# XLoader (FormBook) Infostealer Delivered via Fake Business Order Phishing, RAR/JScript/LuaJIT Chain with In-Memory Injection

> Phishing emails posing as business orders and price quotes deliver RAR archives containing obfuscated JScript that unpacks a LuaJIT interpreter and Lua loader, starting a memory-only XLoader infection chain. The chain patches AMSI/ETW-related ntdll functions and injects XLoader into 32-bit Windows binaries via shared memory sections to steal Windows Vault credentials and browser cookie records.

- **Published:** 2026-11-04T10:38:44Z
- **Last reviewed:** 2026-11-04T10:38:44Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5227
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5227.png
- **ID:** TL-2026-5227
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 26 (3 shown free below)

## Description

Morphisec research (reported by Cybersecurity News on 2026-11-04) documents an XLoader campaign, the successor to the FormBook infostealer, that uses business-themed phishing emails (order confirmations, quotations, invoice requests) with RAR attachments. Lures were observed in Greek and Slovenian, and earlier variants of the campaign spoofed SharePoint notifications. The same campaign infrastructure was also observed delivering Agent Tesla, Remcos and XWorm.

The RAR contains an obfuscated JScript file. On execution it drops a LuaJIT interpreter (EHFTUOMQDRXVTJSF.exe), a Lua loader (FSJTVXRDQMOUTFHE) and a VBS launcher (FSJTVXRDQMOUTFHE.vbs) into the user's Documents folder, and removes the Zone.Identifier stream. The Lua program attempts to erase AMSI functions and patch 12 ntdll functions (EtwEventWrite, EtwEventWriteFull, EtwEventWriteTransfer, EtwEventWriteString, NtTraceEvent, EtwEventEnabled, NtOpenThread, NtSuspendThread, NtTerminateThread, NtTerminateProcess, NtSuspendProcess, NtCreateSection), then decodes a packed PE in memory. The packed PE decrypts the XLoader core with RC4, selectively decrypting routines during execution.

XLoader is injected into a 32-bit target process using shared section objects and thread-context redirection rather than WriteProcessMemory. Twelve candidate host processes are named: cleanmgr.exe, clip.exe, TSTheme.exe, getmac.exe, UserAccountControlSettings.exe, proquota.exe, SearchProtocolHost.exe, mobsync.exe, mshta.exe, ftp.exe, fsutil.exe and find.exe. Persistence is conditional: a scheduled task named EHFTUOMQDRXVTJSF runs every 10 minutes if the .mui marker file exists. The malware enumerates the Windows Vault and collects cookie records. C2 uses HTTP GET with a Winsock fallback, with 16 configured C2 slots and POST parameters such as dat=, &un= and &br=9 behind a PKT2: marker. Per Zscaler ThreatLabz research, XLoader mixes decoy hosts with real C2 servers and derives network encryption keys from the C2 URL, so not every listed domain is necessarily operator-controlled.

No CVE, CVSS score or named threat actor is given in the sources; severity is an analyst assessment. Delivery used a relay at 66.113.160.32 and the host webmail.bekdachegroup.com. The Morphisec primary report was retrieved only as a summarized fetch; hash and C2 values were consistent between it and the news article.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1059.007 JavaScript
- T1059.005 Visual Basic
- T1106 Native API
- T1053.005 Scheduled Task
- T1685 Disable or Modify Tools
- T1685 Disable or Modify Tools
- T1553.005 Mark-of-the-Web Bypass
- T1620 Reflective Code Loading
- T1027.013 Encrypted/Encoded File
- T1140 Deobfuscate/Decode Files or Information
- T1055.003 Thread Execution Hijacking
- T1055 Process Injection
- T1555.004 Windows Credential Manager
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1071.001 Web Protocols

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**XLoader LuaJIT Loader Chain Executed From User Documents (EHFTUOMQDRXVTJSF / FSJTVXRDQMOUTFHE)** (`TL-2026-5227-SPL-001`)

Detects the execution stage of the XLoader (FormBook successor) order-lure chain documented by Morphisec: an obfuscated JScript run by wscript/cscript drops a LuaJIT interpreter (EHFTUOMQDRXVTJSF.exe), a Lua loader (FSJTVXRDQMOUTFHE) and a VBS launcher into the user's Documents folder and starts them. Matches the known LuaJIT filename and loader name, the community-corroborated LuaJIT SHA256, and the behavioural pattern of a script host spawning an executable from Documents. Early detection here precedes AMSI/ETW patching and in-memory XLoader injection.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.002, T1059.007, T1059.005, T1140
- **Data sources:** sysmon_event_id_1, windows_process_creation, defender_DeviceProcessEvents
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(Image="*\\EHFTUOMQDRXVTJSF.exe" OR CommandLine="*FSJTVXRDQMOUTFHE*" OR CommandLine="*EHFTUOMQDRXVTJSF*" OR Hashes="*d447a06cba8d3dbe80e09d73dd64576836b258961ee0d3ba56cf26cea7962b49*" OR (ParentImage IN ("*\\wscript.exe", "*\\cscript.exe") AND Image="*\\Documents\\*.exe"))
| eval lua_loader_args=if(like(lower(CommandLine), "%fsjtvxrdqmoutfhe%") OR like(lower(CommandLine), "%.lua%"), 1, 0)
| stats count min(_time) AS first_seen max(_time) AS last_seen max(lua_loader_args) AS lua_loader_args values(Image) AS images values(ParentImage) AS parent_images values(CommandLine) AS command_lines BY host, User
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "EHFTUOMQDRXVTJSF.exe"
    or ProcessCommandLine has_any ("FSJTVXRDQMOUTFHE", "EHFTUOMQDRXVTJSF")
    or SHA256 =~ "d447a06cba8d3dbe80e09d73dd64576836b258961ee0d3ba56cf26cea7962b49"
    or (InitiatingProcessFileName in~ ("wscript.exe", "cscript.exe") and FolderPath contains @"\Documents\" and FileName endswith ".exe")
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
```

### Sigma

```yaml
title: XLoader LuaJIT Loader Chain Executed From User Documents
id: 7c1d4e9a-52b3-4f68-a1c7-0e9d3b8f2a11
status: experimental
description: Detects execution of the XLoader order-lure chain components (EHFTUOMQDRXVTJSF.exe LuaJIT host, FSJTVXRDQMOUTFHE Lua loader) or a script host spawning an executable from the user's Documents folder.
references:
  - https://www.morphisec.com/blog/from-business-emails-to-xloader-an-order-lure-that-led-to-in-memory-injection/
  - https://cybersecuritynews.com/hackers-hide-xloader-malware/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-04
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1059.007
  - attack.t1059.005
  - attack.defense_evasion
  - attack.t1140
logsource:
  category: process_creation
  product: windows
detection:
  selection_name:
    Image|endswith: '\EHFTUOMQDRXVTJSF.exe'
  selection_cmd:
    CommandLine|contains:
      - 'FSJTVXRDQMOUTFHE'
      - 'EHFTUOMQDRXVTJSF'
  selection_hash:
    Hashes|contains: 'D447A06CBA8D3DBE80E09D73DD64576836B258961EE0D3BA56CF26CEA7962B49'
  selection_chain:
    ParentImage|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
    Image|contains: '\Documents\'
    Image|endswith: '.exe'
  condition: 1 of selection_*
falsepositives:
  - Legitimate admin or line-of-business scripts that launch a signed executable from a Documents folder
level: high
```

**Known false positives:**

- Legitimate logon or admin scripts (wscript/cscript) that start a signed executable from a user Documents folder
- Developers running portable tools or interpreters from Documents via script wrappers

**Tuning notes:** Name and hash branches are near-zero false positive; the wscript/cscript-to-Documents-exe branch is behavioural, so allowlist known admin script paths and signed publishers. Requires Sysmon EID 1 with Hashes enabled (SHA256). Add other Lua loader SHA256 values from research.json iocs[] to the hash branch as they are confirmed.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- JScript/JSE Launched by Windows Script Host From RAR Extraction (Order-Lure Phishing) (locked: unlock with TL Creds)
- XLoader Section-Object and Thread-Context Injection Into 32-bit Host Processes (locked: unlock with TL Creds)
- XLoader C2, Delivery Infrastructure and Community-Observed Sibling Network Connections (locked: unlock with TL Creds)
- XLoader Dropped Artifacts in User Documents and Zone.Identifier Removal (locked: unlock with TL Creds)
- Windows Vault Credential Library Loaded by XLoader Host or LuaJIT Process (locked: unlock with TL Creds)
- DNS Resolution of XLoader C2, Delivery and Community-Observed Sibling Domains (locked: unlock with TL Creds)
- XLoader Scheduled Task Persistence (EHFTUOMQDRXVTJSF, 10-Minute Repeat) (locked: unlock with TL Creds)
- XLoader Injected Host Process Making Outbound Network Connections (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 26)

Defanged, TLP:CLEAR.

- IP address: `66.113.160[.]32`
- Domain: `focused-albattani[.]66-113-160-32[.]plesk[.]page`
- File hash: `e834ea9cd3025f8070778cf7ef8219976568cc28085feaf974912b64e5b77bc8`

Full set of 26 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Hackers Hide XLoader Malware in Fake Business Orders to Steal Passwords and Evade Detection](https://cybersecuritynews.com/hackers-hide-xloader-malware/)
- [Morphisec: From Business Emails to XLoader - An Order Lure That Led to In-Memory Injection](https://www.morphisec.com/blog/from-business-emails-to-xloader-an-order-lure-that-led-to-in-memory-injection/)
- [Zscaler ThreatLabz: Technical Analysis of Xloader Versions 6 and 7 Part 1](https://www.zscaler.com/blogs/security-research/technical-analysis-xloader-versions-6-and-7-part-1)
- [Zscaler ThreatLabz: Technical Analysis of Xloader Versions 6 and 7 Part 2](https://www.zscaler.com/blogs/security-research/technical-analysis-xloader-versions-6-and-7-part-2)
- [Zscaler ThreatLabz: Latest Xloader Obfuscation Methods and Network Protocol](https://www.zscaler.com/blogs/security-research/latest-xloader-obfuscation-methods-and-network-protocol)
- [BlackBerry: Threat Thursday - XLoader Infostealer](https://blogs.blackberry.com/en/2021/09/threat-thursday-xloader-infostealer)
- [Security Boulevard: Technical Analysis of Xloader Versions 6 and 7 Part 1](https://securityboulevard.com/2025/01/technical-analysis-of-xloader-versions-6-and-7-part-1/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5227