XLoader Campaign Hides Credential Stealer in LuaJIT Interpreter via Shared-Section Injection
Morphisec researchers detailed a new XLoader infection chain that conceals the credential stealer inside an embedded LuaJIT interpreter and injects it into legitimate Windows processes via shared-section injection with thread-context redirection. The campaign uses business-themed phishing lures (order confirmations, quotations) in Greek and Slovenian, delivering RAR archives containing obfuscated JScript instead of documents. The same delivery chain has also been used to drop Agent Tesla, Remcos, and XWorm. The malware attempts to patch AMSI and ETW in memory to evade detection, though researchers did not observe successful defense bypass on a host.
Detalhes técnicos
The JScript payload strips the Zone.Identifier mark-of-the-web, then decodes Base64 blobs via Microsoft.XMLDOM/ADODB.Stream into an x86 LuaJIT-compatible executable and a companion Lua file dropped in the Documents folder. Using LuaJIT's FFI, the loader zeroes AmsiScanBuffer/AmsiInitialize strings and overwrites 12 ntdll exports (including EtwEventWrite and NtTraceEvent) with RET/NOP patches. A conditional persistence mechanism tied to a .mui marker file can create a scheduled task running a VBS launcher every ten minutes, though this was not observed as a confirmed first-run behavior. The loader decodes a 382,982-byte packed PE32 via substitution, reversal, custom Base64 and rotation, mapping it into LuaJIT memory and executing it via CreateRemoteThread targeting GetCurrentProcess(). The packed PE (entropy ~7.9937 bits/byte, no import table) resolves NtAllocateVirtualMemory, decrypts regions with RC4 (single pass plus 15 re-keyed blocks), and launches the XLoader core. XLoader's injector maps a shared section into one of 12 candidate SysWOW64 host processes (cleanmgr.exe, clip.exe, TSTheme.exe, getmac.exe, UserAccountControlSettings.exe, proquota.exe, SearchProtocolHost.exe, mobsync.exe, mshta.exe, ftp.exe, fsutil.exe, find.exe), redirecting execution via thread-context manipulation rather than WriteProcessMemory. The deployed XLoader can issue HTTP GET commands, enumerate Windows Vault credentials, and prepare browser cookie records.
Remediação
Morphisec recommends blocking RAR-delivered script files, monitoring wscript.exe launching executables from Documents, and alerting on unexpected SysWOW64 utilities starting suspended or on shared-section mappings between unrelated processes.
Linha do tempo
-
XLoader Campaign Hides Credential Stealer in LuaJIT Interpreter via Shared-Section Injection
ler a análise desta fonte ocultar
Morphisec researchers detailed a new XLoader infection chain that conceals the credential stealer inside an embedded LuaJIT interpreter and injects it into legitimate Windows processes via shared-section injection with thread-context redirection. The campaign uses business-themed phishing lures (order confirmations, quotations) in Greek and Slovenian, delivering RAR archives containing obfuscated JScript instead of documents. The same delivery chain has also been used to drop Agent Tesla, Remcos, and XWorm. The malware attempts to patch AMSI and ETW in memory to evade detection, though researchers did not observe successful defense bypass on a host.
Technical Details
The JScript payload strips the Zone.Identifier mark-of-the-web, then decodes Base64 blobs via Microsoft.XMLDOM/ADODB.Stream into an x86 LuaJIT-compatible executable and a companion Lua file dropped in the Documents folder. Using LuaJIT's FFI, the loader zeroes AmsiScanBuffer/AmsiInitialize strings and overwrites 12 ntdll exports (including EtwEventWrite and NtTraceEvent) with RET/NOP patches. A conditional persistence mechanism tied to a .mui marker file can create a scheduled task running a VBS launcher every ten minutes, though this was not observed as a confirmed first-run behavior. The loader decodes a 382,982-byte packed PE32 via substitution, reversal, custom Base64 and rotation, mapping it into LuaJIT memory and executing it via CreateRemoteThread targeting GetCurrentProcess(). The packed PE (entropy ~7.9937 bits/byte, no import table) resolves NtAllocateVirtualMemory, decrypts regions with RC4 (single pass plus 15 re-keyed blocks), and launches the XLoader core. XLoader's injector maps a shared section into one of 12 candidate SysWOW64 host processes (cleanmgr.exe, clip.exe, TSTheme.exe, getmac.exe, UserAccountControlSettings.exe, proquota.exe, SearchProtocolHost.exe, mobsync.exe, mshta.exe, ftp.exe, fsutil.exe, find.exe), redirecting execution via thread-context manipulation rather than WriteProcessMemory. The deployed XLoader can issue HTTP GET commands, enumerate Windows Vault credentials, and prepare browser cookie records.
Remediation
Morphisec recommends blocking RAR-delivered script files, monitoring wscript.exe launching executables from Documents, and alerting on unexpected SysWOW64 utilities starting suspended or on shared-section mappings between unrelated processes.