MALWARE FAMILY

sLoad

Internal ID: ps1.sload

aliases

Last seen:Mar 17, 2026

Intelligence Profile

sLoad is a PowerShell downloader that most frequently delivers Ramnit banker and includes noteworthy reconnaissance features. The malware gathers information about the infected system including a list of running processes, the presence of Outlook, and the presence of Citrix-related files. sLoad can also take screenshots and check the DNS cache for specific domains (e.g., targeted banks), as well as load external binaries.

Threat Analysis

sLoad is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://blog.minerva-labs.com/sload-targeting-europe-again

→https://blog.yoroi.company/research/the-sload-powershell-threat-is-expanding-to-italy/

→https://cert-agid.gov.it/news/campagna-sload-v-2-9-3-veicolata-via-pec/

→https://cyware.com/news/new-sload-malware-downloader-being-leveraged-by-apt-group-ta554-to-spread-ramnit-7d03f2d9

→https://isc.sans.edu/forums/diary/Malicious+Powershell+Targeting+UK+Bank+Customers/23675/

→https://threatpost.com/sload-spying-payload-delivery-bits/151120/

→https://www.bitdefender.com/files/News/CaseStudies/study/377/Bitdefender-Whitepaper-WMI-creat4871-en-EN-GenericUse.pdf

→https://www.cert-pa.it/notizie/campagna-sload-star-wars-edition-veicolata-via-pec/

→https://www.certego.net/en/news/sload-hits-italy-unveil-the-power-of-powershell-as-a-downloader/

→https://www.cybereason.com/blog/banking-trojan-delivered-by-lolbins-ramnit-trojan

Quick Facts

TypeMalware Family

Aliases1

Also Known As

ps1.sload

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search sLoad