Morphisec researchers have identified a new XLoader infection chain. Each email contains a RAR archive disguised as an order, but it actually holds a single obfuscated JScript file. Crafted emails lure unsuspecting recipients into clicking on a seemingly legitimate link.
The first email, titled "RE: Παραγγελία 001828", is part of a chain of communication, prompting recipients to review the attached order and respond promptly.
Two additional emails in Slovenian and English request an invoice and price quote, as well as a quotation for an urgent item. The Lua loader, designed to hide the console and potentially weaken security within its own process, is the primary focus of this cyber threat. The entry point is located at RVA 0x26F0, and the section entropy is approximately 7.9937 bits per byte (Source: morphisec).
It either locates an active process or initiates a suspended SysWOW64 host such as cleanmgr.exe, mshta.exe, ftp.exe, or find.exe. It then maps a shared memory section into both LuaJIT and the target, and redirects a target thread’s context to the mapped bootstrap code. Many of these hosts are decoys, matching Zscaler's description of XLoader disguising its real C2 servers among fake ones.
Indicators of Compromise Indicator Context 6d7aaf1e563032ba46d8e0f1c8eab2b91d383fb2e5d00a1d4fff891f78a3572b EML 78f08bdefb127c96a64229b591de7b3f984a451796ad132cb26ff54c76d073d4 EML Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort.
