Powload

Powload is a Trojan downloader that can download and install other threats for attacking your computer. Although like most Trojan downloaders, its payload is adjustable broadly, many of its campaigns are using bank account-compromising banking Trojans as the last payload. Windows users should monitor their e-mails for signs of an attack especially carefully and use anti-malware products for removing Powload as soon as possible.

E-mails Carrying a Load of Powerful Trojans

Much of the interest in cyber-security concentrates on the thematic highlights and results of infections, such as the ransoming of files by the Scarab Ransomware or hardware being burnt out by cryptocurrency-mining Trojans. While these threats offer an upfront view of the dangers of neglecting cyber-security, the final consequence isn't more important than the steps between a starting phishing attack and the last threat to appear on a compromised system necessarily. For instance, Powload is one of many cases of a 'middle' step: a Trojan downloader that distributes other threats.

Powload isn't a new Trojan – since 2018, it's been responsible for statistically-significant upticks in the distribution of high-level threats of various types. Out of the different programs that malware experts often find circulating with Powload, banking Trojans are prominent notably, including Bebloh, Snifula (AKA Ursnif), and bots for the Emotet botnet. These highly collectthy Trojans can modify your Web-browsing experience by injecting new data and use different techniques for collecting bank account credentials.

Most Powload infections arrive through e-mail messages. Although some of the technicalities vary between campaigns, Powload uses formatting in its spam messages that target specific nationalities and organizations consistently. Some of the other details of interest that malware experts see include multiple methods of checking the victim's geographical status, steganography exploits for hiding code inside of pictures, and increasingly sophisticated infection methods over time, including file-omitting techniques like memory-hollowing injections.

Rescinding a Mailed Invitation to Being Robbed

Many of the differences between iterations Powload installations, such as the various PowerShell script reconfigurations, are meant for hiding from known security solutions and threat-detecting heuristics. Users are likely of seeing not many differences between these variant attacks, which all employ similar lures that trick the victim into opening an attachment or link. Using outdated software and heedlessly enabling macros are two especially hazardous actions that any employee or casual Web surfer should avoid for their PC's safety.

Many Powload campaigns operate with a high degree of regionalism, such as the Snifula's bank account-hijacking attacks against Japan. With that said, however, various campaigns are ongoing throughout the world at any given time, and most Windows users with internet access can consider themselves as being at risk accurately. Familiarizing oneself with the templates that malware experts often see in spam emails, such as fake invoices, can help with identifying attacks. Anti-malware solutions can combat both the Trojan droppers for Powload, the Trojan downloader, itself, and the banking Trojans that follow it. Manually removing Powload is not appropriate for most users.

Powload is getting updates and advancements as the months go on, as a regularly-improving workhorse of the Black Hat software industry. Since it's not likely for crippling its travel rates in 2019, Windows users will need to keep their eyes open for e-mails that are a little too inviting.