XLoader Infostealer Campaign Uses LuaJIT Loader and Shared-Section Injection via Fake Order Emails
Morphisec researchers identified a phishing campaign delivering the XLoader infostealer through spoofed business emails written in Greek, Slovenian, and English, referencing fake purchase orders and invoices. Victims who open attached RAR archives trigger an obfuscated JScript file that strips Mark-of-the-Web protections and drops an x86 LuaJIT interpreter alongside a Lua script. The Lua script uses the Foreign Function Interface to disable AMSI and patch ntdll.dll export functions before unpacking and executing the XLoader core payload via a novel shared-section injection technique rather than traditional process hollowing. The same campaign infrastructure was also observed delivering Agent Tesla, Remcos, and XWorm. No specific threat actor group has been attributed; researchers suspect financially motivated initial access brokers operating commodified malware services.
Detalhes técnicos
The JScript dropper decodes two Base64 blobs via the Microsoft XMLDOM component, writing the LuaJIT executable and an extensionless Lua file to the Documents folder, then launches it hidden. The Lua script searches CLR memory to zero AMSI-related strings and patches twelve ntdll.dll exports with return/NOP instructions, with conditional persistence via scheduled tasks every ten minutes. It then decodes a 382KB string into an importless 32-bit PE, executing it on a thread within LuaJIT; the packer resolves APIs from the PEB and decrypts the XLoader core using multiple RC4 passes. The injector targets clean processes (existing x86 processes or suspended SysWOW64 hosts like mshta.exe, cleanmgr.exe, clip.exe) using shared memory sections and thread-context redirection, leaving the target's original image mapped — distinct from process hollowing. XLoader then harvests browser credentials, Windows Vault data, and cookies, communicating over HTTP and raw sockets using 64 hostname candidates to build 16 active C2 endpoints mixed with decoy domains, per prior Zscaler ThreatLabz analysis.
Remediação
Defenders should monitor process ancestry for Windows Script Host launching unexpected executables from user directories, flag LuaJIT binaries invoking native memory allocation APIs, and deploy AppLocker policies blocking script execution from user folders. Mail gateways should inspect compressed archives for embedded scripts and filter emails with mismatched recipient headers. Endpoint behavioral protection should be tuned to detect shared-section mapping between unrelated processes.
Linha do tempo
-
XLoader Infostealer Campaign Uses LuaJIT Loader and Shared-Section Injection via Fake Order Emails
ler a análise desta fonte ocultar
Morphisec researchers identified a phishing campaign delivering the XLoader infostealer through spoofed business emails written in Greek, Slovenian, and English, referencing fake purchase orders and invoices. Victims who open attached RAR archives trigger an obfuscated JScript file that strips Mark-of-the-Web protections and drops an x86 LuaJIT interpreter alongside a Lua script. The Lua script uses the Foreign Function Interface to disable AMSI and patch ntdll.dll export functions before unpacking and executing the XLoader core payload via a novel shared-section injection technique rather than traditional process hollowing. The same campaign infrastructure was also observed delivering Agent Tesla, Remcos, and XWorm. No specific threat actor group has been attributed; researchers suspect financially motivated initial access brokers operating commodified malware services.
Technical Details
The JScript dropper decodes two Base64 blobs via the Microsoft XMLDOM component, writing the LuaJIT executable and an extensionless Lua file to the Documents folder, then launches it hidden. The Lua script searches CLR memory to zero AMSI-related strings and patches twelve ntdll.dll exports with return/NOP instructions, with conditional persistence via scheduled tasks every ten minutes. It then decodes a 382KB string into an importless 32-bit PE, executing it on a thread within LuaJIT; the packer resolves APIs from the PEB and decrypts the XLoader core using multiple RC4 passes. The injector targets clean processes (existing x86 processes or suspended SysWOW64 hosts like mshta.exe, cleanmgr.exe, clip.exe) using shared memory sections and thread-context redirection, leaving the target's original image mapped — distinct from process hollowing. XLoader then harvests browser credentials, Windows Vault data, and cookies, communicating over HTTP and raw sockets using 64 hostname candidates to build 16 active C2 endpoints mixed with decoy domains, per prior Zscaler ThreatLabz analysis.
Remediation
Defenders should monitor process ancestry for Windows Script Host launching unexpected executables from user directories, flag LuaJIT binaries invoking native memory allocation APIs, and deploy AppLocker policies blocking script execution from user folders. Mail gateways should inspect compressed archives for embedded scripts and filter emails with mismatched recipient headers. Endpoint behavioral protection should be tuned to detect shared-section mapping between unrelated processes.