Powercat Infostealer Campaign: Fake Game Cheats Deliver Discord Session Hijacking & Crypto Theft — OTX Pulse Analysis

---
title: Powercat Infostealer - Fake Game Cheat Initial Execution and Persistence
id: 7f3a1c2e-9b4d-4e1a-a5c6-p0wercat0001
status: experimental
description: Detects execution of suspicious game-cheat-themed executables from user-writable directories followed by registry Run-key persistence, consistent with Powercat Stage-1 behavior.
author: Security Arsenal Threat Intelligence
references:
  - https://www.threatlocker.com/blog/powercat-malware-campaign-fake-game-cheats-deliver-infostealer-targeting-discord-roblox-and-crypto-wallets
logsource:
  category: process_creation
  product: windows
detection:
  selection_paths:
    Image|startswith:
      - 'C:\Users\'
      - 'C:\ProgramData\'
      - 'C:\Windows\Temp\'
  selection_names:
    OriginalFileName|contains:
      - 'cheat'
      - 'hack'
      - 'aimbot'
      - 'roblox'
      - 'minecraft'
      - 'gta'
  condition: selection_paths and selection_names
falsepositives:
  - Legitimate modding tools executed by developers (rare in enterprise)
level: high
tags:
  - attack.execution
  - attack.t1059
  - attack.t1204.002
date: 2026/08/11
---
title: Powercat Infostealer - Java Loader Execution From User Directories
id: 7f3a1c2e-9b4d-4e1a-a5c6-p0wercat0002
status: experimental
description: Detects java.exe/javaw.exe executing JAR files from user-writable or temp paths spawned by a non-Java parent process, matching the Powercat multi-stage Java loader pattern.
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
detection:
  selection_java:
    Image|endswith:
      - '\java.exe'
      - '\javaw.exe'
  selection_jar:
    CommandLine|contains:
      - '-jar'
  selection_paths:
    CommandLine|contains:
      - '\AppData\'
      - '\Temp\'
      - '\Downloads\'
      - 'C:\ProgramData\'
  filter_minecraft:
    CommandLine|contains:
      - 'minecraft'
      - '.minecraft'
  condition: selection_java and selection_jar and selection_paths and not filter_minecraft
falsepositives:
  - Minecraft launcher (filtered)
  - Legitimate Java applications installed in user profiles
level: high
tags:
  - attack.execution
  - attack.t1059.007
  - attack.defense_evasion
date: 2026/08/11
---
title: Powercat Infostealer - Discord Token Storage Access and C2 Domain
id: 7f3a1c2e-9b4d-4e1a-a5c6-p0wercat0003
status: experimental
description: Detects non-Discord processes reading Discord leveldb Local Storage (token theft) and DNS/connection attempts to known Powercat infrastructure.
author: Security Arsenal Threat Intelligence
logsource:
  category: file_event
  product: windows
detection:
  selection_leveldb:
    TargetFilename|contains:
      - '\discord\Local Storage\leveldb\'
      - '\discordcanary\Local Storage\leveldb\'
      - '\discordptb\Local Storage\leveldb\'
  filter_legit:
    Image|endswith:
      - '\Discord.exe'
      - '\DiscordCanary.exe'
      - '\DiscordPTB.exe'
      - '\msedgewebview2.exe'
  condition: selection_leveldb and not filter_legit
falsepositives:
  - Backup software scanning user profiles
  - EDR/AV scanners (allowlist by process hash)
level: critical
tags:
  - attack.credential_access
  - attack.t1552.001
  - attack.t1539
date: 2026/08/11

// Powercat Infostealer Hunt — Microsoft Sentinel
// Hunts C2 domain contact, Java loader execution, and suspicious cheat-themed process launches
let lookback = 14d;
let powercat_iocs = dynamic(["powercat.dog"]);
let NetworkHits = DeviceNetworkEvents
| where TimeGenerated >= ago(lookback)
| where RemoteUrl has_any (powercat_iocs) or RemoteIP in (powercat_iocs)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort, ActionType
| extend Hunt = "Powercat C2 Contact";
let DnsHits = DeviceEvents
| where TimeGenerated >= ago(lookback)
| where ActionType == "DnsQueryResponse"
| where AdditionalFields has_any (powercat_iocs)
| project TimeGenerated, DeviceName, InitiatingProcessFileName = FileName, AdditionalFields
| extend Hunt = "Powercat DNS Resolution";
let JavaLoader = DeviceProcessEvents
| where TimeGenerated >= ago(lookback)
| where FileName in~ ("java.exe", "javaw.exe")
| where ProcessCommandLine has "-jar"
| where ProcessCommandLine has_any ("\\AppData\\", "\\Temp\\", "\\Downloads\\", "ProgramData")
| where ProcessCommandLine !has_any (".minecraft", "minecraft launcher")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| extend Hunt = "Suspicious Java Loader (Powercat Stage-2)";
let CheatLure = DeviceProcessEvents
| where TimeGenerated >= ago(lookback)
| where FolderPath has_any ("\\Downloads\\", "\\AppData\\", "\\Temp\\")
| where FileName has_any ("cheat", "aimbot", "hack", "roblox", "gta") or ProcessCommandLine has_any ("cheat", "aimbot")
| project TimeGenerated, DeviceName, FileName, FolderPath, ProcessCommandLine, SHA256, InitiatingProcessFileName
| extend Hunt = "Fake Cheat Executable (Powercat Stage-1)";
NetworkHits
| union DnsHits, JavaLoader, CheatLure
| sort by TimeGenerated desc

<#
.SYNOPSIS
    Powercat Infostealer IOC & Artifact Hunt — Security Arsenal
.DESCRIPTION
    Checks endpoints for Powercat campaign artifacts: known file hashes, C2 domain
    connections, suspicious Run-key persistence, and Java loader JAR droppings.
    Run elevated. Output: console + CSV per host.
#>

$ReportPath = ".\Powercat_Hunt_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv"
$Findings = @()

# --- 1. Known malicious hashes (OTX Pulse: Powercat campaign) ---
$MalHashes = @(
    "a33a96cbd92eef15116c0c1dcaa8feb6eee28a818046ac9576054183e920eeb5",
    "a9b4823a1b2c0702a1eb8a1bf18db2d9c9604d2d2dd98a99f1d388bf7cfa71e3",
    "c0c3a0331b57d10d23a172a79bdf13ab066255de41774e5a19dd8a8e8446e1fa",
    "725567384190916da37957e90bd5892a6b4fbe09",
    "ac5bb68591b4350858878d2184bdac63cedfcb60",
    "1d8e87144890cfe06a208c99a50748f7",
    "ccb902ac93fce95a87d19262ef90688c"
)

Write-Host "[1/5] Hashing executables in high-risk user paths..." -ForegroundColor Cyan
$ScanPaths = @("$env:USERPROFILE\Downloads", "$env:APPDATA", "$env:LOCALAPPDATA\Temp", "C:\ProgramData")
foreach ($p in $ScanPaths) {
    if (Test-Path $p) {
        Get-ChildItem -Path $p -Recurse -Include *.exe,*.jar -ErrorAction SilentlyContinue | ForEach-Object {
            try {
                $h = Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction Stop
                if ($MalHashes -contains $h.Hash.ToLower()) {
                    $Findings += [PSCustomObject]@{Check="Malicious Hash"; Artifact=$_.FullName; Detail=$h.Hash; Severity="CRITICAL"}
                }
            } catch {}
        }
    }
}

# --- 2. Active/historical connections to powercat.dog ---
Write-Host "[2/5] Checking network connections and DNS cache for powercat.dog..." -ForegroundColor Cyan
$DnsHits = Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object { $_.Entry -like "*powercat.dog*" }
if ($DnsHits) {
    $Findings += [PSCustomObject]@{Check="DNS Cache Hit"; Artifact="powercat.dog"; Detail=($DnsHits.Entry -join "; "); Severity="CRITICAL"}
}
$NetHits = Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $_.State -eq "Established" }
foreach ($c in $NetHits) {
    try {
        $ptr = Resolve-DnsName -Name $c.RemoteAddress -Type PTR -ErrorAction Stop
        if ($ptr.NameHost -like "*powercat.dog*") {
            $proc = (Get-Process -Id $c.OwningProcess -ErrorAction SilentlyContinue).ProcessName
            $Findings += [PSCustomObject]@{Check="Active C2 Connection"; Artifact="$($c.RemoteAddress):$($c.RemotePort)"; Detail="Process: $proc (PID $($c.OwningProcess))"; Severity="CRITICAL"}
        }
    } catch {}
}

# --- 3. Run-key persistence referencing cheat/java/user paths ---
Write-Host "[3/5] Auditing Run keys for suspicious persistence..." -ForegroundColor Cyan
$RunKeys = @(
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"
)
foreach ($rk in $RunKeys) {
    if (Test-Path $rk) {
        (Get-ItemProperty $rk).PSObject.Properties | Where-Object {
            $_.Value -match "(?i)(cheat|aimbot|roblox|minecraft|gta|javaw.*-jar|AppData.*\.exe)" -and $_.Name -notmatch "^PS"
        } | ForEach-Object {
            $Findings += [PSCustomObject]@{Check="Suspicious Run Key"; Artifact="$rk\$($_.Name)"; Detail=$_.Value; Severity="HIGH"}
        }
    }
}

# --- 4. Scheduled tasks executing from user-writable paths ---
Write-Host "[4/5] Auditing scheduled tasks..." -ForegroundColor Cyan
Get-ScheduledTask -ErrorAction SilentlyContinue | ForEach-Object {
    $actions = $_.Actions | Where-Object { $_.Execute -match "(?i)(AppData|Temp|Downloads|javaw)" }
    if ($actions) {
        $Findings += [PSCustomObject]@{Check="Suspicious Scheduled Task"; Artifact=$_.TaskName; Detail=($actions.Execute -join "; "); Severity="HIGH"}
    }
}

# --- 5. JAR files dropped in user-writable locations (Java loader staging) ---
Write-Host "[5/5] Searching for staged JAR loaders..." -ForegroundColor Cyan
foreach ($p in @("$env:APPDATA", "$env:LOCALAPPDATA\Temp", "C:\ProgramData")) {
    if (Test-Path $p) {
        Get-ChildItem -Path $p -Recurse -Filter *.jar -ErrorAction SilentlyContinue |
            Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-60) } | ForEach-Object {
            $Findings += [PSCustomObject]@{Check="Recent JAR in User Path"; Artifact=$_.FullName; Detail="Modified: $($_.LastWriteTime)"; Severity="MEDIUM"}
        }
    }
}

# --- Output ---
if ($Findings.Count -gt 0) {
    Write-Host "`n[!] $($Findings.Count) finding(s) — review immediately:`n" -ForegroundColor Red
    $Findings | Sort-Object Severity | Format-Table -AutoSize
    $Findings | Export-Csv -Path $ReportPath -NoTypeInformation
    Write-Host "Report saved: $ReportPath" -ForegroundColor Yellow
} else {
    Write-Host "`n[+] No Powercat artifacts detected on this host." -ForegroundColor Green
}