Xloader 8.7 Adds Obfuscation and Uses Layered Encryption to Hide C2 Traffic

Summary

A technical analysis of Xloader versions 8.1 onward details harder-to-automate code obfuscation, layered encryption and decoy C2 servers, plus how the malware steals credentials and receives commands to run or download payloads.

Key points

Xloader, descended from Formbook, steals credentials and cookies from browsers and email clients and can execute commands or download additional payloads.
Since version 8.1, Xloader has made function decryption and constant values harder to analyze through out-of-order parameter construction and more complex obfuscation.
The malware communicates over HTTP using raw TCP sockets or Windows WinINet APIs, with different User-Agent behavior.
Multiple RC4 encryption layers and URL-derived keys protect C2 traffic, while 65 candidate C2 IPs—including decoys—complicate identification of real servers.
Network commands can execute scripts or binaries, update or remove Xloader, steal credentials, remove cookies, or reboot or shut down the host.
The analysis covers versions through 8.7 and provides three SHA-256 hashes for Xloader samples.

Article Details

Attack Vectors: Xloader sends HTTP GET requests to retrieve commands and HTTP POST requests to exfiltrate stolen credentials and cookies.
Xloader can download and execute PowerShell scripts, Windows executables, and DLLs, and can execute files already specified in a command.
Xloader steals credentials and cookies from the infected system, including data from browsers and email clients.

Indicators of compromise

Type	Indicator	Context
SHA256	`316fee57d6004b1838576bb178215c99b56a0bd37a012e8650cd2898041f6785`	SHA-256 hash identified for Xloader version 8.7.
SHA256	`59db173fbff74cdab24995a0d3669dabf6b09f7332a0128d4faa68ae2526d39a`	SHA-256 hash identified for Xloader version 8.5.
SHA256	`6b15d702539c47fd54a63bda4d309e06d3c0b92d150f61c0b8b65eae787680be`	SHA-256 hash identified for Xloader version 8.5.

MITRE ATT&CK

T1041 · Exfiltration Over C2 ChannelXloader sends stolen credentials and other collected data to its C2 server in HTTP POST requests.T1059.001 · PowerShellXloader can download and execute PowerShell scripts received through network commands.T1071.001 · Web ProtocolsXloader communicates with C2 servers using HTTP GET and POST requests.T1105 · Ingress Tool TransferXloader can download second-stage payloads, including PowerShell scripts and Windows executable files.T1555.003 · Credentials from Web BrowsersXloader collects credentials and cookies from browsers on the compromised system.

Malware

FormBookXloader is an information stealing malware family that evolved from Formbook and targets web browsers, email clients, and File Transfer Protocol (FTP) applications. Additionally, Xloader may execute arbitrary commands XLoaderXloader is an information stealing malware family that evolved from Formbook and targets web browsers, email clients, and File Transfer Protocol (FTP) applications. Additionally, Xloader may execute arbitrary commands

Tools

Miasman assembly level becomes a tedious task. One tool that can be used when analyzing these changes is the Miasm framework, which can statically lift the obfuscated code and reconstruct the stack properly.