XLoader Malware Uses LuaJIT and Injection to Hide Credential Stealer
Original title: Hackers Hide XLoader Malware in Fake Business Orders to Steal Passwords and Evade Detection
AI summary · x-ai/grok-4.7Summaries by Vani AI
The loader hides the credential stealer inside an embedded LuaJIT interpreter and moves it into another Windows process through shared-section injection.
Hackers abuse LuaJIT and Windows process injection to hide XLoader credential-stealing malware. The campaign uses business-themed email lures and delivered Agent Tesla, Remcos and XWorm. The chain starts with order and payment emails containing RAR archives with obfuscated JScript that launches the hidden loader.
Unconfirmed: The conditional persistence branch is treated as a capability rather than confirmed behavior.
Key facts
- The script drops EHFTUOMQDRXVTJSF.exe and FSJTVXRDQMOUTFHE in the Documents folder.
- XLoader uses shared-section injection to run in a suspended SysWOW64 host process.
- A conditional persistence branch can create a scheduled task every ten minutes if a .mui marker is present.
Security assessment · AI, from the articleExploited in the wild
Impact: Steals saved passwords, browser cookies and other login data from infected hosts.
What to do
- 1.Block RAR-delivered script files
- 2.Monitor wscript.exe launching executables from Documents folder
- 3.Alert on unexpected SysWOW64 utilities that start suspended
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 511mma.ru | ox[.]com[.]tw/upw6/ URL Configured endpoint, slot 11 hxxp://511mma[.]ru/dnir/ URL Configured endpoint, slot 12 hxxp://hahashoe[.] |
| domain | bagolone.it | ultras[.]store/2r3a/ URL Configured endpoint, slot 9 hxxp://bagolone[.]it/qbqm/ URL Configured endpoint, slot 10 hxxp://tomatox[.]c |
| domain | eolienzaer.com | fon33fv[.]club/6yav/ URL Configured endpoint, slot 2 hxxp://eolienzaer[.]com/jrsi/ URL Configured endpoint, slot 3 hxxp://tori[.]fi/8y |
| domain | grandseosite91.shop | /sonhero[.]top/xc0y/ URL Configured endpoint, slot 7 hxxp://grandseosite91[.]shop/1ud5/ URL Configured endpoint, slot 8 hxxp://moreultras[. |
| domain | hahashoe.com | //511mma[.]ru/dnir/ URL Configured endpoint, slot 12 hxxp://hahashoe[.]com/r0zm/ URL Configured endpoint, slot 13 hxxp://snvipvn[.]c |
| domain | iqos-one.com | kdachegroup.com Hostname Received-chain host, not C2 hxxp://iqos-one[.]com/gf2n/ URL Configured endpoint, slot 1 hxxp://offon33fv[.] |
| domain | komplek.id | bajegame[.]com/l3iy/ URL Configured endpoint, slot 5 hxxp://komplek[.]id/gkws/ URL Configured endpoint, slot 6 hxxp://sonhero[.]to |
| domain | moreultras.store | osite91[.]shop/1ud5/ URL Configured endpoint, slot 8 hxxp://moreultras[.]store/2r3a/ URL Configured endpoint, slot 9 hxxp://bagolone[.]i |
| domain | offon33fv.club | iqos-one[.]com/gf2n/ URL Configured endpoint, slot 1 hxxp://offon33fv[.]club/6yav/ URL Configured endpoint, slot 2 hxxp://eolienzaer[. |
| domain | okbajegame.com | xp://tori[.]fi/8yfp/ URL Configured endpoint, slot 4 hxxp://okbajegame[.]com/l3iy/ URL Configured endpoint, slot 5 hxxp://komplek[.]id |
| domain | revelintravel.com | snvipvn[.]com/v0rc/ URL Configured endpoint, slot 14 hxxp://revelintravel[.]com/zd56/ URL Configured endpoint, slot 15 hxxp://www[.]990ma |
| domain | snvipvn.com | ahashoe[.]com/r0zm/ URL Configured endpoint, slot 13 hxxp://snvipvn[.]com/v0rc/ URL Configured endpoint, slot 14 hxxp://revelintrav |
| domain | sonhero.top | //komplek[.]id/gkws/ URL Configured endpoint, slot 6 hxxp://sonhero[.]top/xc0y/ URL Configured endpoint, slot 7 hxxp://grandseosite |
| domain | tomatox.com.tw | bagolone[.]it/qbqm/ URL Configured endpoint, slot 10 hxxp://tomatox[.]com[.]tw/upw6/ URL Configured endpoint, slot 11 hxxp://511mma[.] |
| domain | tori.fi | lienzaer[.]com/jrsi/ URL Configured endpoint, slot 3 hxxp://tori[.]fi/8yfp/ URL Configured endpoint, slot 4 hxxp://okbajegame[. |
| domain | webmail.bekdachegroup.com | -160-32.plesk.page Hostname Delivery infrastructure, not C2 webmail.bekdachegroup.com Hostname Received-chain host, not C2 hxxp://iqos-one[.]com/ |
| domain | www.990match.com | ntravel[.]com/zd56/ URL Configured endpoint, slot 15 hxxp://www[.]990match[.]com/ccp8/ URL Configured endpoint, slot 16 Note: IP address |
| ipv4 | 66.113.160.32 | RE: Παραγγελία 001828 Email subject Both captured messages 66.113.160.32 IP address Delivery relay, not C2 focused-albattani.66-113- |
| sha256 | 05ecf6621bc2f2303db6bab33cdc231cb1cd08895b4d089f7410b98b21c38c24 | 8be9ab378cf31611461fce30ac28 SHA-256 Παραγγελί623768193.rar 05ecf6621bc2f2303db6bab33cdc231cb1cd08895b4d089f7410b98b21c38c24 SHA-256 Παραγγελί623768193.rar 78cb203de34c4a4c1961fe0e3700 |
| sha256 | 08aadfcffb61f90b0d3b34758048e0f699f241216d164c82919a6934488a52e9 | 152a80016bbcccf39e960a2790d1efb8a22 SHA-256 S0_283723919.JS 08aadfcffb61f90b0d3b34758048e0f699f241216d164c82919a6934488a52e9 SHA-256 Listed without a context label in the source Παραγγ |
| sha256 | 21eb09400f387066649bec4c7fa63e4d4fd2171fb21a2b2ba182941325d76205 | 4626b4e10fa2ff06e80119eb0056974407cf7d8e834745e SHA-256 EML 21eb09400f387066649bec4c7fa63e4d4fd2171fb21a2b2ba182941325d76205 SHA-256 ROQ_O 2828-501.zip 38a498b126f8fc799a4f36f37b6d955f |
| sha256 | 33dbb7d0c78bfa2e124b78409ecc7152a80016bbcccf39e960a2790d1efb8a22 | ba6410d7eb02a9922eb21767897a8769 SHA-256 180SW_2828-501.rar 33dbb7d0c78bfa2e124b78409ecc7152a80016bbcccf39e960a2790d1efb8a22 SHA-256 S0_283723919.JS 08aadfcffb61f90b0d3b34758048e0f699f |
| sha256 | 38a498b126f8fc799a4f36f37b6d955fba6410d7eb02a9922eb21767897a8769 | 4fd2171fb21a2b2ba182941325d76205 SHA-256 ROQ_O 2828-501.zip 38a498b126f8fc799a4f36f37b6d955fba6410d7eb02a9922eb21767897a8769 SHA-256 180SW_2828-501.rar 33dbb7d0c78bfa2e124b78409ecc7152 |
| sha256 | 46e8d2bd454926641176ea67b2e357089ff411c89e524def0158a04b6103d7d4 | b71dae9e2de408197fbc82733e SHA-256 Παραγγελία 00182`8.rar | 46e8d2bd454926641176ea67b2e357089ff411c89e524def0158a04b6103d7d4 SHA-256 Naročilo_180SW_2828-501.JS 896a4ddd93ab1d6fda5d57e7 |
| sha256 | 685c989f4d89b2402c167075d5d6d6e1f4573c0450adc1de3d8c08c65ed8ee9f | 61ee0d3ba56cf26cea7962b49 SHA-256 Dropped LuaJIT executable 685c989f4d89b2402c167075d5d6d6e1f4573c0450adc1de3d8c08c65ed8ee9f SHA-256 Dropped Lua loader d87299e4a6457caccb6960c351003cb1 |
| sha256 | 6d7aaf1e563032ba46d8e0f1c8eab2b91d383fb2e5d00a1d4fff891f78a3572b | s. Indicators of compromise (IoCs):- Indicator Type Context 6d7aaf1e563032ba46d8e0f1c8eab2b91d383fb2e5d00a1d4fff891f78a3572b SHA-256 EML 78f08bdefb127c96a64229b591de7b3f984a451796ad132 |
| sha256 | 78cb203de34c4a4c1961fe0e3700e6c76ab9b8b71dae9e2de408197fbc82733e | 08895b4d089f7410b98b21c38c24 SHA-256 Παραγγελί623768193.rar 78cb203de34c4a4c1961fe0e3700e6c76ab9b8b71dae9e2de408197fbc82733e SHA-256 Παραγγελία 00182`8.rar | 46e8d2bd454926641176ea67b2 |
| sha256 | 78f08bdefb127c96a64229b591de7b3f984a451796ad132cb26ff54c76d073d4 | 6d8e0f1c8eab2b91d383fb2e5d00a1d4fff891f78a3572b SHA-256 EML 78f08bdefb127c96a64229b591de7b3f984a451796ad132cb26ff54c76d073d4 SHA-256 EML e834ea9cd3025f8070778cf7ef8219976568cc28085feaf |
| sha256 | 896a4ddd93ab1d6fda5d57e71c5b2cf5db32970093350a1111396b2e80dc6686 | 9e524def0158a04b6103d7d4 SHA-256 Naročilo_180SW_2828-501.JS 896a4ddd93ab1d6fda5d57e71c5b2cf5db32970093350a1111396b2e80dc6686 SHA-256 EML be40d790d265afba64626b4e10fa2ff06e80119eb005697 |
| sha256 | be40d790d265afba64626b4e10fa2ff06e80119eb0056974407cf7d8e834745e | a5d57e71c5b2cf5db32970093350a1111396b2e80dc6686 SHA-256 EML be40d790d265afba64626b4e10fa2ff06e80119eb0056974407cf7d8e834745e SHA-256 EML 21eb09400f387066649bec4c7fa63e4d4fd2171fb21a2b2 |
| sha256 | d447a06cba8d3dbe80e09d73dd64576836b258961ee0d3ba56cf26cea7962b49 | feaf974912b64e5b77bc8 SHA-256 RAR attached to both messages d447a06cba8d3dbe80e09d73dd64576836b258961ee0d3ba56cf26cea7962b49 SHA-256 Dropped LuaJIT executable 685c989f4d89b2402c167075d |
| sha256 | d87299e4a6457caccb6960c351003cb109748be9ab378cf31611461fce30ac28 | f4573c0450adc1de3d8c08c65ed8ee9f SHA-256 Dropped Lua loader d87299e4a6457caccb6960c351003cb109748be9ab378cf31611461fce30ac28 SHA-256 Παραγγελί623768193.rar 05ecf6621bc2f2303db6bab33cdc |
| sha256 | e834ea9cd3025f8070778cf7ef8219976568cc28085feaf974912b64e5b77bc8 | 64229b591de7b3f984a451796ad132cb26ff54c76d073d4 SHA-256 EML e834ea9cd3025f8070778cf7ef8219976568cc28085feaf974912b64e5b77bc8 SHA-256 RAR attached to both messages d447a06cba8d3dbe80e09 |
| url | http://511mma.ru/dnir/ | //tomatox[.]com[.]tw/upw6/ URL Configured endpoint, slot 11 hxxp://511mma[.]ru/dnir/ URL Configured endpoint, slot 12 hxxp://hahashoe[.]com/r0 |
| url | http://bagolone.it/qbqm/ | ://moreultras[.]store/2r3a/ URL Configured endpoint, slot 9 hxxp://bagolone[.]it/qbqm/ URL Configured endpoint, slot 10 hxxp://tomatox[.]com[.]t |
| url | http://eolienzaer.com/jrsi/ | xp://offon33fv[.]club/6yav/ URL Configured endpoint, slot 2 hxxp://eolienzaer[.]com/jrsi/ URL Configured endpoint, slot 3 hxxp://tori[.]fi/8yfp/ UR |
| url | http://grandseosite91.shop/1ud5/ | hxxp://sonhero[.]top/xc0y/ URL Configured endpoint, slot 7 hxxp://grandseosite91[.]shop/1ud5/ URL Configured endpoint, slot 8 hxxp://moreultras[.]store |
| url | http://hahashoe.com/r0zm/ | 1 hxxp://511mma[.]ru/dnir/ URL Configured endpoint, slot 12 hxxp://hahashoe[.]com/r0zm/ URL Configured endpoint, slot 13 hxxp://snvipvn[.]com/v0r |
| url | http://iqos-one.com/gf2n/ | mail.bekdachegroup.com Hostname Received-chain host, not C2 hxxp://iqos-one[.]com/gf2n/ URL Configured endpoint, slot 1 hxxp://offon33fv[.]club/6 |
| url | http://komplek.id/gkws/ | xp://okbajegame[.]com/l3iy/ URL Configured endpoint, slot 5 hxxp://komplek[.]id/gkws/ URL Configured endpoint, slot 6 hxxp://sonhero[.]top/xc0y |
| url | http://moreultras.store/2r3a/ | grandseosite91[.]shop/1ud5/ URL Configured endpoint, slot 8 hxxp://moreultras[.]store/2r3a/ URL Configured endpoint, slot 9 hxxp://bagolone[.]it/qbqm |
| url | http://offon33fv.club/6yav/ | hxxp://iqos-one[.]com/gf2n/ URL Configured endpoint, slot 1 hxxp://offon33fv[.]club/6yav/ URL Configured endpoint, slot 2 hxxp://eolienzaer[.]com/j |
| url | http://okbajegame.com/l3iy/ | ot 3 hxxp://tori[.]fi/8yfp/ URL Configured endpoint, slot 4 hxxp://okbajegame[.]com/l3iy/ URL Configured endpoint, slot 5 hxxp://komplek[.]id/gkws/ |
| url | http://revelintravel.com/zd56/ | hxxp://snvipvn[.]com/v0rc/ URL Configured endpoint, slot 14 hxxp://revelintravel[.]com/zd56/ URL Configured endpoint, slot 15 hxxp://www[.]990match[.] |
| url | http://snvipvn.com/v0rc/ | xxp://hahashoe[.]com/r0zm/ URL Configured endpoint, slot 13 hxxp://snvipvn[.]com/v0rc/ URL Configured endpoint, slot 14 hxxp://revelintravel[.]c |
| url | http://sonhero.top/xc0y/ | 5 hxxp://komplek[.]id/gkws/ URL Configured endpoint, slot 6 hxxp://sonhero[.]top/xc0y/ URL Configured endpoint, slot 7 hxxp://grandseosite91[.]s |
| url | http://tomatox.com.tw/upw6/ | hxxp://bagolone[.]it/qbqm/ URL Configured endpoint, slot 10 hxxp://tomatox[.]com[.]tw/upw6/ URL Configured endpoint, slot 11 hxxp://511mma[.]ru/dni |
| url | http://tori.fi/8yfp/ | xp://eolienzaer[.]com/jrsi/ URL Configured endpoint, slot 3 hxxp://tori[.]fi/8yfp/ URL Configured endpoint, slot 4 hxxp://okbajegame[.]com/l |
| url | http://www.990match.com/ccp8/ | /revelintravel[.]com/zd56/ URL Configured endpoint, slot 15 hxxp://www[.]990match[.]com/ccp8/ URL Configured endpoint, slot 16 Note: IP addresses and |
From the original article
5 min read at cybersecuritynews.com
A new XLoader malware campaign is landing in inboxes as ordinary business orders and price quote requests. The emails look routine, but the attached archive holds a script that starts a chain of hidden steps. The chain ends with the XLoader password stealer running inside a trusted Windows program.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.