sload | 4508cbb75ae014ea3eb0f399340f4a03738889e4515a0e012f06d270f832f27a | Triage

Sharing

General

Target

4508cbb75ae014ea3eb0f399340f4a03738889e4515a0e012f06d270f832f27a
Size

62KB
Sample

220520-swa3tahdd7
MD5

06eb1ef4535c6396998c9a99fe18f376
SHA1

18ff5dd40edea78b88f2ee48a6feb1be73b7222b
SHA256

4508cbb75ae014ea3eb0f399340f4a03738889e4515a0e012f06d270f832f27a
SHA512

3f9490f758d8caf8c10a3cf66e1ddbb0e8174840fbd347f98a512b87079a53907993802b3af6aed4213c89fd34a27a38c2d6aef5cbd29687ef937f5098d44079

Score

10^/10

sload stealer trojan

Malware Config

Targets

- Target
  
  FattDiffEmessa2020 00616840120.vbs
- Size
  
  4KB
- MD5
  
  df040acc717de01627876e0ee3fa86df
- SHA1
  
  de8d3e73eaa96d6dc3140b63808fd7fa316cdc08
- SHA256
  
  e96c29490b415926118a9342760a5060070e9dd415aee367cca7a0e5146a45fe
- SHA512
  
  9f563b9eea761dd6ef02db008a130ac207b2e610067489a29dac9f918cdda9ada9130e3b0e26aafb1653ded52f7080fbf2413fff3321c239db46b69839805db9
Score

10^/10

sload stealer trojan
- sLoad
  sLoad is a PowerShell downloader that can exfiltrate system information and deliver additional payloads.
  trojan stealer sload
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

sloadstealertrojan

behavioral2

sloadstealertrojan