malware

Starloader S0188

Type: malware
Platform: Windows
Created: 16 January 2018
Last modified: 25 April 2025

Starloader is a loader component that has been observed loading Felismus and associated tools. [1]

TechniquesBottom 7%

TacticBottom 6%

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Starloader MITRE reference S0188

Match Legitimate Resource Name or Location T1036.005 ↗

Starloader has masqueraded as legitimate software update packages such as Adobe Acrobat Reader and Intel.2

Stealth30 detection rules

Deobfuscate/Decode Files or Information T1140 ↗

Starloader decrypts and executes shellcode from a file called Stars.jps.3

Stealth20 detection rules

Standing S0188

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques2Bottom 7%

7th percentile · 93% of 825 ATT&CK software entries have more Enterprise techniques.

Tactic1Bottom 6%

6th percentile · 94% of 825 ATT&CK software entries have more tactics spanned.

Threat group161% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaigns085% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique25med61st pct

61st percentile · 61% of 825 ATT&CK software entries have this many detection rules per technique or fewer.

Tests / technique7med62nd pct

62nd percentile · 62% of 825 ATT&CK software entries have this many atomic tests per technique or fewer.

Data comps / technique7med54% tie · 11 values

54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.

Mitigations / technique1.5med65th pct

65th percentile · 65% of 825 ATT&CK software entries have this many mitigations per technique or fewer.

5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 2 Enterprise techniques.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 42Splunk ESCU (cumulative) · 8

Standing S0188

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
Splunk	The following analytic detects the execution of tools commonly exploited by cybercriminals, such as those used for unauthorized access, network scanning, privilege escalation, password dumping or data exfiltration. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike · Cisco NVM · Cisco	Reconnaissance Active Scanning Stealth Masquerading Match Legitimate Resource Name or Location Credential Access OS Credential Dumping	-	medium	Bhavin Patel, Splunk, sventec, Github Community	2021-07-12	2026-09-22	a51bfe1a-94f0-48cc-b4e4-16a110145893	-
	Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Deobfuscate/Decode Files or Information Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems)	2020-01-29	2023-01-26	e32d4572-9826-4738-b651-95fa63747e8a
Splunk	The following analytic detects the use of CertUtil.exe with the 'decode' argument, which may indicate an attempt to decode a previously encoded file, potentially containing malicious payloads. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Stealth Deobfuscate/Decode Files or Information	-	medium	Michael Haag, Splunk	2021-03-25	2026-10-02	bfe94226-8c10-11eb-a4b3-acde48001122
	Detects deployments of pods within the kube-system namespace, which could be intended to imitate system pods. (...)	Generic	test	-	-	Kubernetes Audit · Kubernetes	Stealth Masquerading Match Legitimate Resource Name or Location	-	medium	Leo Tsaousis (@laripping)	2024-03-26	—	a80d927d-ac6e-443f-a867-e8d6e3897318
	Detects when a user enables DNS-over-HTTPS. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Stealth Deobfuscate/Decode Files or Information Persistence, Defense Impairment Modify Registry	-	medium	Austin Songer	2021-07-22	2023-08-17	04b45a8a-d11d-49e4-9acc-4a1b524407a5
	Detects Winword starting uncommon sub process MicroScMgmt.exe as used in exploits for CVE-2015-1641	Emerging	stable	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Match Legitimate Resource Name or Location	CVE-2015-1641	critical	Florian Roth (Nextron Systems)	2018-02-22	2021-11-27	7993792c-5ce2-4475-a3db-a3a5539827ef
	Detects the creation of a file with the ".dll" extension that has the name of a System DLL in uncommon or unsuspected locations. (...)	Generic	test	file_event	windows	Sysmon	Stealth Masquerading Match Legitimate Resource Name or Location	-	medium	Nasreddine Bencherchali (Nextron Systems)	2024-06-24	—	13c02350-4177-4e45-ac17-cf7ca628ff5e
	Detects the creation of an executable with a system process name in folders other than the system ones (System32, SysWOW64, etc.). (...)	Generic	test	file_event	windows	Sysmon	Stealth Masquerading Match Legitimate Resource Name or Location	-	medium	Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems)	2020-05-26	2026-07-28	d5866ddf-ce8f-4aea-b28e-d96485a20d3d
	Detects a flashplayer update from an unofficial location	Generic	test	proxy	-	-	Initial Access Drive-by Compromise Stealth Masquerading Match Legitimate Resource Name or Location Execution User Execution Malicious File	-	high	Florian Roth (Nextron Systems)	2017-10-25	2022-08-08	4922a5dd-6743-4fc2-8e81-144374280997
	Detects tools and process executions used by Greenbug in their May 2020 campaign as reported by Syma (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Command and Control Ingress Tool Transfer Stealth Masquerading Match Legitimate Resource Name or Location	-	critical	Florian Roth (Nextron Systems)	2020-05-20	2023-03-09	3711eee4-a808-4849-8a14-faf733da3612
	Detects binaries used by the Lazarus group which use system names but are executed and launched from (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Match Legitimate Resource Name or Location	-	high	Trent Liffick (@tliffick), Bartlomiej Czyz (@bczyz1)	2020-06-03	2023-03-10	3f7f5b0b-5b16-476c-a85f-ab477f6dd24b
Splunk	The following analytic detects suspicious Base64 decode operations that may indicate malicious activity, such as data exfiltration or execution of encoded commands. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Stealth Deobfuscate/Decode Files or Information	-	medium	Teoderick Contreras, Splunk	2024-08-12	2026-05-13	5890ba10-4e48-4dc0-8a40-3e1ebe75e737
	Detects suspicious process command line that uses base64 encoded input for execution with a shell	Generic	test	process_creation	linux	Sysmon	Stealth Deobfuscate/Decode Files or Information	-	medium	pH-T (Nextron Systems)	2022-07-26	2023-06-16	ba592c6d-6888-43c3-b8c6-689b8fe47337
	Detects the presence of a base64 version of the shebang in the commandline, which could indicate a m (...)	Generic	test	process_creation	linux	Sysmon	Stealth Deobfuscate/Decode Files or Information	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-09-15	—	fe2f9663-41cb-47e2-b954-8a228f3b9dff
	Detects suspicious process command line that starts with a shell that executes something and finally (...)	Generic	test	process_creation	linux	Sysmon	Stealth Deobfuscate/Decode Files or Information	-	medium	Florian Roth (Nextron Systems)	2022-03-14	2022-07-26	880973f3-9708-491c-a77b-2a35a1921158
	Detects execution of mshta.exe with file types that looks like they do not typically represent HTA ( (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter JavaScript Stealth Deobfuscate/Decode Files or Information Stealth System Binary Proxy Execution Mshta	CVE-2020-1599	high	Diego Perez (@darkquassar), Markus Neis, Swisscom (Improve Rule), Swachchhanda Shrawan Poudel (Nextron Systems)	2019-02-22	2025-05-12	cc7abbd0-762b-41e3-8a26-57ad50d2eea3
	Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. (...)	Generic	test	process_creation	macos	-	Execution Command and Scripting Interpreter Stealth Deobfuscate/Decode Files or Information Execution User Execution	-	medium	Tim Rauch (rule), Elastic (idea)	2022-10-17	—	234dc5df-40b5-49d1-bf53-0d44ce778eca
	Detects a ping command that uses a hex encoded IP address	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Deobfuscate/Decode Files or Information Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems)	2018-03-23	2025-10-17	1a0d4aba-7668-4365-9ce4-6d79ab088dfd
	Detects the use of tail to extract bytes at an offset from an image and then decode the base64 value to create a new file with the decoded content. (...)	Generic	test	process_creation	macos	-	Stealth Deobfuscate/Decode Files or Information	-	high	Joseliyo Sanchez, @Joseliyo_Jstnk	2023-12-20	—	09a910bf-f71f-4737-9c40-88880ba5913d
	Detects binaries that use the same name as legitimate sysinternals tools to evade detection. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Indirect Command Execution Stealth Masquerading Match Legitimate Resource Name or Location Stealth System Binary Proxy Execution	-	medium	frack113, Swachchhanda Shrawan Poudel (Nextron Systems)	2021-12-20	2025-04-12	7cce6fc8-a07f-4d84-a53e-96e1879843c9
	Detects command line patterns used by BlackByte ransomware in different operations	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Impact Data Destruction Stealth Deobfuscate/Decode Files or Information Impact Network Denial of Service	-	high	Florian Roth (Nextron Systems)	2022-02-25	2023-02-08	999e8307-a775-4d5f-addc-4855632335be
	Detects potential commandline obfuscation using known escape characters	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Deobfuscate/Decode Files or Information	-	medium	juju4	2018-12-11	2023-03-03	f0cdd048-82dc-4f7a-8a7a-b87a52b6d0fd
	Detects the execution of msiexec.exe from an uncommon directory	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Match Legitimate Resource Name or Location	-	high	Florian Roth (Nextron Systems)	2019-11-14	2023-02-21	e22a6eb2-f8a5-44b5-8b44-a2dbd47b1144
	Detects the modification of the wsl.exe binary from its installed location. (...)	Generic	experimental	file_event	windows	Sysmon	Stealth Masquerading Match Legitimate Resource Name or Location Stealth System Binary Proxy Execution	-	medium	Liran Ravich, Swachchhanda Shrawan Poudel (Nextron Systems)	2026-05-05	—	2f400434-01e1-416b-b52c-bb5bfbb9eb78
	Detects usage of a base64 encoded "FromBase64String" cmdlet in a process command line	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Deobfuscate/Decode Files or Information	-	high	Florian Roth (Nextron Systems)	2019-08-24	2023-04-06	fdb62a13-9a81-4e5c-a38f-ea93a16f6d7c
	A General detection for specific decompress commands in PowerShell logs. (...)	Generic	test	ps_module	windows	PowerShell	Stealth Deobfuscate/Decode Files or Information	-	informational	Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)	2020-05-02	2022-12-25	1ddc1472-8e52-4f7d-9f11-eab14fc171f5
	Detects two stages of the RedSun post-exploitation process chain that deliver a SYSTEM-level shell to the attacker's interactive session. (...)	Emerging	experimental	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation, Stealth Access Token Manipulation Create Process with Token Stealth Masquerading Match Legitimate Resource Name or Location	-	high	Swachchhanda Shrawan Poudel (Nextron Systems), @unresolvedhost	2026-04-17	—	2ad78473-6978-40f5-b8f1-89c7e1c27a1a
	Detects Windows Defender (EventID 1119 - Remediation Action Failed) flagging TieringEngineService.ex (...)	Emerging	experimental	-	windows	Windows Defender	Defense Impairment Disable or Modify Tools Stealth Masquerading Match Legitimate Resource Name or Location Privilege Escalation, Stealth Process Injection	-	critical	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-17	—	a7c3e5f2-8b1d-4e9a-b6c2-3d7f5e8a9b4c
	Detects the creation of a file named TieringEngineService.exe inside a directory whose path contains (...)	Emerging	experimental	file_event	windows	Sysmon	Stealth Masquerading Match Legitimate Resource Name or Location	-	critical	Swachchhanda Shrawan Poudel (Nextron Systems), @unresolvedhost	2026-04-17	—	f2e4b7d9-5c3a-4f8b-9e1d-7a6c2b3f4e5d
	Detects the creation of scheduled tasks that involve system processes, which may indicate malicious actors masquerading as or abusing these processes to execute payloads or maintain persistence.	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Masquerade Task or Service Match Legitimate Resource Name or Location Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-02-05	—	9f8573c9-22b4-40e3-89c1-72bc2b8d49ab
	Detects filename indicators that contain a specific typo seen used by the Small Sieve malware.	Emerging	test	file_event	windows	Sysmon	Stealth Masquerading Match Legitimate Resource Name or Location	-	high	Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)	2023-05-19	—	39466c42-c189-476a-989f-8cdb135c163a
	Detects the creation of copy of suspicious files (EXE/DLL) to the default GPO storage folder	Generic	test	file_event	windows	Sysmon	Stealth Masquerading Match Legitimate Resource Name or Location	-	medium	elhoim	2022-04-28	—	5f87308a-0a5b-4623-ae15-d8fa1809bc60
	Detects suspicious rules that delete or move messages or folders are set on a user's inbox.	Generic	test	-	-	Azure Risk Detection · Azure	Stealth Deobfuscate/Decode Files or Information	-	high	Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'	2023-09-03	—	ceb55fd0-726e-4656-bf4e-b585b7f7d572
	Detects a suspicious process that is masquerading as the legitimate "svchost.exe" by naming its binary "svchost.exe" and executing from an uncommon location. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Match Legitimate Resource Name or Location	-	high	Swachchhanda Shrawan Poudel	2024-08-07	—	be58d2e2-06c8-4f58-b666-b99f6dc3b6cd
	Detects the creation of a scheduled task using the "-XML" flag with a file without the '.xml' extension. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Match Legitimate Resource Name or Location Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	medium	Swachchhanda Shrawan Poudel, Elastic (idea)	2023-04-20	2024-12-01	dd2a821e-3b07-4d3b-a9ac-929fe4c6ca0c
	Detects C:\Windows\System32\wsl.exe spawning a child wsl.exe process from outside the legitimate WSL install locations. (...)	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Match Legitimate Resource Name or Location Stealth System Binary Proxy Execution	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-05-05	—	88d306e9-8e2d-4025-9768-28757d2732db
	Detects execution of masqueraded wsl.exe binary. (...)	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Match Legitimate Resource Name or Location Stealth System Binary Proxy Execution	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-05-05	—	530576ee-3b62-4bce-9a03-9aac6c61788a
	Detects presence of a potentially xor encoded powershell command	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Deobfuscate/Decode Files or Information Stealth Obfuscated Files or Information	-	medium	Sami Ruohonen, Harish Segar, Tim Shelton, Teymur Kheirkhabarov, Vasiliy Burov, oscd.community, Nasreddine Bencherchali	2018-09-05	2023-01-30	bb780e0c-16cf-4383-8383-1e5471db6cf9
	Detects execution of "wget" to download a ".zip" or ".rar" files from "temp.sh". (...)	Emerging	test	process_creation	linux	Sysmon	Stealth Deobfuscate/Decode Files or Information	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-06-16	—	60d050c4-e253-4d9a-b673-5ac100cfddfb
	Detects execution of "wget" to download a "tar" from an IP address that doesn't have a trusted certificate. (...)	Emerging	test	process_creation	linux	Sysmon	Stealth Deobfuscate/Decode Files or Information	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-06-16	—	23835beb-ec38-4e74-a5d4-b99af6684e91
	Detects the execution of "openssl" to connect to an IP address. (...)	Emerging	test	process_creation	linux	Sysmon	Stealth Deobfuscate/Decode Files or Information	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-06-16	—	60911c07-f989-4362-84af-c609828ef829
	Detects instances of svchost.exe running with an unusual or uncommon command line parameter by excluding known legitimate or common patterns. (...)	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Match Legitimate Resource Name or Location Privilege Escalation, Stealth Process Injection Process Hollowing	-	high	Liran Ravich	2025-11-14	2026-03-23	f17211f1-1f24-4d0c-829f-31e28dc93cdd
	Detects an uncommon svchost parent process	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Match Legitimate Resource Name or Location	-	medium	Florian Roth (Nextron Systems)	2017-08-15	2022-06-28	01d2e2a1-5f09-44f7-9fc1-24faa7479b6d
	Detects the loading of unsigned .node files. (...)	Generic	experimental	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL Stealth Masquerading Match Legitimate Resource Name or Location Execution Shared Modules	-	medium	Jonathan Beierle (@hullabrian)	2025-11-22	2026-08-27	e5f5c693-52d7-4de5-88ae-afbfbce85595
Splunk	The following analytic identifies a LOLBAS process being executed outside of it's expected location. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Match Legitimate Resource Name or Location Stealth System Binary Proxy Execution Rundll32	-	medium	Steven Dick	2024-05-03	2026-09-22	326fdf44-b90c-4d2e-adca-1fd140b10536
Splunk	The following analytic detects potential MSC EvilTwin loader exploitation, which manipulates directory paths with spaces to bypass security controls. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution Exploitation for Client Execution Stealth Masquerading Match Legitimate Resource Name or Location Stealth System Binary Proxy Execution	CVE-2025-26633	medium	Michael Haag, Splunk	2025-04-17	2026-05-13	7f6b8a95-3fb7-429a-8c53-e5d4f8d92a10
Splunk	The following analytic identifies processes running from file paths within the ProgramData directory (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Stealth Masquerading Match Legitimate Resource Name or Location	-	medium	Teoderick Contreras, Splunk	2021-05-07	2026-06-08	237016fa-d8e6-47b4-80f9-70c4d42c72c0
Splunk	The following analytic identifies processes running from %temp% directory file paths. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Persistence, Privilege Escalation Create or Modify System Process Stealth Masquerading Match Legitimate Resource Name or Location	-	medium	Teoderick Contreras, Splunk	2021-05-07	2026-09-01	f6fbe929-4187-4ba4-901e-8a34be838443
	Detect suspicious parent processes of well-known Windows processes	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Rename Legitimate Utilities Match Legitimate Resource Name or Location	-	low	vburov	2019-02-23	2025-03-06	96036718-71cc-4027-a538-d1587e0006a7
Splunk	The following analytic identifies processes running from file paths not typically associated with legitimate software. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Persistence, Privilege Escalation Create or Modify System Process Stealth Masquerading Match Legitimate Resource Name or Location	-	medium	Teoderick Contreras, Splunk	2021-05-07	2026-09-01	ecddae4e-3d4b-41e2-b3df-e46a88b38521

Title

Description