XLoader, a notorious malware from the FormBook family, is masking its malicious activities within seemingly genuine business communications. Recent reports reveal an uptick in XLoader campaigns that utilize fake business orders and price quotes to infiltrate systems.
Malware Disguised as Business Correspondence
These deceptive emails appear routine at first glance, but the attached files initiate a covert sequence that culminates in the execution of XLoader. This malware is adept at extracting stored passwords and other sensitive login information, which it then transmits to the attackers’ servers. Its accessibility as a service makes it a favored tool among cybercriminals.
Research Findings on XLoader Activity
Security experts at Morphisec have documented a notable increase in XLoader incidents, particularly those leveraging business-themed email lures. A common tactic involves emails that seem to continue previous conversations, often starting with “RE:” and urging the recipient to confirm an order. Such emails not only distribute XLoader but also other malware like Agent Tesla and Remcos.
Technical Details of the Attack Mechanism
The emails contain RAR archives that nominally reference order numbers but actually include obfuscated JScript files. When executed, these scripts initiate actions that evade detection by erasing their web-origin markers and unpacking files into the system’s Documents folder. The use of LuaJIT interpreters and Lua scripts further complicates detection, as they operate predominantly in memory, thus bypassing many network filters.
The malware then conceals its presence by embedding itself into legitimate Windows processes. It modifies memory functions to avoid logging and detection, a technique distinct from process hollowing, ensuring that its core operations remain hidden.
Preventative Measures and Security Recommendations
To combat these threats, it is crucial to treat email attachments with caution, especially those containing script files. Blocking JScript files within compressed attachments at the email gateway can mitigate risk. Additionally, monitoring for LuaJIT programs and unusual task scheduling is advisable.
Organizations are urged to implement comprehensive training to enhance staff vigilance against such phishing attempts. Regular updates and patches for software vulnerabilities, particularly in Office applications, are essential in preventing similar exploits.
In the event of infection, immediate password resets for all affected accounts are recommended, given XLoader’s ability to capture login credentials.
By maintaining a proactive defense strategy and integrating threat intelligence, organizations can better protect themselves from the sophisticated approaches employed by XLoader and similar malware.
