Tag: xloader

9 Attack Reports | 0 Vulnerabilities

Attack reports

Latest Xloader Obfuscation Methods and Network Protocol

Xloader is an information stealing malware family that evolved from Formbook and targets web browsers, email clients, and File Transfer Protocol (FTP) applications. Additionally, Xloader may execute arbitrary commands and download second-stage payloads on an infected system. The author of Xloader c…
infostealer
xloader
ftp
2026-04-01
wininet api
Published: April 1, 2026
Downloadable IOCs: 3

Leveraging Generative AI to Reverse Engineer XLoader

This report details how generative AI was used to accelerate the reverse engineering of XLoader malware. The researchers employed a combination of cloud-based static analysis using exported IDA data and occasional dynamic checks via MCP to rapidly unpack encrypted code, deobfuscate API calls, and d…
obfuscation
encryption
malware analysis
chatgpt
reverse engineering
xloader
generative ai
2025-11-03
ioc extraction
Published: November 3, 2025
Downloadable IOCs: 16

Stealthy .NET Malware: Hiding Malicious Payloads as Bitmap Resources

This article discusses a new obfuscation technique used by threat actors to conceal malware within bitmap resources embedded in seemingly benign 32-bit .NET applications. The malware employs a multi-stage process to extract, deobfuscate, load, and execute secondary payloads, ultimately leading to t…
obfuscation
steganography
malspam
.net
agent tesla
remcos rat
multi-stage
xloader
2025-05-09
bitmap
Published: May 9, 2025
Downloadable IOCs: 0

XLoader Info-stealer Distributed Using MS Equation Editor Vulnerability (CVE-2017-11882)

An analysis reveals the distribution of XLoader info-stealer through phishing emails exploiting the MS Equation Editor vulnerability (CVE-2017-11882). The attack begins with a DOCX file containing an RTF document that creates a VBE file in a temporary folder. This VBE file, built using HorusProtect…
phishing
CVE-2017-11882
xloader
info-stealer
2025-05-01
rtf
vbe
ms equation editor
regasm.exe
horusprotector
Published: May 1, 2025
Downloadable IOCs: 0

Cascading Shadows: An Attack Chain Approach to Avoid Detection and Complicate Analysis

A multi-layered attack chain was uncovered in December 2024, employing distinct stages to deliver malware like Agent Tesla variants, Remcos RAT, or XLoader. The campaign uses phishing emails posing as order release requests with malicious attachments. The attack chain leverages multiple execution p…
infostealer
shellcode
autoit
agent tesla
snake keylogger
remcos rat
xloader
2025-04-16
Published: April 16, 2025
Downloadable IOCs: 0

Uncovering .NET Malware Obfuscated by Encryption and Virtualization

This article examines advanced obfuscation techniques used in popular malware families like Agent Tesla, XWorm, and FormBook/XLoader. The techniques include code virtualization, staged payload delivery, dynamic code loading, AES encryption, and multi-stage payloads. The malware uses a three-stage p…
obfuscation
xworm
encryption
.net
formbook
agent tesla
sandbox evasion
xloader
2025-03-03
virtualization
static analysis
Published: March 3, 2025
Downloadable IOCs: 11

Technical Analysis of Xloader Versions 6 and 7 P2

The latest versions of the Xloader malware, known as Formbook, use advanced obfuscation techniques to mask critical parts of its code and data, as part of a two-part technical analysis.
c2 server
formbook
base64
xloader
2025-02-14
c2 traffic
dword xor
dwords
decoy c2
pushdo
Published: February 14, 2025
Downloadable IOCs: 261

Technical Analysis of Xloader Versions 6 and 7

This analysis examines the latest versions of Xloader malware, focusing on its advanced obfuscation techniques. Xloader, successor to Formbook, is an information stealer targeting browsers, email clients, and FTP applications. The malware employs complex encryption layers to protect critical code a…
obfuscation
encryption
formbook
information stealer
process injection
xloader
2025-01-28
api resolution
ntdll hook evasion
Published: January 28, 2025
Downloadable IOCs: 261

Increase in Distribution of AutoIt Compile Malware via Phishing Emails

The distribution of malware compiled with AutoIt has been rapidly increasing, surpassing .NET-type malware. AutoIt, a scripting language for Windows automation, is preferred due to its ease of compilation into EXE files and fewer dependencies. The trend began in August 2024, with AutoIt malware nea…
phishing
infostealer
remcosrat
redline
autoit
agenttesla
2025-01-10
xloader
snakekeylogger
Published: January 10, 2025
Downloadable IOCs: 3
Click here to see more Attack Reports