XLoader Malware Uses LuaJIT and Injection to Hide Credential Stealer
Original title: Hackers Abuse LuaJIT and Windows Process Injection to Hide XLoader Credential-Stealing Malware
The loader hides the credential stealer inside an embedded LuaJIT interpreter and moves it into another Windows process through shared-section injection.
Hackers abuse LuaJIT and Windows process injection to hide XLoader credential-stealing malware. The campaign uses business-themed email lures and delivered Agent Tesla, Remcos and XWorm. The chain starts with order and payment emails containing RAR archives with obfuscated JScript that launches the hidden loader.
Unconfirmed: The conditional persistence branch is treated as a capability rather than confirmed behavior.
- The script drops EHFTUOMQDRXVTJSF.exe and FSJTVXRDQMOUTFHE in the Documents folder.
- XLoader uses shared-section injection to run in a suspended SysWOW64 host process.
- A conditional persistence branch can create a scheduled task every ten minutes if a .mui marker is present.
Impact: Steals saved passwords, browser cookies and other login data from infected hosts.
- 1.Block RAR-delivered script files
- 2.Monitor wscript.exe launching executables from Documents folder
- 3.Alert on unexpected SysWOW64 utilities that start suspended
From the original article
4 min read at gbhackers.com
A new XLoader infection chain. It hides the credential stealer inside an embedded LuaJIT interpreter. It moves it into another Windows process through shared-section injection.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.