Hackers Hide XLoader Malware in Fake Business Orders to Steal Passwords and Evade Detection

A new XLoader malware campaign is landing in inboxes as ordinary business orders and price quote requests. The emails look routine, but the attached archive holds a script that starts a chain of hidden steps.

The chain ends with the XLoader password stealer running inside a trusted Windows program. XLoader is an information stealer from the FormBook family.

It takes saved passwords, browser cookies and other login data, then sends them to servers run by the attackers. Criminals favor it because it is sold as a service, so almost anyone can buy and use it.

Researchers at Morphisec noted that they have seen more XLoader activity in recent months, built around many business-themed email lures.

One chain they studied begins with a Greek-language email that asks the reader to confirm order 001828. The subject starts with “RE:”, which makes it look like part of an ongoing conversation. The same campaign also delivered Agent Tesla, Remcos and XWorm.

Hackers Hide XLoader Malware in Fake Business Orders

The message is short and asks the reader to review the attached order and reply quickly. It was sent to “undisclosed-recipients,” so no single target is known.

The attached RAR archive repeats the order number, but it holds one obfuscated JScript file instead of a document. Morphisec also saw Slovenian and quotation-themed emails with the same type of attachment.

When the victim opens the script, Windows Script Host runs it. The script tries to wipe its own Zone.Identifier stream, which is the mark Windows uses to flag files that came from the internet.

It then unpacks two files from its own body into the Documents folder: a LuaJIT interpreter and a Lua program with no file extension. Nothing is downloaded at this stage, so network filters have little to catch. The script launches the interpreter in a hidden window.

The Lua program hides its console window and tries to blind security tools. It searches memory for the AMSI scanning functions and tries to erase their names. It also tries to overwrite 12 functions in ntdll, including several that Windows uses for event tracing, so that logging fails.

Morphisec says this shows the loader’s intent, and it did not observe the patches working on a real host. Many other campaigns have used fake orders as bait, as in the Cascading Shadows attack chain that also delivered XLoader.

Memory-Only Tricks That Help XLoader Evade Detection

Next, the Lua loader decodes a large hidden blob and loads it straight into memory as a packed program. This packed program has no import table, so it looks bare to scanners.

It finds the Windows functions it needs by itself and decrypts the XLoader core with RC4 encryption. Only the script, the interpreter and the Lua file ever touch the disk. Everything after that lives in memory.

XLoader then picks a 32-bit Windows program to hide in. The 12 candidates include cleanmgr.exe, clip.exe, getmac.exe, mshta.exe, ftp.exe and find.exe.

It creates a shared memory section that both programs can see, copies itself in and changes the target thread so it runs the new code.

Morphisec says this is not process hollowing, because the host program’s original image stays in place. The method also avoids the common WriteProcessMemory call that many tools watch for. The core code is encrypted too, and it decrypts a key routine only while that routine runs.

Once active, XLoader can read Windows Vault entries and prepare cookie records for theft. Its settings list 64 possible hosts plus one more, and it starts with 16 of them.

Many are decoys, so the list alone does not reveal the real server. Earlier reporting showed that XLoader has upgraded its obfuscation tactics in the same way. Zscaler ThreatLabz has also documented XLoader’s network protocol, and Morphisec says this sample matches that design.

Treat archives with script files inside as suspicious, even when the email mentions a real-looking order number. Block JS files in RAR and ZIP attachments at the mail gateway.

Watch for LuaJIT programs with random names starting from the Documents folder. Also look for scheduled tasks named EHFTUOMQDRXVTJSF, which the loader can create to run every ten minutes if a marker file exists.

Defenders should also correlate the order-themed script with the dropped files, changes to ntdll functions, and a shared memory mapping followed by a thread context change.

The same lure style has long worked for criminals. One older campaign sent fake SharePoint notification emails to spread XLoader. Staff training and attachment filtering therefore remain the cheapest defenses.

Since XLoader steals saved logins, any infected machine needs a full password reset for browser and email accounts. Another campaign used an Equation Editor vulnerability campaign to reach the same goal, so patching old Office flaws still matters.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Hide XLoader Malware in Fake Business Orders to Steal Passwords and Evade Detection appeared first on Cyber Security News.