sLoad
Aliases: Starslord
- First seen
- 2018-06-01 00:00:00
- Malware type
- downloader, screen-capture
- Family
- Malware family
- Last IoC activity
- 2026-07-11 08:31:22
- Profile updated
- 2026-07-07 13:45:47
Targeted industries: financial-services
Targeted regions: country_code:gb country_code:it
Context
sLoad is a PowerShell downloader that most frequently delivers Ramnit banker and includes noteworthy reconnaissance features. The malware gathers information about the infected system including a list of running processes, the presence of Outlook, and the presence of Citrix-related files. sLoad can also take screenshots and check the DNS cache for specific domains (e.g., targeted banks), as well as load external binaries.
Detection coverage
- 6 YARA rules
Detection rules
- SEKOIA_Crime_Sload_Powershellarchiveexfiltrator_Strings (yara-rule)
- SEKOIA_Crime_Sload_Zip_Archives (yara-rule)
- SEKOIA_Crime_Sload_Vbs_Wsf_Downloader (yara-rule)
- SEKOIA_Crime_Sload_Vbs_Downloader_Strings_2 (yara-rule)
- SEKOIA_Crime_Sload_Scheduledtask_Dropper_Strings (yara-rule)
- SEKOIA_Crime_Sload_Mainpowershellimplant (yara-rule)
Reports & references
- bitdefender.com — Bitdefender Whitepaper Wmi Creat4871 En En Genericuse (report)
- malpedia.caad.fkie.fraunhofer.de — Ps1.Sload (report)
- blog.yoroi.company — The Sload Powershell Threat Is Expanding To Italy (report)
- cert-agid.gov.it — Campagna Sload V 2 9 3 Veicolata Via Pec (report)
- vkremez.com — Lets Learn In Depth Into Latest Ramnit (report)
- isc.sans.edu — 23675 (report)
- cyware.com — New Sload Malware Downloader Being Leveraged By Apt Group Ta554 To Spread Ramnit 7D03F2D9 (report)
- certego.net — Sload Hits Italy Unveil The Power Of Powershell As A Downloader (report)
- Microsoft — Sload Launches Version 2 0 Starslord (report)
- proofpoint.com — Sload And Ramnit Pairing Sustained Campaigns Against Uk And Italy (report)
- blog.minerva-labs.com — Sload Targeting Europe Again (report)
- intrinsec.com — Tlp Clear From Espionage To Psyops Tracking Operations And Infrastructure Of Uacs In 2025 En 1 (report)
- cert-pa.it — Campagna Sload Star Wars Edition Veicolata Via Pec (report)
- threatpost.com — 151120 (report)
- cybereason.com — Banking Trojan Delivered By Lolbins Ramnit Trojan (report)