Google XLoader 2017

XLoader uses process hollowing by injecting itself into the `explorer.exe` process and other files ithin the Windows `SysWOW64` directory.

XLoader can capture keystrokes from the victim machine.

XLoader can use an AutoIT script to decrypt a payload file, load it into victim memory, then execute it on the victim machine.

XLoader uses HTTP and HTTPS for command and control communication.

XLoader can capture screenshots on compromised hosts.

XLoader can collect data stored in the victim's clipboard.

XLoader uses XOR and RC4 algorithms to decrypt payloads and functions. XLoader can be distributed as a self-extracting RAR archive that launches an AutoIT loader.

XLoader can conduct form grabbing, steal cookies, and extract data from HTTP sessions.

XLoader performs timing checks using the Read-Time Stamp Counter (RDTSC) instruction on the victim CPU.

XLoader can initiate a system reboot or shutdown.

XLoader can capture web session cookies and session information from victim browsers.

XLoader establishes persistence by copying its executable in a subdirectory of `%APPDATA%` or `%PROGRAMFILES%`, and then modifies Windows Registry Run keys or policies keys to execute the executable on system start.

XLoader can collect credentials stored in email clients.

XLoader can gather credentials from several web browsers.

XLoader has been delivered as a phishing attachment, including PDFs with embedded links, Word and Excel files, and various archive files (ZIP, RAR, ACE, and ISOs) containing EXE payloads.

XLoader uses anti-debugging mechanisms such as calling `NtQueryInformationProcess` with `InfoClass=7`, referencing `ProcessDebugPort`, to determine if it is being analyzed.