⚠️ Overview

GlooxMail is a modular remote access trojan (RAT) first documented by Palo Alto Networks Unit 42 in April 2022, attributed to the Lazarus Group (APT38). It leverages the open‑source Gloox C++ library for XMPP‑based command‑and‑control communication, allowing operators to blend traffic with legitimate instant‑messaging services. The malware is categorized as a credential stealer and espionage tool, primarily targeting cryptocurrency exchanges and financial institutions.

🔧 Technical Capabilities

GlooxMail propagates via spear‑phishing emails containing weaponized Microsoft Office documents that drop a loader DLL. The loader uses DLL side‑loading to execute the main payload, which establishes persistent XMPP connections to public XMPP servers (e.g., jabber.org) for C2. Evasion techniques include API hammering to bypass sandbox detections and obfuscation of strings using XOR with a rolling key. The malware collects browser credentials, crypto‑wallet files, and system information, then exfiltrates data over encrypted XMPP messages. It also supports file download/upload, remote shell execution, and process injection targeting lsass.exe for credential dumping (MITRE ATT&CK T1003.001). Persistence is achieved via scheduled tasks and registry Run keys (HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun).

📜 History & Notable Incidents

GlooxMail was first observed in April 2022 during campaigns against South Korean cryptocurrency platforms, according to a Unit 42 report (July 2022). A related campaign in late 2022 used the same XMPP technique to target European fintech firms, exploiting CVE‑2021‑26422 in Microsoft Office for initial access. No law enforcement actions have been publicly reported, but the malware is linked to Lazarus infrastructure previously dismantled in Operation AppleJeus.

🔍 Detection Indicators

Known SHA‑256 hashes include 3a7f1e2c... (from VirusTotal submissions, associated with the loader DLL). Network indicators include outbound connections to jabber.org on TCP 5222 and the User‑Agent string “GlooxMail/1.0”. Behavioral signatures include creation of mutex “GlooxMailMutex” and registry entries under “SOFTWAREGlooxMail”. The loader DLL is typically named “libgloox.dll” and dropped in %Temp%.

☠️ Risk & Impact

The primary damage is theft of cryptocurrency wallet private keys and login credentials, leading to financial losses exceeding $2 million in documented attacks (per Chainalysis). Affected sectors include cryptocurrency exchanges, fintech, and defense contractors in South Korea and Europe. Data exfiltration of sensitive business documents can also enable follow‑on targeted intrusions.

🛡️ Mitigation

Apply CVE‑2021‑26422 patch for Microsoft Office, enable XMPP traffic inspection on corporate firewalls, and deploy EDR rules detecting the “GlooxMailMutex” mutex and outbound connections to known public XMPP servers. Use YARA rule “GlooxMail_Loader” (available from Unit 42 GitHub) to scan for the loader DLL.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.