sLoad Banking Trojan Downloader Displays Sophisticated Recon and Targeting

guest · Oct 24, 2018

sLoad Banking Trojan Downloader Displays Sophisticated Recon and Targeting
The sLoad downloader is an example of the stealthy, smart malware trend
October 24, 2018
https://threatpost.com/sload-bankin...ays-sophisticated-recon-and-targeting/138542/

A new PowerShell downloader dubbed sLoad is making the rounds, sporting impressive reconnaissance tactics and a penchant for geofencing, which indicate increasing sophistication when it comes to targeting efforts.

First spotted in May 2018, sLoad typically delivers the Ramnit banking trojan (but has been seen fetching Gootkit, DarkVNC, Ursnif and PsiXBot as well). The notable aspect is the lengths to which it will go to learn about a target before delivering its payload.

According to a Proofpoint analysis, the malware gathers information about the infected system, including a list of running processes, the presence of Outlook, and the presence of Citrix-related files. It will also take screenshots of the target machine.

“This particular loader is being used by an actor we refer to internally as TA554,” Dawson said.
Click to expand...

guest · Nov 27, 2018

The SLoad Powershell malspam is expanding to Italy
November 27, 2018
https://securityaffairs.co/wordpress/78468/malware/sload-malspam-hit-italy.html

sLoad is a sophisticated script, used in the past to deliver different types of malware such as the dreaded “Ramnit banker”.

“In the past months CERT-Yoroi observed an emerging attack pattern targeting its constituency. These series of malicious email messages shared common techniques may be likely related to a single threat group starting its operation against the Italian cyber panorama.” reads the analysis published by Yoroi.

sLoad implements a broad range of capabilities including the ability to take screenshots, read the list of running process, exfiltrate DNS cache, exfiltrate outlook e-mail and other typical spyware functionalities.
As usual, it comes as a zip file attached to an e-mail [...] complex infection chain [...]
Click to expand...

Technical details, including IoCs and Yara Rules, about the sLoad malware are available on the Yoroi blog.
Click to expand...

guest · Oct 4, 2019

The sLoad Threat: Ten Months Later
October 4, 2019
https://securityaffairs.co/wordpress/92138/malware/sload-italian-attacks.html

According to CERT-PA investigations, the malware has recently been delivered using legit certified emails (PEC). These recent attack waves were targeting Italians Organizations and consultants affiliated to Professional associations, such as lawyers and civil engineers. Once again the attachment is a malicious zip.

For both malware variants, the archive contains a legit image (or pdf) used to deceive the unaware user. Moreover, in the first analyzed variant, the core of the infection is mainly based on powershell scripts and LOLbins. However, the latest stages uses a mix of Powershell and Visual Basic Scripts.
Conclusion
sLoad is keeping evolving their TTPs and represents a vivid threat for the Italian cyber-panorama. Also, many times, especially during the last months, [...]
The plentiful usage of LOLbins, Powershell scripts and SSL encrypted channels, makes detection of this threat difficult for automated systems, and frequently requires analysis abilities or high quality threat intelligence sources to detect and tackle sLoad attack campaigns, many times targeting just a single country.
Click to expand...

guest · Jan 22, 2020

Microsoft discovers new sLoad 2.0 (Starslord) malware
sLoad malware gangs makes a comeback after having operations exposed last month
January 21, 2020
https://www.zdnet.com/article/microsoft-discovers-new-sload-2-0-starslord-malware/

After thoroughly having its secrets laid bare last month in a Microsoft exposé report, the operators of the sLoad malware have put into circulation a revamped 2.0 version earlier this month.

This new sLoad version (also known as Starslord) doesn't change much, but the fact that the sLoad gang shipped a new version in less than a month after having its operations exposed shows the speed at which malware authors often operate.
THE SLOAD MALWARE OPERATION
The sLoad malware is not something new. It's a malware strain that has been around for years. The malware is what someone would call a "malware downloader" or "malware dropper."
SLOAD'S BITS OBSESSION
According to a Microsoft report from December 2019, sLoad had become one of the few malware strains that ported its entire host-server communications systems to the Windows BITS service.
Click to expand...

A NEED TO CHANGE MODUS OPERANDI
Microsoft's report from last month exposed sLoad's capabilities and increased awareness among cyber-security vendors about the malware's modus operandi.
However, if the sLoad gang was hoping to stay one step ahead of Microsoft, they didn't succeed, as the company published another exposé today detailing the new v2.0 in a similar depth as v1.0 last month.

Either way, Microsoft seems to be on top of the recent sLoad updates, and its latest technical report should help other vendors keep up with detecting this new version as well.
Click to expand...

Microsoft: sLoad launches version 2.0, Starslord

The new version comes on the heels of a comprehensive blog we published detailing the malware’s multi-stage nature and use of BITS as alternative protocol for data exfiltration and other behaviors.

With the new version, sLoad has added the ability to track the stage of infection on every affected machine. Version 2.0 also packs an anti-analysis trick that could identify and isolate analyst machines vis-à-vis actual infected machines.
We’re calling the new version “Starslord” based on strings in the malware code, which has clues indicating that the name “sLoad” may have been derived from a popular comic book superhero.
Click to expand...

guest · Jun 21, 2021

Sload Targeting Europe Again
June 21, 2021
https://blog.minerva-labs.com/sload-targeting-europe-again

Sload (also known as Starslord loader) is one of the most dangerous types of malware in recent years. It usually functions as a downloader, which is a computer virus that collects and exfiltrates information from the infected device, with the purpose of assessing the target and dropping a more significant payload if the target seems profitable.

Minerva Labs have seen Sload infections coming from Italian endpoints this year, aligning with the information provided in this tweet. The script we encountered is an obfuscated WSF script that decodes a set of malicious commands, and once executed, will stealthily download and run a remote payload in memory.
This is achieved using a simple evasion technique, the script renames legitimate Windows binaries. Both “bitsadmin.exe” and “Powershell.exe” are copied and renamed, the former is used to download a malicious PowerShell script and the latter loads it to memory and begins its execution.
Click to expand...

Log in or Sign up

sLoad Banking Trojan Downloader Displays Sophisticated Recon and Targeting

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

sLoad Banking Trojan Downloader Displays Sophisticated Recon and Targeting

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches