SSLoad
- First seen
- 2024-01-01 00:00:00
- Malware type
- downloader, loader
- Last IoC activity
- 2026-06-29 10:54:01
- Profile updated
- 2026-07-07 14:56:31
Targeted industries: technology-and-telecommunications
Context
SSLoad is a Rust-based downloader that first emerged in January 2024 and is used to deliver secondary payloads. Early versions of the malware used a first-stage DLL that connected to a Telegram channel named 'SSLoad' to retrieve another URL. It then downloaded a compressed PE file using a hardcoded User-Agent (SSLoad/1.x) and Content-Type over HTTP. The downloaded file was then decompressed and executed directly in memory. The malware has since undergone several updates, including changes to the command-and-control (C2) communication and the supporting executables that load the malware. Recent versions of the malware bypass the first-stage DLL by loading SSLoad directly onto the victim's machine.
Detection coverage
- 1 YARA rules
Detection rules
- MALPEDIA_Win_Ssload_Auto (yara-rule)
Reports & references
- infosec.exchange — 113402246487904714 (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Ssload (report)
- linkedin.com — Urn:Li:Activity:7185786751922192384 (report)
- github.com — 2024 04 15 Ioc For Contact Forms Campaign Ssload Activity.Txt (report)