A latest PowerShell downloader has been discovered – the sLoad downloader – which is being utilized in quiet, highly targeted attacks in the UK and Italy. The sLoad downloader executes a wide variety of checks to find out a lot of information concerning the system on which it lives, before selecting the most suitable malevolent payload to position – if a payload is positioned at all.
The sLoad downloader was first identified in May 2018 when it was mainly being used to download the Ramnit banking Trojan, even though more lately it has been providing a much wider variety of malevolent payloads including Ursnif, PsiBot, DarkVNC, and Gootkit, as per safety scientists at Proofpoint who have been studying the danger.
The malware is assumed to be the work of a threat actor known as TA554 that Proofpoint has been tracing for over a year. sLoad is being used in greatly targeted attacks, mostly in the United Kingdom and Italy, even though the group also often targets Canadian companies.
sLoad is part of an increasing type of silent writings that are being developed to carry out silent attacks and improve the quality of infected hosts. Among the difficulties with infecting as many machines as possible is the attacks are loud and are quickly noticed, providing safety researchers plenty of time to study malware, add signatures to AV software, and develop repairs.
Although the spray and pray method of infecting as many end users as possible carries on, particularly by affiliates signed up to use ransomware-as-a-service, there has been a rising tendency over the last few months of a much quieter type of malware – Malware that stays under the detector for longer and goes to great lengths to discover more about a system prior to attacks are started.
Infection mainly happens through spam electronic mails, which are cautiously created, written in the targeted nation’s language, and contain tailored information such as the target’s name and address to add reliability. The most usual subjects and message subjects are missed package distributions and purchase orders, which are detailed in documents attached to the electronic mails. Hyperlinks are also utilized to connect to zip files having the documents. The documents have malevolent macros that start PowerShell writings, which download the sLoad downloader.
The threat group extensively utilizes geofencing at all points in the infection series. This limits infection to particular places as well as orders what actions are taken when a host is infected. This is specifically important when the final payload is a banking Trojan. Banking Trojans aim country-specific banks and use precise web injects for those attacks.
The sLoad downloader examines to define if specific safety procedures are running on a system, and will leave if those procedures are found. A list of all running procedures will be gathered and sent back to its C2 server together with details of Citrix-related .ICA files, Outlook files, and a wide variety of other system information. sLoad will also test browsing histories to decide whether the user has earlier visited banks that are being aimed and will report back on its findings.
If the infected appliance has been utilized to access a banking website that Ramnit is aiming, the banking Trojan will be downloaded, even though other malware variations can also be delivered depending on the information found during the reconnaissance stage.
“sLoad, like other downloaders we have described lately, fingerprints infected systems, letting threat actors better select objectives of interest for the payloads of their selection,” wrote Proofpoint. “Downloaders, although, like sLoad, Marap, and others, provide high levels of flexibility to threat actors, whether evading seller sandboxes, providing ransomware to a system that seems mission critical, or providing a banking Trojan to systems with the most likely return.”