H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

PowerShower

[PowerShower](https://attack.mitre.org/software/S0441) is a PowerShell backdoor used by [Inception](https://attack.mitre.org/groups/G0100) for initial reconnaissance and to download and execute second stage payloads.(Citation: Unit 42 Inception November 2018)(Citation: Kaspersky Cloud Atlas August 2019)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[PowerShower](https://attack.mitre.org/software/S0441) is a PowerShell backdoor used by [Inception](https://attack.mitre.org/groups/G0100) for initial reconnaissance and to download and execute second stage payloads.(Citation: Unit 42 Inception November 2018)(Citation: Kaspersky Cloud Atlas August 2019)

Labels

malware
15 recorded

Relationships

uses
from Inception
Group
uses
to Archive via Utility
Technique
uses
to Exfiltration Over C2 Channel
Technique
uses
to File Deletion
Technique
uses
to Hidden Window
Technique
uses
to Modify Registry
Technique
uses
to PowerShell
Technique
uses
to Process Discovery
Technique
uses
to Registry Run Keys / Startup Folder
Technique
uses
to Standard Encoding
Technique
uses
to System Information Discovery
Technique
uses
to System Network Configuration Discovery
Technique
uses
to System Owner/User Discovery
Technique
uses
to Visual Basic
Technique
uses
to Web Protocols
Technique
3 external

References

mitre-attack
S0441
open
Unit 42 Inception November 2018
https://unit42.paloaltonetworks.com/unit42-inception-attackers-target-europe-year-old-office-vulnerability/
open
Kaspersky Cloud Atlas August 2019
https://securelist.com/recent-cloud-atlas-activity/92016/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance