Excerpt
Xloader is a stealer that was built on the FormBook malware family that first emerged in 2016; the rebranded Xloader was introduced in 2020. It is highly sophisticated malware that uses a combination of anti-analysis and obfuscation techniques, and it’s written in pure assembly, so there are minimal compiler artifacts.
The infection chain used in this campaign is widely used to deliver multiple different malware families in a very similar way, with almost identical loader characteristics.
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by d01a.github.io on d01a.github.io.
More from d01a.github.io1
- Aurora Stealerd01a.github.io · Published 12 Apr 2023
On the same topics
- Lorem Ipsum Revisited: ClickFix Pivot & Rapid BrigantineBlueVoyant · Added 25 Oct
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Showboat Malware: Emerging Threats Targeting Telecom ProvidersLumen Black Lotus Labs · Added 25 Oct
- International law enforcement initiate hunt on malware group SocGholishDutch National Police · Published 18 Jun
