{"id":6145,"date":"2025-02-20T14:12:08","date_gmt":"2025-02-20T14:12:08","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/cybercriminals-spread-xloader-via-zips\/"},"modified":"2025-02-20T14:12:09","modified_gmt":"2025-02-20T14:12:09","slug":"cybercriminals-spread-xloader-via-zips","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/cybercriminals-spread-xloader-via-zips\/","title":{"rendered":"Cybercriminals Spread XLoader via ZIPs"},"content":{"rendered":"\n<\/p>\n
\n

\ue802<\/i>February 20, 2025<\/span>\ue804<\/i>Ravie Lakshmanan<\/span><\/span>Cybercrime \/ Malware<\/span><\/p>\n<\/div>\n

\n
\n<\/p>\n

<\/a>\n<\/div>\n

A recent malware campaign has been identified, utilizing the XLoader malware, which employs the DLL side-loading technique<\/a>. This technique leverages a legitimate application associated with the Eclipse Foundation to distribute the malware.<\/p>\n

According to the AhnLab Security Intelligence Center (ASEC), the legitimate application used in the attack is jarsigner, a file created during the installation of the IDE package distributed by the Eclipse Foundation. Jarsigner is a tool used for signing JAR (Java Archive) files.<\/p>\n

The malware is propagated in the form of a compressed ZIP archive that includes the legitimate executable, as well as the DLLs that are sideloaded to launch the malware. These files include:<\/p>\n

\n

\n
\n\"Cybersecurity\"
\n<\/a>
\n<\/center>\n<\/div>\n

Documents2012.exe, a renamed version of the legitimate jarsigner.exe binary, jli.dll, a DLL file modified by the threat actor to decrypt and inject concrt140e.dll, and concrt140e.dll, the XLoader payload.<\/p>\n

The attack chain transitions to the malicious phase when “Documents2012.exe” is executed, triggering the execution of the tampered “jli.dll” library to load the XLoader malware.<\/p>\n

ASEC explained that the distributed concrt140e.dll file is an encrypted payload that is decrypted during the attack process and injected into the legitimate file aspnet_wp.exe for execution.<\/p>\n

The injected malware, XLoader, steals sensitive information, such as the user’s PC and browser information, and performs various activities, including downloading additional malware.<\/p>\n

XLoader, a successor to the Formbook malware, was first detected in the wild in 2020. It is available for sale to other criminal actors under a Malware-as-a-Service (MaaS) model. In August 2023, a macOS version of the information stealer and keylogger was discovered<\/a> impersonating Microsoft Office.<\/p>\n

According to Zscaler ThreatLabz, XLoader versions 6 and 7 include additional obfuscation and encryption layers to protect critical code and information, making it challenging to detect and reverse-engineer.<\/p>\n

\n
\n\"Malware
\n<\/a>\n<\/div>\n

XLoader has introduced techniques that were previously observed in SmokeLoader, including encrypting parts of code at runtime and NTDLL hook evasion.<\/p>\n

Further analysis of the malware revealed its use of hard-coded decoy lists to blend real command-and-control (C2) network communications with traffic to legitimate websites. Both the decoys and real C2 servers are encrypted using different keys and algorithms.<\/p>\n

Similar to other malware families, such as Pushdo<\/a>, the intention behind using decoys is to generate network traffic to legitimate domains to disguise real C2 traffic.<\/p>\n

\n

\n
\n\"Cybersecurity\"\n
Source Link<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

\ue802February 20, 2025\ue804Ravie LakshmananCybercrime \/ Malware A recent malware campaign has been identified, utilizing the XLoader malware, which employs the DLL side-loading technique. This technique leverages a legitimate application associated…<\/p>\n","protected":false},"author":19,"featured_media":6146,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[22],"tags":[46,39,32,31,33,34,35,40,36,37,42,44,43,41,38,45],"class_list":["post-6145","post","type-post","status-publish","format-standard","has-post-thumbnail","category-cybersecurity","tag-computer-security","tag-cyber-attacks","tag-cyber-news","tag-cyber-security-news","tag-cyber-security-news-today","tag-cyber-security-updates","tag-cyber-updates","tag-data-breach","tag-hacker-news","tag-hacking-news","tag-how-to-hack","tag-information-security","tag-network-security","tag-ransomware-malware","tag-software-vulnerability","tag-the-hacker-news"],"jetpack_featured_media_url":"https:\/\/fusionmindlabs.com\/blogs\/wp-content\/uploads\/sites\/9\/2025\/02\/jar-code.png","_links":{"self":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/6145","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/comments?post=6145"}],"version-history":[{"count":1,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/6145\/revisions"}],"predecessor-version":[{"id":6147,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/6145\/revisions\/6147"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media\/6146"}],"wp:attachment":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media?parent=6145"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/categories?post=6145"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/tags?post=6145"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}