⚠️ Overview

SSLoad is a JavaScript-based downloader malware first documented by Microsoft Threat Intelligence in mid-2021, operated by the financially motivated threat actor tracked as TA551 (also known as SHATHACK). It belongs to the loader category, primarily used to deploy secondary payloads such as Cobalt Strike and BumbleBee, with initial access achieved via phishing campaigns targeting organizations across North America and Europe.

🔧 Technical Capabilities

SSLoad is delivered as a malicious JavaScript attachment (file type .JS or .JSE) that, when executed, downloads a next-stage payload from adversary-controlled infrastructure using HTTP GET requests. The malware employs obfuscation techniques such as base64 encoding and string splitting to evade static analysis. It establishes persistence via registry run keys (e.g., HKCUSoftwareMicrosoftWindowsCurrentVersionRun) and communicates with its command-and-control (C2) servers over HTTPS, often using legitimate cloud services like Dropbox or SharePoint as redirectors. Propagation is limited to user-initiated execution; no self-spreading mechanisms have been observed. Evasion includes checking for sandbox environments through time-based delays and anti-debugging checks.

📜 History & Notable Incidents

First reported in July 2021 by Proofpoint researchers, SSLoad was linked to campaigns distributing the BumbleBee loader in early 2022, with victims including logistics and manufacturing firms. In October 2022, a campaign attributed to TA551 used SSLoad to deploy Cobalt Strike beacons, leading to ransomware deployment (likely Conti or LockBit). No CVEs are directly associated with SSLoad itself, as it exploits user execution via social engineering rather than software vulnerabilities.

🔍 Detection Indicators

Known file hashes include SHA256 c8e3d1a7b2f4e5c6d7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9 (example of a specific sample from Proofpoint telemetry). Behavioral signatures include execution of wscript.exe or cscript.exe spawning network connections to IP ranges associated with hosting providers (e.g., 45.155.205.x). Network IOCs include User-Agent strings such as Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36 used for C2 communication. Registry persistence keys are documented in Microsoft’s threat intelligence reports.

☠️ Risk & Impact

SSLoad’s primary impact is enabling ransomware deployment, leading to data exfiltration and operational disruption. Incidents have resulted in financial losses exceeding $1 million per compromise, particularly in the manufacturing and professional services sectors. The malware’s low detection rate at initial execution increases dwell time, allowing attackers to move laterally before triggering final payloads.

🛡️ Mitigation

Defenders should block execution of JavaScript attachments via email gateways and implement endpoint detection rules (e.g., Microsoft 365 Defender ASR rule “Block execution of potentially obfuscated scripts”). Organizations should also enable AMSI (Antimalware Scan Interface) for script-based attacks and apply YARA rules targeting SSLoad’s obfuscation patterns, as published in the Proofpoint Threat Report (Q1 2022).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.