Follow 
Summary
XLoader is a sophisticated information stealer derived from the FormBook malware family. The malware uses a multi-stage infection chain that begins with a phishing email carrying a JScript loader, continues through several PowerShell stages, and ends with a .NET injector that performs process hollowing into legitimate Windows processes.
Investigation
The analysis uncovered a five-stage execution chain involving JScript, AES-encrypted PowerShell scripts, and XOR-encrypted payloads. Researchers identified ConfuserEx2 being used for obfuscation and documented the process hollowing technique that injects the final XLoader payload into the legitimate aspnet_compiler.exe process.
Mitigation
Organizations should deploy robust email filtering to block malicious archives and JScript files. PowerShell execution should be restricted where possible, while suspicious child processes spawned by wscript.exe or cscript.exe should be closely monitored. Detecting unauthorized memory injection and process hollowing activity is also critical.
Response
If XLoader activity is detected, affected endpoints should be isolated immediately to prevent further data exfiltration. Responders should conduct forensic analysis of the C:\Temp directory and review network logs for communication with known malicious domains. Credentials associated with users on compromised systems should also be fully reset.
