Procedure examples

XLoader uses various packers, including CyaX, to obfuscate malicious executables.

XLoader features encrypted functions using the RC4 algorithm and bytecode operations.

XLoader can identify the username from a victim machine.

XLoader can create scheduled tasks for persistence.

XLoader injects code into the APC queue using `NtQueueApcThread` API.

XLoader uses process hollowing by injecting itself into the `explorer.exe` process and other files ithin the Windows `SysWOW64` directory.

XLoader can capture keystrokes from the victim machine.

XLoader can use an AutoIT script to decrypt a payload file, load it into victim memory, then execute it on the victim machine.

XLoader can delete malicious executables from compromised machines.

XLoader uses HTTP and HTTPS for command and control communication.

XLoader can collect system information and supported language information from the victim machine.

XLoader uses the native Windows API for functionality, including defense evasion.

XLoader can capture screenshots on compromised hosts.

XLoader can collect data stored in the victim's clipboard.

XLoader uses XOR and RC4 algorithms to decrypt payloads and functions. XLoader can be distributed as a self-extracting RAR archive that launches an AutoIT loader.

XLoader can conduct form grabbing, steal cookies, and extract data from HTTP sessions.

XLoader has exploited Office vulnerabilities during local execution such as CVE-2017-11882 and CVE-2018-0798.

XLoader can utilize decoy command and control domains within the malware configuration to circumvent sandbox analysis.

XLoader performs timing checks using the Read-Time Stamp Counter (RDTSC) instruction on the victim CPU.

XLoader can initiate a system reboot or shutdown.

XLoader can capture web session cookies and session information from victim browsers.

XLoader establishes persistence by copying its executable in a subdirectory of `%APPDATA%` or `%PROGRAMFILES%`, and then modifies Windows Registry Run keys or policies keys to execute the executable on system start.

XLoader can collect credentials stored in email clients.

XLoader can gather credentials from several web browsers.

XLoader has been delivered as a phishing attachment, including PDFs with embedded links, Word and Excel files, and various archive files (ZIP, RAR, ACE, and ISOs) containing EXE payloads.

XLoader can utilize hardcoded command and control domain configurations created by the XLoader authors. These are designed to mimic domain registrars and hosting service providers such as Hostinger and Namecheap.

XLoader uses anti-debugging mechanisms such as calling `NtQueryInformationProcess` with `InfoClass=7`, referencing `ProcessDebugPort`, to determine if it is being analyzed.

XLoader loads a copy of NTDLL to evade hooks from security monitoring tools on this library. XLoader can add the path of its executable to the Microsoft Defender exclusion list.