{"id":90477,"date":"2020-01-21T10:00:39","date_gmt":"2020-01-21T18:00:39","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/?p=90477"},"modified":"2023-05-15T23:09:50","modified_gmt":"2023-05-16T06:09:50","slug":"sload-launches-version-2-0-starslord","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/21\/sload-launches-version-2-0-starslord\/","title":{"rendered":"sLoad launches version 2.0, Starslord"},"content":{"rendered":"<p>sLoad, the PowerShell-based Trojan downloader notable for its almost exclusive use of the Background Intelligent Transfer Service (BITS) for malicious activities, has launched version 2.0. The new version comes on the heels of a <a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/12\/12\/multi-stage-downloader-trojan-sload-abuses-bits-almost-exclusively-for-malicious-activities\/\">comprehensive blog<\/a> we published detailing the malware\u2019s multi-stage nature and use of BITS as alternative protocol for data exfiltration and other behaviors.<\/p>\n<p>With the new version, sLoad has added the ability to track the stage of infection on every affected machine. Version 2.0 also packs an anti-analysis trick that could identify and isolate analyst machines vis-\u00e0-vis actual infected machines.<\/p>\n<p>We\u2019re calling the new version \u201cStarslord\u201d based on strings in the malware code, which has clues indicating that the name &#8220;sLoad&#8221; may have been derived from a popular comic book superhero.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-90478\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/wp-content\/uploads\/2020\/01\/1-sLoad-2-Starslord-malware-code.png\" alt=\"\" width=\"995\" height=\"141\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/1-sLoad-2-Starslord-malware-code.png 995w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/1-sLoad-2-Starslord-malware-code-300x43.png 300w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/1-sLoad-2-Starslord-malware-code-768x109.png 768w\" sizes=\"(max-width: 995px) 100vw, 995px\" \/><\/p>\n<p>We discovered the new sLoad version over the holidays, in our continuous monitoring of the malware. New sLoad campaigns that use version 2.0 follow an attack chain similar to the previous version, with some updates, including dropping the dynamic list of command-and-control (C2) servers and upload of screenshots.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-90479\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/wp-content\/uploads\/2020\/01\/2-sLoad-2-Starslord-attack-chain.png\" alt=\"\" width=\"1210\" height=\"1019\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/2-sLoad-2-Starslord-attack-chain.png 1210w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/2-sLoad-2-Starslord-attack-chain-300x253.png 300w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/2-sLoad-2-Starslord-attack-chain-768x647.png 768w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/2-sLoad-2-Starslord-attack-chain-1024x862.png 1024w\" sizes=\"(max-width: 1210px) 100vw, 1210px\" \/><\/p>\n<h2>Tracking the stage of infection<\/h2>\n<p>With the ability to track the stage of infection, malware operators with access to the Starslord backend could build a detailed view of infections across affected machines and segregate these machines into different groups.<\/p>\n<p>The tracking mechanism exists in the final-stage, which, as with the old version, loops infinitely (with sleep interval of 2400 seconds, higher than the 1200 seconds in version 1.0). In line with the previous version, at every iteration of the final stage, the malware uses a download BITS job to exfiltrate stolen system information and receive additional payloads from the active C2 server.<\/p>\n<p>As we noted in our previous blog, creating a BITS job with an extremely large RemoteURL parameter that includes non-encrypted system information, as the old sLoad version did, stands out and is relatively easy to detect. However, with Starslord, the system information is encoded into Base64 data before being exfiltrated.<\/p>\n<p>The file received by Starslord in response to the exfiltration BITS job contains a tuple of three values separated by an asterisk (*):<\/p>\n<ul>\n<li>Value #1 is a URL to download additional payload using a download BITS job<\/li>\n<li>Value #2 specifies the action, which can be any of the following, to be taken on the payload downloaded from the URL in value#1:\n<ul>\n<li>\u201ceval\u201d &#8211; Run (possibly very large) PowerShell scripts<\/li>\n<li>\u201ciex\u201d &#8211; Load and invoke (possibly small) PowerShell code<\/li>\n<li>\u201crun\u201d &#8211; Download encoded PE file, decode using <em>exe<\/em>, and run the decoded executable<\/li>\n<\/ul>\n<\/li>\n<li>Value #3 is an integer that can signify the stage of infection for the machine<\/li>\n<\/ul>\n<p>Supplying the payload URL as part of value #1 allows the malware infrastructure to house additional payloads on different servers from the active C2 servers responding to the exfiltration BITS jobs.<\/p>\n<p>Value#3 is the most noteworthy component in this setup. If the final stage succeeds in downloading additional payload using the URL provided in value #1 and executing it as specified by the command in value #2, then a variable is used to form the string <em>\u201ctd\u201d:\u201d&lt;value#3&gt;\u201d,\u201dtds\u201d:\u201d3\u201d<\/em>. However, if the final stage fails to download and execute the payload, then the string formed is <em>\u201ctd\u201d:\u201d&lt;value #3&gt;\u201d,\u201dtds\u201d:\u201d4\u201d<\/em>.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-90480\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/wp-content\/uploads\/2020\/01\/3-sLoad-2-Starslord-infinite-loop.png\" alt=\"\" width=\"975\" height=\"727\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/3-sLoad-2-Starslord-infinite-loop.png 975w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/3-sLoad-2-Starslord-infinite-loop-300x224.png 300w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/3-sLoad-2-Starslord-infinite-loop-768x573.png 768w\" sizes=\"(max-width: 975px) 100vw, 975px\" \/><\/p>\n<p>The infinite loop ensures that the exfiltration BITS jobs are created at a fixed interval. The backend infrastructure can then pick up the pulse from each infected machine. However, unlike the previous version, Starslord includes the said string in succeeding iterations of data exfiltration. This means that the malware infrastructure is always aware of the exact stage of the infection for a specific affected machine. In addition, since the numeric value for value #3 in the tuple is always governed by the malware infrastructure, malware operators can compartmentalize infected hosts and could potentially set off individual groups on unique infection paths. For example, when responding to exfiltration BITS jobs, malware operators can specify a different URL (value #1) and action (value #2) for each numeric value for value #3 of the tuple, essentially deploying a different malware payload for different groups.<\/p>\n<h2>Anti-analysis trap<\/h2>\n<p>Starslord comes built-in with a function named <em>checkUniverse<\/em>, which is in-fact an anti-analysis trap.<\/p>\n<p>As mentioned in our previous blog post, the final stage of sLoad is a piece of PowerShell code obtained by decoding one of the dropped .ini files. The PowerShell code appears in the memory as a value assigned to a variable that is then executed using the Invoke-Expression cmdlet. Because this is a huge piece of decrypted PowerShell code that never hits the disk, security researchers would typically dump it into a file on the disk for further analysis.<\/p>\n<p>The sLoad dropper PowerShell script drops four files:<\/p>\n<ul>\n<li>a randomly named .tmp file<\/li>\n<li>a randomly named .ps1 file<\/li>\n<li>a <em>ini<\/em> file<\/li>\n<li>a <em>ini<\/em> file<\/li>\n<\/ul>\n<p>It then creates a scheduled task to run the .tmp file every 3 minutes, similar to the previous version. The .tmp file is a proxy that does nothing but run the .ps1 file, which decrypts the contents of <em>main.ini<\/em> into the final stage. The final stage then decrypts contents of <em>domain.ini<\/em> to obtain active C2 and perform other activities as documented.<\/p>\n<p>As a unique anti-analysis trap, Starslord ensures that the .tmp and.ps1 files have the same random name. When an analyst dumps the decrypted code of the final stage into a file in the same folder as the .tmp and .ps1 files, the analyst could end up naming it something other than the original random name. When this dumped code is run from such differently named file on the disk, a function named <em>checkUniverse<\/em> returns the value 1, and the analyst gets trapped:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-90481\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/wp-content\/uploads\/2020\/01\/4-sLoad-2-Starslord-anti-analysis-trap.png\" alt=\"\" width=\"964\" height=\"170\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/4-sLoad-2-Starslord-anti-analysis-trap.png 964w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/4-sLoad-2-Starslord-anti-analysis-trap-300x53.png 300w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/4-sLoad-2-Starslord-anti-analysis-trap-768x135.png 768w\" sizes=\"(max-width: 964px) 100vw, 964px\" \/><\/p>\n<p>What comes next is not very desirable for a security researcher: being profiled by the malware operator.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-90482\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/wp-content\/uploads\/2020\/01\/5-sLoad-2-Starslord-profile.png\" alt=\"\" width=\"964\" height=\"113\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/5-sLoad-2-Starslord-profile.png 964w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/5-sLoad-2-Starslord-profile-300x35.png 300w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/5-sLoad-2-Starslord-profile-768x90.png 768w\" sizes=\"(max-width: 964px) 100vw, 964px\" \/><\/p>\n<p>If the host belongs to a trapped analyst, the file downloaded from the backend in response to the exfiltration BITS job, if any, is discarded and overwritten by the following new tuple:<\/p>\n<p style=\"padding-left: 30px;\"><em>hxxps:\/\/&lt;active C2&gt;\/doc\/updx2401.jpg*eval*-1<\/em><\/p>\n<p>In this case, the value #1 of the tuple is a URL that\u2019s known to the backend for being associated with trapped hosts. BITS jobs from trapped hosts don&#8217;t always get a response. If they do, it&#8217;s a copy of the dropper PowerShell script. This could be to create an illusion that the framework is being updated as the URL in value #1 of the tuple suggests (<em>hxxps:\/\/&lt;active C2&gt;\/doc\/updx2401.jpg<\/em>).<\/p>\n<p>However, the string that is included in all successive exfiltration BITS jobs from such host is <em>\u201ctd\u201d:\u201d-1\u201d,\u201dtds\u201d:\u201d3\u201d<\/em>, eventually leading to all such hosts getting grouped under value <em>\u201ctd\u201d:\u201d-1\u201d<\/em>. This forms the group of all trapped machines that are never delivered a payload. For the rest, so far, evidence suggests that it has been delivering the file infector Ramnit intermittently.<\/p>\n<h2>Durable protection against evolving malware<\/h2>\n<p>sLoad\u2019s multi-stage attack chain, use of mutated intermediate scripts and BITS as an alternative protocol, and its polymorphic nature in general make it a piece malware that can be quite tricky to detect. Now, it has evolved into a new and polished version Starlord, which retains sLoads most basic capabilities but does away with spyware capabilities in favor of new and more powerful features, posing even higher risk.<\/p>\n<p>Starslord can track and group affected machines based on the stage of infection, which can allow for unique infection paths. Interestingly, given the distinct reference to a fictional superhero, these groups can be thought of as universes in a multiverse. In fact, the malware uses a function called <em>checkUniverse<\/em> to determine if a host is an analyst machine.<\/p>\n<p><a href=\"https:\/\/www.microsoft.com\/en-us\/security\/technology\/threat-protection\">Microsoft Threat Protection<\/a> defends customers from sophisticated and continuously evolving threats like sLoad using multiple industry-leading security technologies that protect various attack surfaces. Through signal-sharing across multiple Microsoft services, Microsoft Threat Protection delivers comprehensive protection for identities, endpoints, data, apps, and infrastructure.<\/p>\n<p>On endpoints, <a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/10\/08\/in-hot-pursuit-of-elusive-threats-ai-driven-behavior-based-blocking-stops-attacks-in-their-tracks\/\">behavioral blocking and containment capabilities<\/a> in Microsoft Defender Advanced Threat Protection (<a href=\"https:\/\/www.microsoft.com\/en-us\/WindowsForBusiness\/windows-atp\">Microsoft Defender ATP<\/a>) ensure durable protection against evolving threats. Through cloud-based machine learning and data science informed by threat research, Microsoft Defender ATP can spot and stop malicious behaviors from threats, both old and new, in real-time.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p><strong><em>Sujit Magar<\/em><\/strong><\/p>\n<p><em>Microsoft Defender ATP Research Team<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>sLoad has launched version 2.0.  With the new version, sLoad, which is a PowerShell-based Trojan downloader notable for its almost exclusive use of the Windows BITS service for malicious activities, has added an anti-analysis trick and the ability to track the stage of infection for every affected machine. <\/p>\n","protected":false},"author":68,"featured_media":90483,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"ep_exclude_from_search":false,"_classifai_error":"","footnotes":""},"content-type":[3663],"topic":[3687],"products":[],"threat-intelligence":[3727],"tags":[],"coauthors":[1968],"class_list":["post-90477","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","content-type-research","topic-threat-intelligence","threat-intelligence-attacker-techniques-tools-and-infrastructure"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.9 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>sLoad launches version 2.0, Starslord | Microsoft Security Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/21\/sload-launches-version-2-0-starslord\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"sLoad launches version 2.0, Starslord | Microsoft Security Blog\" \/>\n<meta property=\"og:description\" content=\"sLoad has launched version 2.0. With the new version, sLoad, which is a PowerShell-based Trojan downloader notable for its almost exclusive use of the Windows BITS service for malicious activities, has added an anti-analysis trick and the ability to track the stage of infection for every affected machine.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/21\/sload-launches-version-2-0-starslord\/\" \/>\n<meta property=\"og:site_name\" content=\"Microsoft Security Blog\" \/>\n<meta property=\"article:published_time\" content=\"2020-01-21T18:00:39+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-05-16T06:09:50+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/sLoad-2-Starslord-attack-chain-social.png\" \/>\n\t<meta property=\"og:image:width\" content=\"800\" \/>\n\t<meta property=\"og:image:height\" content=\"450\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Microsoft Defender Security Research Team\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/sLoad-2-Starslord-attack-chain-social.png\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Microsoft Defender Security Research Team\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/21\/sload-launches-version-2-0-starslord\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/21\/sload-launches-version-2-0-starslord\/\"},\"author\":[{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/author\/windows-defender-research\/\",\"@type\":\"Person\",\"@name\":\"Microsoft Defender Security Research Team\"}],\"headline\":\"sLoad launches version 2.0, Starslord\",\"datePublished\":\"2020-01-21T18:00:39+00:00\",\"dateModified\":\"2023-05-16T06:09:50+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/21\/sload-launches-version-2-0-starslord\/\"},\"wordCount\":1358,\"publisher\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/21\/sload-launches-version-2-0-starslord\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/sLoad-2-Starslord-blog.jpg\",\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/21\/sload-launches-version-2-0-starslord\/\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/21\/sload-launches-version-2-0-starslord\/\",\"name\":\"sLoad launches version 2.0, Starslord | Microsoft Security Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/21\/sload-launches-version-2-0-starslord\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/21\/sload-launches-version-2-0-starslord\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/sLoad-2-Starslord-blog.jpg\",\"datePublished\":\"2020-01-21T18:00:39+00:00\",\"dateModified\":\"2023-05-16T06:09:50+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/21\/sload-launches-version-2-0-starslord\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/21\/sload-launches-version-2-0-starslord\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/21\/sload-launches-version-2-0-starslord\/#primaryimage\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/sLoad-2-Starslord-blog.jpg\",\"contentUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/sLoad-2-Starslord-blog.jpg\",\"width\":440,\"height\":268},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/21\/sload-launches-version-2-0-starslord\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"sLoad launches version 2.0, Starslord\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\",\"name\":\"Microsoft Security Blog\",\"description\":\"Expert coverage of cybersecurity topics\",\"publisher\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization\",\"name\":\"Microsoft Security Blog\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png\",\"contentUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png\",\"width\":512,\"height\":512,\"caption\":\"Microsoft Security Blog\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"sLoad launches version 2.0, Starslord | Microsoft Security Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/21\/sload-launches-version-2-0-starslord\/","og_locale":"en_US","og_type":"article","og_title":"sLoad launches version 2.0, Starslord | Microsoft Security Blog","og_description":"sLoad has launched version 2.0. With the new version, sLoad, which is a PowerShell-based Trojan downloader notable for its almost exclusive use of the Windows BITS service for malicious activities, has added an anti-analysis trick and the ability to track the stage of infection for every affected machine.","og_url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/21\/sload-launches-version-2-0-starslord\/","og_site_name":"Microsoft Security Blog","article_published_time":"2020-01-21T18:00:39+00:00","article_modified_time":"2023-05-16T06:09:50+00:00","og_image":[{"width":800,"height":450,"url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/sLoad-2-Starslord-attack-chain-social.png","type":"image\/png"}],"author":"Microsoft Defender Security Research Team","twitter_card":"summary_large_image","twitter_image":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/sLoad-2-Starslord-attack-chain-social.png","twitter_misc":{"Written by":"Microsoft Defender Security Research Team","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/21\/sload-launches-version-2-0-starslord\/#article","isPartOf":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/21\/sload-launches-version-2-0-starslord\/"},"author":[{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/author\/windows-defender-research\/","@type":"Person","@name":"Microsoft Defender Security Research Team"}],"headline":"sLoad launches version 2.0, Starslord","datePublished":"2020-01-21T18:00:39+00:00","dateModified":"2023-05-16T06:09:50+00:00","mainEntityOfPage":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/21\/sload-launches-version-2-0-starslord\/"},"wordCount":1358,"publisher":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization"},"image":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/21\/sload-launches-version-2-0-starslord\/#primaryimage"},"thumbnailUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/sLoad-2-Starslord-blog.jpg","inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/21\/sload-launches-version-2-0-starslord\/","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/21\/sload-launches-version-2-0-starslord\/","name":"sLoad launches version 2.0, Starslord | Microsoft Security Blog","isPartOf":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/21\/sload-launches-version-2-0-starslord\/#primaryimage"},"image":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/21\/sload-launches-version-2-0-starslord\/#primaryimage"},"thumbnailUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/sLoad-2-Starslord-blog.jpg","datePublished":"2020-01-21T18:00:39+00:00","dateModified":"2023-05-16T06:09:50+00:00","breadcrumb":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/21\/sload-launches-version-2-0-starslord\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/21\/sload-launches-version-2-0-starslord\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/21\/sload-launches-version-2-0-starslord\/#primaryimage","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/sLoad-2-Starslord-blog.jpg","contentUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/sLoad-2-Starslord-blog.jpg","width":440,"height":268},{"@type":"BreadcrumbList","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/21\/sload-launches-version-2-0-starslord\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/"},{"@type":"ListItem","position":2,"name":"sLoad launches version 2.0, Starslord"}]},{"@type":"WebSite","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/","name":"Microsoft Security Blog","description":"Expert coverage of cybersecurity topics","publisher":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization","name":"Microsoft Security Blog","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png","contentUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png","width":512,"height":512,"caption":"Microsoft Security Blog"},"image":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/"}}]}},"msxcm_display_generated_audio":false,"distributor_meta":false,"distributor_terms":false,"distributor_media":false,"distributor_original_site_name":"Microsoft Security Blog","distributor_original_site_url":"https:\/\/www.microsoft.com\/en-us\/security\/blog","push-errors":false,"_links":{"self":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts\/90477"}],"collection":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/users\/68"}],"replies":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/comments?post=90477"}],"version-history":[{"count":0,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts\/90477\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/media\/90483"}],"wp:attachment":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/media?parent=90477"}],"wp:term":[{"taxonomy":"content-type","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/content-type?post=90477"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/topic?post=90477"},{"taxonomy":"products","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/products?post=90477"},{"taxonomy":"threat-intelligence","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/threat-intelligence?post=90477"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/tags?post=90477"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/coauthors?post=90477"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}