Hackers Hide XLoader Malware in Fake Business Orders to Steal Passwords and Evade Detection

A new XLoader malware campaign is landing in inboxes as ordinary business orders and price quote requests. The emails look routine, but the attached archive holds a script that starts a chain of hidden steps.

The chain ends with the XLoader password stealer running inside a trusted Windows program. XLoader is an information stealer from the FormBook family.

It takes saved passwords, browser cookies and other login data, then sends them to servers run by the attackers. Criminals favor it because it is sold as a service, so almost anyone can buy and use it.

Researchers at Morphisec noted that they have seen more XLoader activity in recent months, built around many business-themed email lures.

One chain they studied begins with a Greek-language email that asks the reader to confirm order 001828. The subject starts with “RE:”, which makes it look like part of an ongoing conversation. The same campaign also delivered Agent Tesla, Remcos and XWorm.

Hackers Hide XLoader Malware in Fake Business Orders

The message is short and asks the reader to review the attached order and reply quickly. It was sent to “undisclosed-recipients,” so no single target is known.

The attached RAR archive repeats the order number, but it holds one obfuscated JScript file instead of a document. Morphisec also saw Slovenian and quotation-themed emails with the same type of attachment.

When the victim opens the script, Windows Script Host runs it. The script tries to wipe its own Zone.Identifier stream, which is the mark Windows uses to flag files that came from the internet.

It then unpacks two files from its own body into the Documents folder: a LuaJIT interpreter and a Lua program with no file extension. Nothing is downloaded at this stage, so network filters have little to catch. The script launches the interpreter in a hidden window.

The Lua program hides its console window and tries to blind security tools. It searches memory for the AMSI scanning functions and tries to erase their names. It also tries to overwrite 12 functions in ntdll, including several that Windows uses for event tracing, so that logging fails.

Morphisec says this shows the loader’s intent, and it did not observe the patches working on a real host. Many other campaigns have used fake orders as bait, as in the Cascading Shadows attack chain that also delivered XLoader.

Memory-Only Tricks That Help XLoader Evade Detection

Next, the Lua loader decodes a large hidden blob and loads it straight into memory as a packed program. This packed program has no import table, so it looks bare to scanners.

It finds the Windows functions it needs by itself and decrypts the XLoader core with RC4 encryption. Only the script, the interpreter and the Lua file ever touch the disk. Everything after that lives in memory.

XLoader then picks a 32-bit Windows program to hide in. The 12 candidates include cleanmgr.exe, clip.exe, getmac.exe, mshta.exe, ftp.exe and find.exe.

It creates a shared memory section that both programs can see, copies itself in and changes the target thread so it runs the new code.

Morphisec says this is not process hollowing, because the host program’s original image stays in place. The method also avoids the common WriteProcessMemory call that many tools watch for. The core code is encrypted too, and it decrypts a key routine only while that routine runs.

Once active, XLoader can read Windows Vault entries and prepare cookie records for theft. Its settings list 64 possible hosts plus one more, and it starts with 16 of them.

Many are decoys, so the list alone does not reveal the real server. Earlier reporting showed that XLoader has upgraded its obfuscation tactics in the same way. Zscaler ThreatLabz has also documented XLoader’s network protocol, and Morphisec says this sample matches that design.

Treat archives with script files inside as suspicious, even when the email mentions a real-looking order number. Block JS files in RAR and ZIP attachments at the mail gateway.

Watch for LuaJIT programs with random names starting from the Documents folder. Also look for scheduled tasks named EHFTUOMQDRXVTJSF, which the loader can create to run every ten minutes if a marker file exists.

Defenders should also correlate the order-themed script with the dropped files, changes to ntdll functions, and a shared memory mapping followed by a thread context change.

The same lure style has long worked for criminals. One older campaign sent fake SharePoint notification emails to spread XLoader. Staff training and attachment filtering therefore remain the cheapest defenses.

Since XLoader steals saved logins, any infected machine needs a full password reset for browser and email accounts. Another campaign used an Equation Editor vulnerability campaign to reach the same goal, so patching old Office flaws still matters.

Indicators of compromise (IoCs):-

Indicator	Type	Context
6d7aaf1e563032ba46d8e0f1c8eab2b91d383fb2e5d00a1d4fff891f78a3572b	SHA-256	EML
78f08bdefb127c96a64229b591de7b3f984a451796ad132cb26ff54c76d073d4	SHA-256	EML
e834ea9cd3025f8070778cf7ef8219976568cc28085feaf974912b64e5b77bc8	SHA-256	RAR attached to both messages
d447a06cba8d3dbe80e09d73dd64576836b258961ee0d3ba56cf26cea7962b49	SHA-256	Dropped LuaJIT executable
685c989f4d89b2402c167075d5d6d6e1f4573c0450adc1de3d8c08c65ed8ee9f	SHA-256	Dropped Lua loader
d87299e4a6457caccb6960c351003cb109748be9ab378cf31611461fce30ac28	SHA-256	Παραγγελί623768193.rar
05ecf6621bc2f2303db6bab33cdc231cb1cd08895b4d089f7410b98b21c38c24	SHA-256	Παραγγελί623768193.rar
78cb203de34c4a4c1961fe0e3700e6c76ab9b8b71dae9e2de408197fbc82733e	SHA-256	Παραγγελία 00182`8.rar |
46e8d2bd454926641176ea67b2e357089ff411c89e524def0158a04b6103d7d4	SHA-256	Naročilo_180SW_2828-501.JS
896a4ddd93ab1d6fda5d57e71c5b2cf5db32970093350a1111396b2e80dc6686	SHA-256	EML
be40d790d265afba64626b4e10fa2ff06e80119eb0056974407cf7d8e834745e	SHA-256	EML
21eb09400f387066649bec4c7fa63e4d4fd2171fb21a2b2ba182941325d76205	SHA-256	ROQ_O 2828-501.zip
38a498b126f8fc799a4f36f37b6d955fba6410d7eb02a9922eb21767897a8769	SHA-256	180SW_2828-501.rar
33dbb7d0c78bfa2e124b78409ecc7152a80016bbcccf39e960a2790d1efb8a22	SHA-256	S0_283723919.JS
08aadfcffb61f90b0d3b34758048e0f699f241216d164c82919a6934488a52e9	SHA-256	Listed without a context label in the source
Παραγγελία 00182`8.rar | Filename | Attachment in both captured EMLs |
Παραγγελία 00182`8.JS | Filename | Sole member of the RAR |
%MyDocuments%\EHFTUOMQDRXVTJSF.exe	File path	Dropped LuaJIT host
%MyDocuments%\FSJTVXRDQMOUTFHE	File path	Dropped Lua loader
%MyDocuments%\EHFTUOMQDRXVTJSF.mui	File path	Conditional persistence marker
%MyDocuments%\FSJTVXRDQMOUTFHE.vbs	File path	VBS launcher for persistence
EHFTUOMQDRXVTJSF	Scheduled task	Conditional persistence task
RE: Παραγγελία 001828	Email subject	Both captured messages
66.113.160.32	IP address	Delivery relay, not C2
focused-albattani.66-113-160-32.plesk.page	Hostname	Delivery infrastructure, not C2
webmail.bekdachegroup.com	Hostname	Received-chain host, not C2
hxxp://iqos-one[.]com/gf2n/	URL	Configured endpoint, slot 1
hxxp://offon33fv[.]club/6yav/	URL	Configured endpoint, slot 2
hxxp://eolienzaer[.]com/jrsi/	URL	Configured endpoint, slot 3
hxxp://tori[.]fi/8yfp/	URL	Configured endpoint, slot 4
hxxp://okbajegame[.]com/l3iy/	URL	Configured endpoint, slot 5
hxxp://komplek[.]id/gkws/	URL	Configured endpoint, slot 6
hxxp://sonhero[.]top/xc0y/	URL	Configured endpoint, slot 7
hxxp://grandseosite91[.]shop/1ud5/	URL	Configured endpoint, slot 8
hxxp://moreultras[.]store/2r3a/	URL	Configured endpoint, slot 9
hxxp://bagolone[.]it/qbqm/	URL	Configured endpoint, slot 10
hxxp://tomatox[.]com[.]tw/upw6/	URL	Configured endpoint, slot 11
hxxp://511mma[.]ru/dnir/	URL	Configured endpoint, slot 12
hxxp://hahashoe[.]com/r0zm/	URL	Configured endpoint, slot 13
hxxp://snvipvn[.]com/v0rc/	URL	Configured endpoint, slot 14
hxxp://revelintravel[.]com/zd56/	URL	Configured endpoint, slot 15
hxxp://www[.]990match[.]com/ccp8/	URL	Configured endpoint, slot 16

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.