Threat video1:00
XLoader Fake Order Phishing Chain: Detection & IOCs
Fake order emails load XLoader in memory via LuaJIT and steal Vault and cookie data. 9 detection rules, 26 IOCs, 18 techniques and a free Splunk SPL rule.
Read the full threat intel for XLoader Fake Order Phishing Chain: Detection & IOCs →
Chapters
- 0:00The hookFormBook infostealer returns as XLoader.
- 0:04The storyBusiness phishing emails deliver malicious RAR files.
- 0:11Attack pathAccording to reports, phishing opens RAR with JScript.
- 0:25AttributionNo threat actor is attributed.
- 0:29Indicators of compromise25 indicators to hunt: 1 IP, 17 domains and 4 SHA-256 hashes, and more.
- 0:38MITRE ATT&CK techniques17 ATT&CK techniques, from initial access to command and control.
- 0:44Remediation3 steps now: Block the delivery relay.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00FormBook infostealer returns as XLoader.
0:05Business phishing emails deliver malicious RAR files.
0:08Then steals credentials.
0:11According to reports, phishing opens RAR with JScript.
0:15LuaJIT unpacks and erases AMSI.
0:18Decrypts the XLoader core in memory.
0:21Steals Vault credentials and browser cookies.
0:25No threat actor is attributed. Confidence: low.
0:3025 indicators to hunt: 1 IP, 17 domains and 4 SHA-256 hashes, and more.
0:3917 ATT&CK techniques, from initial access to command and control.
0:443 steps now: Block the delivery relay.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.