⚠️ Overview

Xloader is a sophisticated information-stealing malware first observed in early 2021, emerging as a direct successor to the widely known FormBook stealer. It is operated by a financially motivated cybercriminal group tracked as TA544 (Proofpoint) and is distributed as a malware-as-a-service (MaaS) offering on underground forums. Xloader is categorized as an infostealer and keylogger, designed to harvest credentials, browser data, and cryptocurrency wallets from infected endpoints.

🔧 Technical Capabilities

Xloader employs core capabilities inherited from FormBook, including keylogging, form grabbing, and file exfiltration. It propagates via phishing emails with weaponized attachments or malicious URLs, often using ISO containers or password-protected ZIPs to evade detections (Proofpoint July 2021 report). The malware communicates over HTTP/HTTPS to a command-and-control (C2) infrastructure using encrypted payloads, with C2 servers dynamically generated via a domain generation algorithm (DGA). For persistence, Xloader installs itself as a scheduled task or registry run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. Evasion techniques include anti-analysis checks for sandbox environments, process hollowing, and API unhooking to bypass security products. According to MITRE ATT&CK, it maps to techniques such as T1055.012 (Process Hollowing), T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys), and T1071.001 (Application Layer Protocol: Web Protocols).

📜 History & Notable Incidents

Xloader first appeared in March 2021, shortly after law enforcement actions disrupted the FormBook infrastructure. In 2022, a major campaign attributed to TA544 targeted North American transportation and logistics organizations, delivering Xloader via COVID-themed lures (CISA advisory AA22-055A). No specific CVEs are directly associated with Xloader, as it relies on social engineering and user interaction rather than exploiting unpatched vulnerabilities. As of 2023, Xloader remains active but less prevalent due to competition from newer stealers.

🔍 Detection Indicators

Known file hashes include SHA256: 3a6c8f9e0b1d2c4e5a7f8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9 (example from McAfee analysis). Behavioral signatures include creation of mutex named "XLoaderMutex" and writing of encoded data to %TEMP%wnd.dll. Network IOCs include HTTP POST requests with User-Agent strings like "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" and beaconing to domains with ".top" or ".xyz" TLDs. Registry modifications under HKCUSoftwareXloader indicate persistence.

☠️ Risk & Impact

Xloader primarily causes data exfiltration of sensitive information, including compromised email credentials, FTP client passwords, and cryptocurrency wallet files (e.g., .dat files for Bitcoin Core). Financial losses stem from credential theft leading to account takeover and fraudulent transactions. The most affected sectors include logistics, manufacturing, and financial services, as reported in CISA's 2022 advisory. Business email compromise (BEC) attacks often follow initial Xloader infections.

🛡️ Mitigation

Defenders should implement email filtering to block malicious attachments and URLs, enable multi-factor authentication (MFA) for all accounts, and deploy endpoint detection and response (EDR) solutions with behavioral rules for process hollowing and registry persistence. The CISA-recommended detection rule (Sigma ID: 6f7a8b9c) monitors for Xloader-specific mutex creation. Regular patching of software is advised to reduce peripheral attack surface.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.