9dd27c538c75a73f5beba6c6018 -
• FileHash-SHA256 - f204c10af7cdcc0b57e77b2e521b4b0ac04667ccffce478cb4c3b8b8f18e32a2 -
• FileHash-SHA256 - 340f82a198aa510159989058f3f62861de74135666c50060491144b7b3ec5a6f -
• FileHash-SHA256 - 815bd46e66f1d330ed49c6f4a4e570da2ec89bcd665cedf025028a94d7b0cc1e -
• FileHash-SHA256 - 5d215ef3affe320efe4f5034513697675de40ba8878ca82e80b07ad1b8d61ed8 -
• FileHash-SHA256 - a8663becc17e34f85d828f53029ab110f92f635c3dfd94132e5ac87e2f0cdfc3 -
• FileHash-SHA256 - 83e305724e9cd020b8f80535c5dd897b2057cee7d2bb48461614a37941e78e3a -
• FileHash-SHA256 - a1770a7671679f13601e75a7cb841fea90c7add78436a0bea875ce50b92afc33 -
• FileHash-SHA256 - 1e746ba37c56f7f2422e6e01aa6fde6f019214a1e12475fe54ee5c2cf1b9f083 -
• domain - oklinjgreirestacks.biz -
• FileHash-SHA256 - 708374a4dfaaa8e44ee217ca5946511cacec55da5eabb0feb1df321753258782 -
• FileHash-SHA256 - 30cd5d32bc3c046cfc584cb8521f5589c4d86a4241d1a9ae6c8e9172aa58ac73 -
• FileHash-SHA256 - 136379754edd05c20d5162aed7e10774a95657f69d4f9a5de17a8059c9018aa6 -
• FileHash-SHA256 - f45bf212c43d1d30cc00f64b3dcae5c35d4a85cacd9350646f7918a30af1b709 -
• hostname - www.starwoodhotels.pw -
• FileHash-SHA256 - 74ec24b5d08266d86c59718a4a476cfa5d220b7b3c8cc594d4b9efc03e8bee0d -
• FileHash-SHA256 - 7e22ea4e06b8fd6698d224ce04b3ef5f00838543cb96fb234e4a8c84bb5fa7b3 -
• domain - supratimewest.com -
• domain - brookmensoklinherz.org -
• FileHash-SHA256 - 0661c68e6c247cd6f638dbcac7914c826a5feee1013e456af2f1f6fd642f4147 -
• domain - supratimewest.biz -
• FileHash-SHA256 - 90a7951683a5a77a21d4a544b76e2e6ee04e357d2f5bfcff01cd6924906adf77 -

類似Pulses

• Malicious macro using a sneaky new trick (score: 0.71)
• Aggressive Malware Pushers: Prolific Cyber Surfers Beware (score: 0.68)
• Powershell Downloaders (score: 0.67)
• Enterprises Hit by BARTALEX Macro Malware (score: 0.66)
• Evoltin POS Malware Attacks via Macro (score: 0.66)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る