Loading malware…
FormBook is a Windows information-stealing malware family first discovered in 2016. It steals browser-cached credentials, records keystrokes, captures screenshots and clipboard information, and exfiltrates sensitive data to attacker-controlled infrastructure. It can also download and execute additional malicious files. XLoader is a later development of the FormBook lineage.
FormBook is distributed through phishing and spearphishing emails, commonly using purchase orders, invoices, quotations, and shipping-related lures. Attachments include executable-bearing archives and malicious Microsoft Office documents. Document-based campaigns have exploited CVE-2017-0199 and CVE-2017-11882 to initiate multistage delivery chains. GuLoader, NeedleDropper, and Horus Protector have been used to deliver or conceal FormBook payloads.
Observed deployments use encoded scripts, encrypted payloads, registry-backed payload storage, and memory-resident loading to hinder detection. Delivery components inject FormBook into legitimate Windows processes, including through process hollowing. Horus Protector-based deployments have established scheduled-task persistence. Modern XLoader implementations additionally use on-demand code decryption, shared-section process injection with thread-context redirection, and decoy command-and-control endpoints.
FormBook is used by multiple threat actors rather than a single exclusive operator. Its documented users include TA558 and Sweed. Campaigns have targeted maritime organizations and industrial enterprises, with additional activity affecting government, manufacturing, technology, and banking sectors worldwide.
6 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
9 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
“A Word document was attached to the email with a CVE 2017-11882 exploit that called out to kungfrdyeducationalinvestment8agender[.]duckdns[.]org to download another document, and an executable file assessed to be Formbook malware.”
The Guloader file accesses a Google Drive to get the malware payload, FormBook.
常用的攻击工具包括疑似自主开发的office文档公式编辑器漏洞利用工具、恶意office宏制作工具、AgentTesla木马、Formbook木马、Lokibot木马。
These campaigns, detailed in our previous report, distributed payloads that included AgentTesla, Formbook, Lokibot, Netwire and Betabot.
...the delivered payload is in favor of publicly sold malware such as NanoCore, Formbook, etc...
+3 more in the app. View in Mallory
121 distinct techniques documented for this family, organized by ATT&CK tactic.
This attack – known as ‘malvertising’ – is often aimed at users looking to download popular software applications.
SentinelLABS observed a cluster of virtualized .NET malware loaders distributed through malvertising attacks.
[XLoader](https://attack.mitre.org/software/S1207) can utilize hardcoded command and control domain configurations created by the XLoader authors. These are designed to mimic domain registrars and hosting service providers such as Hostinger and Namecheap.(Citation: CheckPoint XLoader 2022)
Observed techniques/sub techniques: Acquire infrastructure - server. The IP address 104[.]244[.]78[.]177 was used to host archives, implants, and scripts.
MITRE ATT&CK TTPs Technique ID Name Notes T1583.006 Acquire Infrastructure: Web Services IPFS used for resilient payload hosting
We first reported about XLoader in April 2018 when it used Domain Name System (DNS) cache poisoning/DNS spoofing to victimize users with malicious Android apps that steal PII and financial data and install additional apps.
Observed techniques/sub techniques: Obtain capabilities - malware and exploits.
Observed techniques/sub techniques: Stage capabilities - upload malware. The server was observed serving archives, implants, and scripts leveraged throughout the campaign variations.
Attackers used PDF lures relying on a simple but effective technique of directing victims to a compromised website that delivers a malicious download, before immediately redirecting them to a legitimate website to create the impression that the trusted platform initiated the download.
The campaigns in Italian analyzed by the TG Soft C.R.A.M. were grouped according to macro categories, obtained from the subject of the email message used for malware distribution (malspam).
[XLoader](https://attack.mitre.org/software/S1207) has been delivered as a phishing attachment, including PDFs with embedded links, Word and Excel files, and various archive files (ZIP, RAR, ACE, and ISOs) containing EXE payloads.(Citation: Google XLoader 2017)(Citation: Acronis XLoader 2021)
or downloaded by a weaponized document attached to an email from RATicate’s C&C infrastructure
From mid-2019 until 2022, the criminals mainly used smishing instead of DNS hijacking to deliver a malicious URL as their landing page.
It establishes persistence, executes a hidden PowerShell stager via WMI...
“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”
[XLoader](https://attack.mitre.org/software/S1207) can create scheduled tasks for persistence.(Citation: Netskope XLoader 2022)
Finally, the DNS changer generates a URL query with the rogue DNS IPs to compromise the DNS settings of the Wi-Fi router, depending on the model
The script job element directs Windows Script Host to spawn a shell that spawns a hidden PowerShell process which runs a Base64 encoded PowerShell script.
WshShell.Run "cmd /c " & runCmd, 0, True
In the Part I of my analysis, I explained how the VBA code in the PowerPoint file was used to download a PowerShell file
It comes with a PHP web-application, used to implement the C&C server.
Pope.txt contained JavaScript code using variable renaming and string obfuscation. Profile.html also contained obfuscated JavaScript and ActiveXObjects.
[XLoader](https://attack.mitre.org/software/S1207) can use an AutoIT script to decrypt a payload file, load it into victim memory, then execute it on the victim machine.(Citation: Google XLoader 2017)
[XLoader](https://attack.mitre.org/software/S1207) uses the native Windows API for functionality, including defense evasion.(Citation: Zscaler XLoader 2025)
In most of the cases observed at the time of writing this article, PhantomVAI Loader injected the payload into the Microsoft Build Engine executable, MSBuild.exe.
Технику применяют сл.вредоносы - все они мапят свои либы с атрибутом SEC_IMAGE для загрузки пайлоада
[XLoader](https://attack.mitre.org/software/S1207) has exploited Office vulnerabilities during local execution such as CVE-2017-11882 and CVE-2018-0798.(Citation: Netskope XLoader 2022)
Office documents encrypted with the password VelvetSweatshop will automatically decrypt themselves when opened in Office.
URLリンクを開いた場合は添付ファイルの場合と同様の不正なファイルがダウンロードされます。
User execution was required to launch and install the executable.
APT38 'has unhooked DLLs to disable endpoint detection and response (EDR) or anti-virus (AV) tools'; Bazar 'has manually loaded ntdll from disk in order to identify and remove API hooks set by security products'; XLoader 'loads a copy of NTDLL to evade hooks from security monitoring tools.'
The core of this campaign lies in the abuse of a legitimate utility... The key vulnerability is that the design of ahost.exe is vulnerable to DLL side-loading or search order hijacking. An attacker can exploit this vulnerability by placing a malicious DLL, named libcares-2.dll, in the same directory as ahost.exe.
Preparing dynamic class Loading dynamic classes is typically done via the DexClassLoader class, from the Android API. To conceal it loads a dynamic class, the malware does not directly call DexClassLoader. Instead, it implements a native library (libgdx.so) that calls DexClassLoader from the native layer.
“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”
[XLoader](https://attack.mitre.org/software/S1207) can create scheduled tasks for persistence.(Citation: Netskope XLoader 2022)
The script tries to modify the following registry keys ... Disables Task Manager ... Turns off the system protection ... Disables UAC
In recent months, we have seen a growth in malware campaigns using malicious Microsoft Excel add-in (XLL) files to infect systems. This technique is tracked in MITRE ATT&CK as T1137.006.
xg66s[.]sbs — Active XLoader gate returning X-Trace encrypted headers on standard gate paths (/frag, /fgds, /j2c3).
FormBook repeatedly launches these processes in a loop until one is successfully created. It then performs process hollowing on the process
Both payloads try to be persistent on the running system either by using the registry key (Windows) or by creating a launch agent (macOS)
« bin.exe est [...] copié sous C:\Program Files (x86)\CouchDB\Uvhvxmv.exe pour persistance. »
[XLoader](https://attack.mitre.org/software/S1207) establishes persistence by copying its executable in a subdirectory of `%APPDATA%` or `%PROGRAMFILES%`, and then modifies Windows Registry Run keys or policies keys to execute the executable on system start.(Citation: Zscaler XLoader 2025)(Citation: Google XLoader 2017)
“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”
[XLoader](https://attack.mitre.org/software/S1207) can create scheduled tasks for persistence.(Citation: Netskope XLoader 2022)
« bin.exe est téléchargé [...] puis injecté dans ROUTE.EXE et autochk.exe. »
Технику применяют сл.вредоносы - все они мапят свои либы с атрибутом SEC_IMAGE для загрузки пайлоада
Данный метод незаслуженно остаётся в тени упомянутого выше. В его основе лежит NtMapViewOfSection() из либы Ntdll.dll, которая используется малварью для скрытой инъекции кода в обход EDR. Технику применяют сл.вредоносы - все они мапят свои либы с атрибутом SEC_IMAGE для загрузки пайлоада
It then calls NtGetContextThread() and NtSetContextThread() to modify the RIP register, redirecting the execution to the injected code.
[XLoader](https://attack.mitre.org/software/S1207) injects code into the APC queue using `NtQueueApcThread` API.(Citation: Zscaler XLoader 2025)
“XLoader uses on-the-fly function decryption… derive head and tail markers… overwrite the markers with six NOP instructions… then transfer execution… After decryption, the code writes a canonical prologue (55 8B EC)… patches the tail with 90 90 90 90.”
[XLoader](https://attack.mitre.org/software/S1207) uses process hollowing by injecting itself into the `explorer.exe` process and other files ithin the Windows `SysWOW64` directory.(Citation: Zscaler XLoader 2025)(Citation: Google XLoader 2017)(Citation: ANY.RUN XLoader 2023)
FormBook repeatedly launches these processes in a loop until one is successfully created. It then performs process hollowing on the process
Both payloads try to be persistent on the running system either by using the registry key (Windows) or by creating a launch agent (macOS)
« bin.exe est [...] copié sous C:\Program Files (x86)\CouchDB\Uvhvxmv.exe pour persistance. »
[XLoader](https://attack.mitre.org/software/S1207) establishes persistence by copying its executable in a subdirectory of `%APPDATA%` or `%PROGRAMFILES%`, and then modifies Windows Registry Run keys or policies keys to execute the executable on system start.(Citation: Zscaler XLoader 2025)(Citation: Google XLoader 2017)
The document is encrypted with the password “VelvetSweatshop”, a common technique employed by multiple threat actors.
Dead Code Injection T1027.001 ~3,700 lines of non-functional AutoIt code obscure ~88 lines of actual payload logic
[XLoader](https://attack.mitre.org/software/S1207) uses various packers, including CyaX, to obfuscate malicious executables.(Citation: Netskope XLoader 2022)
FormBook Malware Returns: New Variant Uses Steganography and In-Memory Loading of multiple stages to steal data
By taking a look at the binary level, we see that XLoader Windows resolves API functions at runtime which is similar to FormBook
The output from olevba indicates there aren’t Visual Basic for Applications (VBA) macros or Excel 4.0 macros present. This leads me into thinking there may be OLE objects involved. We can take a look using oledump.py ... So it looks like we’ve got an OLE object in the spreadsheet
T1027.010 Obfuscated Files or Information: Command Obfuscation PowerShell flags obfuscated in string table
[XLoader](https://attack.mitre.org/software/S1207) features encrypted functions using the RC4 algorithm and bytecode operations.(Citation: Zscaler XLoader 2025)(Citation: ANY.RUN XLoader 2023)
The campaign opened with generic purchase-order spam and from June 11 onward, shifted into two waves forging receipts from Ziraat Bank and Vietcombank.
MITRE ATT&CK Technique ID Usage Masquerading T1036.004 Injection into legitimate RegAsm.exe
A phishing email attachment disguised as a request-for-quote (RFQ 11062026.js)
« bin.exe est téléchargé [...] puis injecté dans ROUTE.EXE et autochk.exe. »
Технику применяют сл.вредоносы - все они мапят свои либы с атрибутом SEC_IMAGE для загрузки пайлоада
Данный метод незаслуженно остаётся в тени упомянутого выше. В его основе лежит NtMapViewOfSection() из либы Ntdll.dll, которая используется малварью для скрытой инъекции кода в обход EDR. Технику применяют сл.вредоносы - все они мапят свои либы с атрибутом SEC_IMAGE для загрузки пайлоада
It then calls NtGetContextThread() and NtSetContextThread() to modify the RIP register, redirecting the execution to the injected code.
[XLoader](https://attack.mitre.org/software/S1207) injects code into the APC queue using `NtQueueApcThread` API.(Citation: Zscaler XLoader 2025)
“XLoader uses on-the-fly function decryption… derive head and tail markers… overwrite the markers with six NOP instructions… then transfer execution… After decryption, the code writes a canonical prologue (55 8B EC)… patches the tail with 90 90 90 90.”
[XLoader](https://attack.mitre.org/software/S1207) uses process hollowing by injecting itself into the `explorer.exe` process and other files ithin the Windows `SysWOW64` directory.(Citation: Zscaler XLoader 2025)(Citation: Google XLoader 2017)(Citation: ANY.RUN XLoader 2023)
This command allows FormBook to clean sensitive data saved on the victim's browsers, such as cookies, credentials, and more. It also deletes some folders and files
[XLoader](https://attack.mitre.org/software/S1207) can delete malicious executables from compromised machines.(Citation: Acronis XLoader 2021)
In most of the cases observed at the time of writing this article, PhantomVAI Loader injected the payload into the Microsoft Build Engine executable, MSBuild.exe.
[XLoader](https://attack.mitre.org/software/S1207) uses XOR and RC4 algorithms to decrypt payloads and functions.(Citation: Zscaler XLoader 2025) [XLoader](https://attack.mitre.org/software/S1207) can be distributed as a self-extracting RAR archive that launches an AutoIT loader.(Citation: Google XLoader 2017)
xg66s[.]sbs — Active XLoader gate returning X-Trace encrypted headers on standard gate paths (/frag, /fgds, /j2c3).
Written natively in the C and Objective C programming languages and signed with an Apple developer signature, XLoader is now masquerading as an office productivity app called ‘OfficeNote’.
One way is to host a file on a server controlled by the attack and use the 44 bytes for a command that accesses that server and executes another binary. For example, the following command uses the mshta executable to run VBscript code from a remote server...
As a result, the extracted 64-bit DLL file, AdobeID.pdf, is executed by rundll32.exe.
[XLoader](https://attack.mitre.org/software/S1207) can utilize decoy command and control domains within the malware configuration to circumvent sandbox analysis.(Citation: ANY.RUN XLoader 2023)(Citation: CheckPoint XLoader 2022)
[XLoader](https://attack.mitre.org/software/S1207) performs timing checks using the Read-Time Stamp Counter (RDTSC) instruction on the victim CPU.(Citation: Google XLoader 2017)
MITRE ATT&CK Technique ID Usage Time-Based Evasion T1497.003 3-second sleep before download
The script changes the cne folder attributes to hide its content by executing the command FileSetAttrib($cne_Folder_Path, "+H")
Threat actors are embedding malicious content into seemingly benign images... The steganography technique obfuscates the malicious content and makes the image appear benign.
PowerShell runs with windowStyle=0 (hidden)
APT38 'has unhooked DLLs to disable endpoint detection and response (EDR) or anti-virus (AV) tools'; Bazar 'has manually loaded ntdll from disk in order to identify and remove API hooks set by security products'; XLoader 'loads a copy of NTDLL to evade hooks from security monitoring tools.'
The core of this campaign lies in the abuse of a legitimate utility... The key vulnerability is that the design of ahost.exe is vulnerable to DLL side-loading or search order hijacking. An attacker can exploit this vulnerability by placing a malicious DLL, named libcares-2.dll, in the same directory as ahost.exe.
Preparing dynamic class Loading dynamic classes is typically done via the DexClassLoader class, from the Android API. To conceal it loads a dynamic class, the malware does not directly call DexClassLoader. Instead, it implements a native library (libgdx.so) that calls DexClassLoader from the native layer.
The PE file is a .Net DLL module that is dynamically deployed by the “Li7f” module... The last thing that the “zOAI” module does is to decrypt another .Net module from a local array variable and then deploys it in the memory as well as invokes its entry method
[XLoader](https://attack.mitre.org/software/S1207) uses anti-debugging mechanisms such as calling `NtQueryInformationProcess` with `InfoClass=7`, referencing `ProcessDebugPort`, to determine if it is being analyzed.(Citation: Google XLoader 2017)
The script tries to modify the following registry keys ... Disables Task Manager ... Turns off the system protection ... Disables UAC
[XLoader](https://attack.mitre.org/software/S1207) loads a copy of NTDLL to evade hooks from security monitoring tools on this library.(Citation: Zscaler XLoader 2025) [XLoader](https://attack.mitre.org/software/S1207) can add the path of its executable to the Microsoft Defender exclusion list.(Citation: Netskope XLoader 2022)
Other features listed include network traffic sniffing, keylogging, clipboard monitoring, and password extraction
once FormBook is inside the Windows process, it injects malicious code into target processes ... from which it steals victim inputs and clipboard data from time to time
[XLoader](https://attack.mitre.org/software/S1207) can capture keystrokes from the victim machine.(Citation: Google XLoader 2017)
XLoader drove a broad browser sweep against banking and brokerage portals ... the target list of a form-grabber.
it maps ntdll.dll in memory to act as a form-grabber that uses an inline hook mechanism to capture information from some browsers.
This feature is used in combination with brute-force attacks on wireless router’s web interfaces to compromise routers and perform DNS hijacking attacks.
[XLoader](https://attack.mitre.org/software/S1207) can capture web session cookies and session information from victim browsers.(Citation: Google XLoader 2017)
Additionally, Xloader steals user credentials or cookies from browsers, logs keystrokes, steals clipboard content, takes screenshots, and sends them to the TA’s C&C server.
[XLoader](https://attack.mitre.org/software/S1207) can collect credentials stored in email clients.(Citation: Google XLoader 2017)(Citation: Netskope XLoader 2022)
[XLoader](https://attack.mitre.org/software/S1207) can gather credentials from several web browsers.(Citation: Zscaler XLoader 2025)(Citation: Google XLoader 2017)(Citation: Netskope XLoader 2022)
T1555.004 Windows Credential Manager ... example detections for Windows Credential Manager Store access by common stealers AgentTesla and FormBook.
The dropped malware is generally able to steal private information, log keyboard strokes and steal browsing data.
For example, it extracts the autofill data for the IE browser from the key path “HKCU\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2” in the system registry.
[XLoader](https://attack.mitre.org/software/S1207) can identify the username from a victim machine.(Citation: Acronis XLoader 2021)
Other features listed include network traffic sniffing, keylogging, clipboard monitoring, and password extraction
When trying to “PWNtcha” a vulnerable router, Moqhao first determines the IP address of the router to request its web-based administration pages. By accessing this default pages, Moqhao can determine the router’s model.
The malware first calls the NtQuerySystemInformation() API with the SystemProcessInformation (0x5) parameter to enumerate all active processes.
[XLoader](https://attack.mitre.org/software/S1207) can collect system information and supported language information from the victim machine.(Citation: Acronis XLoader 2021)
Install manager File browsing (FB Connect) ... Each bot can receive ... FB Connect (file browsing)
[XLoader](https://attack.mitre.org/software/S1207) can utilize decoy command and control domains within the malware configuration to circumvent sandbox analysis.(Citation: ANY.RUN XLoader 2023)(Citation: CheckPoint XLoader 2022)
[XLoader](https://attack.mitre.org/software/S1207) performs timing checks using the Read-Time Stamp Counter (RDTSC) instruction on the victim CPU.(Citation: Google XLoader 2017)
MITRE ATT&CK Technique ID Usage Time-Based Evasion T1497.003 3-second sleep before download
Examples include "Bazar can also check if the Russian language is installed on the infected machine and terminate if it is found," "DropBook has checked for the presence of Arabic language," and "Maze has checked the language of the infected system using the GetUSerDefaultUILanguage function."
[XLoader](https://attack.mitre.org/software/S1207) uses anti-debugging mechanisms such as calling `NtQueryInformationProcess` with `InfoClass=7`, referencing `ProcessDebugPort`, to determine if it is being analyzed.(Citation: Google XLoader 2017)
MITRE ATT&CK® Techniques ... Lateral Movement T1021 Remote Services
The attack chain involves the use of a command that retrieves the payloads from a remote Server Message Block (SMB) open directory.
« L’exfiltration cible les portails bancaires et de courtage (Fidelity, Chase, Bank of America, Schwab, Vanguard, PayPal...). »
once FormBook is inside the Windows process, it injects malicious code into target processes ... from which it steals victim inputs and clipboard data from time to time
[XLoader](https://attack.mitre.org/software/S1207) can capture keystrokes from the victim machine.(Citation: Google XLoader 2017)
XLoader drove a broad browser sweep against banking and brokerage portals ... the target list of a form-grabber.
it maps ntdll.dll in memory to act as a form-grabber that uses an inline hook mechanism to capture information from some browsers.
Self-copy : Script copies itself to C:\Users\Public\Downloads\Name_File.vbs .
[XLoader](https://attack.mitre.org/software/S1207) can capture screenshots on compromised hosts.(Citation: Google XLoader 2017)(Citation: Netskope XLoader 2022)
[XLoader](https://attack.mitre.org/software/S1207) can collect data stored in the victim's clipboard.(Citation: Google XLoader 2017)(Citation: Netskope XLoader 2022)
[XLoader](https://attack.mitre.org/software/S1207) can conduct form grabbing, steal cookies, and extract data from HTTP sessions.(Citation: Google XLoader 2017)
DATA STORED FOR EXFILTRATION TO FORMBOOK C2 SERVER: - C:\Users\[username]\AppData\Roaming\KM1A2CD2\KM1log.ini - 0 bytes - C:\Users\[username]\AppData\Roaming\KM1A2CD2\KM1logim.jpeg - 137 kB (screenshot of desktop) - C:\Users\[username]\AppData\Roaming\KM1A2CD2\KM1logrc.ini - 2 kB (Outlook Recovery) - C:\Users\[username]\AppData\Roaming\KM1A2CD2\KM1logri.ini - 1 kB (Iexplore Recovery) - C:\Users\[username]\AppData\Roaming\KM1A2CD2\KM1logrv.ini - 1 kB (__Vault Recovery)
[Phishing Email] | v [ZIP/RAR Archive]
In Xloader version 4.3, the registration packet sent to the C2 includes an additional encryption layer... The PKT2 tag is then prepended with the RC4 and Base64 encoded data as follows: PKT2 RC4_BASE64(registration_data).
pulls a steganographic .NET injector ("Fiber") hidden inside a JPEG.
XLoader uses a variety of dummy network calls to disguise the real C2. We observed 169 DNS name resolutions and 203 HTTP requests.
[XLoader](https://attack.mitre.org/software/S1207) uses HTTP and HTTPS for command and control communication.(Citation: Google XLoader 2017)
The malware connects to an email inbox using hardcoded outlook.com credentials via POP3. It then obtains the email subject (in Chinese) and extracts the real C2 address using the string “abcd” as an anchor.
xg66s[.]sbs — Active XLoader gate returning X-Trace encrypted headers on standard gate paths (/frag, /fgds, /j2c3). Also runs tinyproxy 1.11.0 on port 8888, likely the operator's forward proxy.
情報窃取型マルウェアをダウンロードする通信先は、GoogleドライブやOneDrive、Discordが使われるケースを確認しています。このように正規サービスを悪用することは、検知や遮断を回避する狙いがあるものとみられます。
it is configured to receive C2 information ( 91.204.227.31 :28877) from a user profile on VKontakte.
The decoded PowerShell downloads abb01.exe from 104[.]244[.]78[.]177 to $env:LOCALAPPDATA\dllhostSvc.exe, then starts the process. The testing JavaScript also downloads comres.cab.
Command and Control Data Encoding T1132 RC4+Base64 with character substitution (+/-, //_, =/.)
xg66s[.]sbs — Active XLoader gate returning X-Trace encrypted headers on standard gate paths (/frag, /fgds, /j2c3).
the DNS changer connects to the hardcoded vk.com account “id728588947” to get the next destination, which is “107.148.162[.]237:26333/sever.ini”. The “sever.ini” ... dynamically provided the criminal’s current rogue DNS IP addresses.
The delivery and installation methodology for MoqHao includes the use of ‘disposable’ staging infrastructure which generally utilizes Dynamic DNS services
“the real C2 (command and control) domains are buried among dozens of fakes… hides real C2 addresses among dozens of decoys and fake domains.”
“In addition, XLoader encrypts its network traffic, and hides real C2 addresses among dozens of decoys and fake domains.”
On macOS, threat actors will quietly exfiltrate session cookies, keychains, SSH keys and more as malicious processes from adware to spyware look to harvest data
Formbook та Snake Keylogger (ексфільтрація за допомогою API Telegram).
« L’exfiltration [...] transite via Sendspace (www.sendspace.com / fs13n1.sendspace.com). »
[XLoader](https://attack.mitre.org/software/S1207) can initiate a system reboot or shutdown.(Citation: Google XLoader 2017)
the criminals compromised Wi-Fi routers for use in DNS hijacking... Through rogue DNS servers, all users accessing a compromised router were redirected to a malicious landing page.
The objective might be more oriented towards a financial gain rather than disruption or espionage... exfiltrated login information and documents resulting from the compromise could be nonetheless later sold on stolen credential markets.
1,604 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.