{
  "family": "psdownload",
  "sample_count": 41,
  "category": "trojan_downloader",
  "description": "Psdownload (tracked across cybersecurity vendors and endpoint detection platforms under signatures such as TrojanDownloader:PowerShell/Psdownload, Trojan:PowerShell/Psdownload.A, and Trojan:PowerShell/Psdownload!MSR) represents a prolific family of weaponized PowerShell scripts and living-off-the-land (LotL) downloaders active since 2017. Designed to achieve fileless execution or stage secondary malware payloads onto Windows endpoints, Psdownload scripts are typically delivered via phishing emails with macro-enabled Office documents, weaponized ISO/LNK shortcuts, or malvertising redirection chains. Upon execution, the obfuscated PowerShell script executes with execution bypass flags (-ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden), invokes WebClient or Invoke-WebRequest APIs (such as Net.WebClient.DownloadFile or Invoke-RestMethod), and dynamically retrieves encoded secondary payloads—including Cobalt Strike beacons, banking trojans, and ransomware—saving or executing them directly in system memory using AMSI bypass techniques.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "TrojanDownloader:PowerShell/Psdownload",
    "Trojan:PowerShell/Psdownload.A",
    "TrojanDownloader:PowerShell/Psdownload.B",
    "PowerShell/Downloader.Psdownload",
    "Trojan:PowerShell/Psdownload!MSR"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is TrojanDownloader:PowerShell/Psdownload?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Psdownload is a family of malicious PowerShell downloaders that abuse legitimate Windows management utilities to download and execute secondary malware payloads."
      }
    },
    {
      "@type": "Question",
      "name": "How does Psdownload evade PowerShell execution policy restrictions?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Attackers launch the PowerShell process with the '-ExecutionPolicy Bypass' and '-NoProfile' flags, allowing unsigned malicious scripts to run unrestricted."
      }
    },
    {
      "@type": "Question",
      "name": "What payloads are typically delivered by Psdownload?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Threat actors use Psdownload to deploy Cobalt Strike beacons, remote access trojans (RATs), cryptocurrency miners, and ransomware."
      }
    },
    {
      "@type": "Question",
      "name": "How does Psdownload bypass the Antimalware Scan Interface (AMSI)?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It uses in-memory memory patching techniques to overwrite the AmsiScanBuffer function in amsi.dll, preventing Windows Defender from inspecting script contents."
      }
    },
    {
      "@type": "Question",
      "name": "What defensive configurations protect against PowerShell downloaders?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Enable PowerShell Constrained Language Mode, enforce Script Block Logging (Event ID 4104), and deploy attack surface reduction (ASR) rules to block obfuscated scripts."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.001",
    "T1105",
    "T1562.001",
    "T1027.010",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2017,
  "threat_actor": null,
  "delivery_mechanism": [
    "Phishing Emails with Weaponized Office Attachments",
    "Malicious LNK / ISO Files",
    "Compromised Web Portals & Malvertising"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows Server 2022",
    "Windows Server 2019",
    "Windows 7"
  ],
  "capabilities": [
    "Fileless In-Memory Execution",
    "AMSI Bypass Routines",
    "Encrypted WebClient C2 Downloads",
    "Process Injection via Invoke-ReflectivePEInjection",
    "Living-off-the-Land (LotL) Binary Abuse"
  ],
  "technical_analysis": {
    "file_types": [
      "PowerShell Script (.ps1)",
      "Obfuscated Command-Line String"
    ],
    "network_signatures": [
      "Outbound HTTP/HTTPS requests generated by powershell.exe with custom User-Agent headers requesting encoded payload blobs",
      "Direct IP communication over non-standard HTTP ports retrieving secondary stage DLLs"
    ],
    "evasion_techniques": [
      "Base64 encoding and multi-layer variable string substitution",
      "Patching AmsiScanBuffer in memory to neutralize Antimalware Scan Interface telemetry"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "a1b2c3d4e5f67890123456789abcdef012345678",
      "b2c3d4e5f67890123456789abcdef0123456789a"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\PSDownloadStub"
    ],
    "file_paths": [
      "%Temp%\\ps_download_stage.ps1",
      "%AppData%\\WindowsPowerShell\\payload.bin"
    ]
  },
  "defensive_measures": [
    "Enforce PowerShell Constrained Language Mode via AppLocker or Windows Defender Application Control (WDAC)",
    "Enable PowerShell Script Block Logging (Event ID 4104) and Transcription Logging for SIEM analysis",
    "Enable Microsoft Defender Attack Surface Reduction (ASR) rules: 'Block executable content from email client and webmail' and 'Block process creations originating from PSExec and WMI commands'"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - TrojanDownloader:PowerShell/Psdownload",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDownloader:PowerShell/Psdownload"
    },
    {
      "name": "CISA Advisory - Defending Against Living off the Land Techniques",
      "url": "https://www.cisa.gov"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "TrojanDownloader:PowerShell/Psdownload.A",
      "TrojanDownloader:PowerShell/Psdownload.B"
    ]
  },
  "motivation": "Initial Compromise & Multi-Stage Payload Delivery",
  "sample_hashes": []
}