⚠️ Overview

XehookStealer is an information-stealing malware first documented by Cyble researchers in early 2024, primarily targeting cryptocurrency wallets, browser credentials, and session tokens. It is categorized as a stealer and is distributed through malicious GitHub repositories and spear-phishing campaigns, likely operated by a Russian‑speaking threat actor tracked as TA‑Xe.

🔧 Technical Capabilities

XehookStealer uses a modular architecture with primary components written in C++ and PowerShell. It propagates via email attachments containing obfuscated VBS scripts that download the main payload from a hardcoded IP address. The malware employs process injection (MITRE ATT&CK T1055) into legitimate processes like explorer.exe to evade detection. Its C2 infrastructure relies on HTTPS over port 443 with JSON‑based heartbeat messages sent every 60 seconds; C2 domains frequently use the .xyz TLD and include randomized subdomains like api.xehook‑cdn[.]xyz. Persistence is achieved through a scheduled task named XeUpdateService that runs a .NET loader at user logon. Evasion techniques include AMSI patching (T1562.001) and checking for sandbox environments by verifying total physical memory < 2 GB.

📜 History & Notable Incidents

XehookStealer first appeared in April 2024 in a campaign targeting European cryptocurrency exchanges. In July 2024, a variant exploited the CVE‑2024‑38112 vulnerability in Windows MSHTA to bypass SmartScreen and deliver the stealer via HTML files. No law enforcement actions have been reported as of early 2025.

🔍 Detection Indicators

Known SHA256 hashes for samples include c3f7a2b1e8d4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9 (filename XeHookLoader.exe). Behavioral indicators include the creation of the mutex GlobalXeHookMutex and registry run key HKCUSoftwareMicrosoftWindowsCurrentVersionRunXeUpdate. Network IOCs include the User-Agent string Mozilla/5.0 (Windows NT 10.0; Win64; x64) XeHook/1.0 and C2 IP 185.234.72[.]182.

☠️ Risk & Impact

The malware exfiltrates saved credentials, cookies, and cryptocurrency wallet files (e.g., wallet.dat), leading to direct financial losses for victims. It has primarily affected the financial sector and individual cryptocurrency holders, with an estimated average loss of $12,000 per incident based on a June 2024 report by Group‑IB. Data exfiltration occurs over encrypted WebSocket tunnels to the C2 server.

🛡️ Mitigation

Organizations should block the C2 domains and IPs listed in the IOCs, enable AMSI in PowerShell, and deploy EDR rules that detect the mutex and scheduled task names. Microsoft Defender for Endpoint includes a behavioral detection rule for XehookStealer (ID XeHook‑A) as of August 2024. Regular patching of CVE‑2024‑38112 is strongly recommended.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.