Skip Navigation
BlackBerry ThreatVector Blog

Threat Thursday: xLoader Infostealer

Background

xLoader is an information-stealing malware targeting both macOS® and Windows®. Previously sold on underground forums under the name Formbook, xLoader surfaced in early 2020 shortly after Formbook was shut down by its author.

xLoader is sold under a Malware-as-a-Service (MaaS) agreement. Subscribers have access to the administrative panel and executable builds for both Windows and macOS. The authors of xLoader retain full control of command-and-control (C2) infrastructure and malware builds for each target environment.

Operating System

Risk & Impact

Technical Analysis

For this report, we analyzed a Windows build of xLoader.

Sample hash: 9f7b903ab126b2a3a0ca3c5977bbf84111f52a6e3a6e43aa127763e1a46b8f2d

The file is a 32-bit Windows executable, which shows a compile timestamp in 2001. Given what we know of xLoader’s history, this is clearly a false date and an indication of this threat’s evasive behavior.

Basic static analysis reveals more abnormal features:

1.      Zero imported libraries and functions
2.      No data directory entries
3.      A single executable “.text” section
4.      A very small number of legible strings

This sample is a very feature-limited build. Perhaps the author adopted a “less is more” mindset, believing that a reduced analysis “surface” would help to avoid suspicion. When placed under the analysis microscope, this decision was largely counter-productive as the malware’s simplicity only serves to highlight its unusual features.

Disassembly shows the code is heavily obfuscated:

Figure 1: Obfuscated code flow within the xLoader binary

Turning to dynamic analysis, when xLoader is launched, it will first manually load ntdll.dll from disk. This approach of manual mapping is an evasive technique that aims to bypass hooks put in place by (poorly implemented) endpoint protection and automated malware analysis environments.

With access to ntdll, xLoader performs a battery of anti-analysis checks. This includes looking for the following conditions:

1.      The presence of a user-mode debugger
2.      The presence of a kernel-mode debugger
3.      Execution timing checks (rdtsc)
4.      The presence of blacklisted process names
5.      The presence of blacklisted modules
6.      The presence of blacklisted usernames
7.      The Thread Environment Block (TEB) Wow32Reserved field points to a 64-bit module

As this last point is a bit more complicated, let’s investigate it a little further.

In this instance, xLoader is a 32-bit process. Under normal operation, Wow32Reserved in the TEB resolves to a function located in wow64cpu.dll. xLoader will validate the PE header of whatever Wow32Reserved points to, and confirm that the expected offset for PE “Magic Number” is 0x20B, indicating a 64-bit (PE32+) module.

Any naïve attempts to intercept API calls made by xLoader, by overwriting Wow32Reserved, would likely be met with having it point to a user allocated block of memory containing shellcode. This would lack the proper PE header and expected “Magic Number” value.

The success or failure of each of the seven anti-analysis checks listed above is recorded in a 16-byte field. Once all checks are completed, the hash value of this field is used to decrypt API strings. Rudimentary attempts to bypass the checks result in incorrect decryption and deliberate self-destruction by way of an unhandled exception.

Figure 2: Roll-call of completed anti-analysis checks employed by xLoader to ward off unwanted attention

Once environmental checks are completed, xLoader obtains a process handle to Windows’ explorer.exe (ID 2460 in the below image). The open process request specifically includes permission to read or write memory, which is a tell-tale sign of imminent remote code injection:

Figure 3: Request to open a process with read and write access rights

In this scenario, code injection is performed by way of section objects and shared memory views, as well as API calls to NtOpenThread, SetThreadContext, and NtResumeThread.

The goal of code injection is to spawn a new, legitimate Windows process that will act as an unwitting host for a second round of code injection. Legitimate Windows processes launched by a user during regular operations will have explorer.exe as the parent, thus xLoader is doing its best to “blend in.”

xLoader chooses a process at random from an internal list:

svchost.exe

msiexec.exe

wuauclt.exe

lsass.exe

wlanext.exe

msg.exe

lsm.exe

dwm.exe

help.exe

chkdsk.exe

cmmon32.exe

nbtstat.exe

spoolsv.exe

cmstp.exe

colorcpl.exe

cscript.exe

explorer.exe

WWAHost.exe

ipconfig.exe

msdt.exe

mstsc.exe

NAPSTAT.EXE

netsh.exe

NETSTAT.EXE

raserver.exe

wscript.exe

taskhost.exe

rundll32.exe

systray.exe

audiodg.exe

wininit.exe

services.exe

autochk.exe

autoconv.exe

autofmt.exe

wuapp.exe

cmd.exe

rdpclip.exe

control.exe

 

Adopting a similar approach as before, the launched process is created in a suspended state. It is then appropriated through use of a section object and a shared view, as well as API calls to SetThreadContext and NtResumeThread:

Figure 4: The final benign process launched in a suspended state

Under a separate invocation of xLoader, a scan of the active processes in the analysis environment reveals two suspicious instances, with threads of execution having an unusual origin:

Figure 5: Injected threads with suspicious origins

With the chain of startup process-injection completed, xLoader deletes itself from disk by invoking cmd.exe:

Figure 6: Self-deletion using cmd.exe

Persistence

Persistence is achieved using the Windows registry, by creating an entry in the HKey_Current_User hive: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\<RANDOM> REG_SZ

This entry points to a copy of itself dropped in a randomly-named subfolder of C:\Program Files (x86):

Figure 7: Persistence via Windows Registry HKCU hive

Command & Control:

Handling of C2 requests remains the responsibility of the first-stage code running inside explorer.exe. The initial check-in with the channel comprises the following basic host information:

1.      Handshake bytes (“XLNG”)
2.      Hash of the user’s Windows Security Identifier (SID) (“28BED20C”)
3.      Version of xLoader (“2.3”)
4.      Operating system version and “bitness” (x64)
5.      Username, Base64 encoded

Figure 8: Execution context included in the initial C2 POST check-in

This host “fingerprint” is encrypted and Base64 encoded prior to transmission.

Repeated sandbox analysis shows xLoader randomly selecting 16 C2 domains from an embedded pool of 43, with only one being the genuine C2 host. Other domains may be included, to make C2 traffic less obvious, or harder to identify against a backdrop of benign HTTP requests. Each domain in the set is contacted an equal amount in a round-robin fashion. Check-in attempts are made at five-second intervals and continue indefinitely.

The campaign ID for the analyzed build is “ipa8,” which is included in the GET request:

Figure 9: GET request to xLoader C2 with encoded host identification

When check-in succeeds, xLoader can be instructed to:

  • Download and launch additional payloads
  • Upload screenshots
  • Intercept and steal user credentials or cookies
  • Commence keystroke logging
  • Terminate and uninstall
  • Steal clipboard contents

One Tool to Bind Them

Subscription to xLoader includes access to a free Java-based tool called xBinder, that combines Windows and macOS executables into a single, portable .jar file. Given Java’s prevalence, this is an attractive feature. It makes crafting email attachments for social engineering or watering hole downloads possible avenues for attack.

Within the .jar file, the macOS and Windows executables are bundled and encrypted using AES with a static key. When launched, a runtime probe identifies the host operating system. It then drops and executes the corresponding payload.

A version of xBinder can be found in VirusTotal, indicating a possible leak or accidental upload. A handful of analyzed xBinder-generated .jar files contained benign macOS command line tools, such as “/bin/ls,” together with malicious Windows executables from these different families:

  • Azorult (info stealer)
  • Snake (info stealer)
  • Neshta (file infector)
  • Guloader (downloader)

This mismatched bundling of benign files together with malicious code from disparate malware families suggests unsanctioned use of xBinder by groups or individuals, rather than paying subscribers.

Figure 10: xBinder tool for creating Mac and Windows .jar files

Conclusion

xLoader promotes itself among the rank-and-file of underground MaaS offerings as cheap, highly functional and resilient. With its evasive and mature binaries for both macOS and Windows, together with the provision of a free binding tool that caters to more indiscriminate targeting, xLoader’s offering has appeal for both fledgling cyber criminals and larger, more organized groups.

YARA Rule

The following YARA rule was authored by the BlackBerry Research & Intelligence Team to catch the threat described in this document:

import "pe"
rule xLoaderInfoStealer
{
    strings:
        $hx_enc_buff = { 57 50 E8 B0 E6 FF FF 8B F8 83 C4 04 80 3F 55 75 79 80 7F 01 8B 75 73 }
    condition:
            pe.is_pe and
            pe.number_of_imported_functions == 0 and
            pe.number_of_imports == 0 and
             all of ($hx*)
}

 

Indicators of Compromise (IoCs)

Network:

www[.]abolad[.]com
www[.]addisonbleu[.]com
www[.]am-conseil-communication[.]com
www[.]askaboutaduhelm[.]com
www[.]astyaviewer[.]com
www[.]bainrix[.]com
www[.]beaumontcycleworks[.]com
www[.]blockchainhub360[.]com
www[.]calerie[.]coffee
www[.]calvarirumba[.]com
www[.]celiktarim[.]com
www[.]dailygame168[.]com
www[.]desarrollosolucionesnavarro[.]com (legitimate C2 domain)
www[.]edwardsrealtyfl[.]rentals
www[.]golfwifi[.]net
www[.]guapandglo[.]com
www[.]hydrarobuxobby[.]com
www[.]instrumentum[.]store
www[.]kinnonstudio[.]com
www[.]lanerbo[.]com
www[.]littlescampers[.]com
www[.]mapopi[.]com
www[.]miotir[.]com
www[.]mnavn[.]com
www[.]northwayenterprise[.]com
www[.]okwideus[.]com
www[.]oqity[.]com
www[.]pastelpastrybakery[.]com
www[.]plastings[.]com
www[.]poolsnation[.]com
www[.]privedenim[.]com
www[.]registernowhd[.]xyz
www[.]rixmusic[.]com
www[.]royalposhpups[.]com
www[.]rwaafd[.]com
www[.]sazekav[.]com
www[.]serialmixer[.]icu
www[.]tailored2fit[.]online
www[.]thebandaiderepair[.]com
www[.]therightmilitia[.]com
www[.]theutahhomestore[.]com
www[.]visions-agency[.]com
www[.]votekellykitashima[.]com
www[.]xiang-life[.]net

Registry:

HKCU\Software\Microsoft\CurrentVersion\Run\<RANDOM> (REG_SZ)

File system:

C:\Program Files (x86)\<RANDOM>\<Random>.exe

SHA256:

9f7b903ab126b2a3a0ca3c5977bbf84111f52a6e3a6e43aa127763e1a46b8f2d (xLoader PE)
693d6f0ac1e3f5e3e5b68c45d2a77bcc9d8976f7b091d5bfa1e719ad8b97fd25 (xBinder JAR)

 

BlackBerry Assistance

If you’re battling this malware or a similar threat, you’ve come to the right place, regardless of your existing BlackBerry relationship.

The BlackBerry Incident Response team is made up of world-class consultants dedicated to handling response and containment services for a wide range of incidents, including ransomware and Advanced Persistent Threat (APT) cases.

We have a global consulting team standing by to assist you by providing around-the-clock support, if required, as well as local assistance. Please contact us here:  https://www.blackberry.com/us/en/forms/cylance/handraiser/emergency-incident-response-containment


For more information about this threat, watch our new demo video, BlackBerry vs. xLoader Infostealer.

The BlackBerry Research & Intelligence Team

About The BlackBerry Research & Intelligence Team

The BlackBerry Research & Intelligence team examines emerging and persistent threats, providing intelligence analysis for the benefit of defenders and the organizations they serve.