Malware keeps evolving, and Xloader is a strong example of how threat actors continuously refine their tools. Originally known as Formbook, this information-stealing malware has been active for years and has steadily grown more sophisticated. Today, Xloader targets browsers, email clients, and FTP applications while also enabling attackers to execute commands remotely and deploy additional malicious payloads.
In this article, we’ll break down how Xloader works, what changed in its recent versions, and why it continues to be a serious cybersecurity concern.
The Evolution from Formbook to Xloader
Formbook first appeared around 2016 as a data-stealing malware. A few years later, it was rebranded as Xloader, marking a shift toward more advanced capabilities and continuous development. The malware has not remained static — it has gone through multiple upgrades, with version 8.7 being one of the most recent observed releases .
Starting from version 8.1, the developers introduced significant changes, particularly in how the code is hidden and how network communication is handled. These updates make it harder for analysts and automated tools to understand what the malware is doing.
How Xloader Hides Its Code
One of the key strengths of Xloader lies in its use of obfuscation techniques. In simple terms, obfuscation means making the code difficult to read and analyze.
Xloader uses several layers of protection:
- Strings and functions are encrypted and only decrypted during execution
- Code blocks are temporarily decrypted and then hidden again after use
- Mathematical tricks (like XOR operations) are used to mask real values
In earlier versions, these techniques were already present, but newer versions take things further.
Dynamic Function Decryption
Xloader identifies the functions it needs during runtime and decrypts them using markers called “eggs.” Before version 8.1, these markers followed a predictable pattern. Now, they are built in random order and sometimes even constructed byte by byte.
This small change makes a big difference. Traditional analysis tools rely on patterns, and when those patterns disappear, analysts must manually reconstruct memory structures — a slow and complex task.
Advanced Obfuscation Techniques
Another improvement in newer versions is how constants and values are hidden. Previously, simple tricks were used to disguise numbers. Now, Xloader applies encryption even to basic function setup instructions.
Additionally, the malware’s internal decryption routines have been modified. Instead of using straightforward logic, the newer versions pass structured data into functions, which then extract and decode values in a layered way. This adds another barrier for anyone trying to reverse engineer the malware.
What Xloader Does on an Infected System
Once inside a system, Xloader focuses on two main goals:
- Stealing sensitive data
- Receiving and executing commands from its control server
It collects credentials, browser cookies, and other valuable information from applications like Chrome and Outlook. At the same time, it maintains communication with a command-and-control (C2) server to receive instructions.
Network Communication Explained
Xloader uses HTTP requests to talk to its servers, but the way it does this is far from simple.
It can operate in two modes:
- Using raw TCP sockets (with varied User-Agent strings to mimic browsers)
- Using Windows APIs like HttpSendRequest (with a fixed User-Agent)
Before sending data, it checks whether certain system functions have been tampered with. If it detects interference, it avoids sending requests altogether.
Multi-Layer Encryption
Even though the communication uses standard HTTP, the data itself is heavily encrypted. Xloader applies multiple layers of encryption using RC4 and SHA-1-based keys.
For example, when sending requests:
- Data is encrypted multiple times using different keys
- Keys are derived from the C2 server’s URL
- The final output is encoded before transmission
Interestingly, some encryption layers don’t actually change the data much but are still included to complicate analysis.
Use of Decoy Servers
To avoid detection, Xloader includes a list of 65 potential C2 servers. It randomly selects a subset and communicates with them.
This creates confusion for analysts because not all servers are real. The only way to identify the actual malicious server is to test each one and analyze its response.
Command Execution Capabilities
Once communication is established, Xloader can execute a wide range of commands. These include:
- Running PowerShell scripts, executables, or DLL files
- Updating itself
- Deleting itself from the system
- Downloading and executing additional payloads
- Stealing credentials and cookies
- Restarting or shutting down the system
Each command is wrapped in a structured packet and encrypted before being sent.
Indicators of Compromise (IOCs)
Below are known hashes associated with Xloader samples:
316fee57d6004b1838576bb178215c99b56a0bd37a012e8650cd2898041f6785 - Xloader v8.7
59db173fbff74cdab24995a0d3669dabf6b09f7332a0128d4faa68ae2526d39a - Xloader v8.5
6b15d702539c47fd54a63bda4d309e06d3c0b92d150f61c0b8b65eae787680be - Xloader v8.5
Final Thoughts
Xloader is not just another piece of malware — it’s a constantly evolving threat. With layered encryption, advanced obfuscation, and clever use of decoy infrastructure, it remains difficult to detect and analyze.
Security teams need to stay updated and rely on behavioral detection, not just signatures, to catch threats like Xloader.
Our Perspective on This Threat
From our point of view, Xloader represents a clear shift in how modern malware is being designed. It’s no longer just about stealing data — it’s about staying hidden for as long as possible. The effort put into obfuscation and layered encryption shows that attackers are investing heavily in evasion techniques rather than just functionality.
What stands out most is the use of decoy servers and redundant encryption layers. Even when some techniques don’t add real security value, they still increase the workload for analysts. This indicates that slowing down defenders is just as important as avoiding detection.
Another concern is how frequently Xloader is updated. Rapid iteration means traditional defenses can quickly become outdated. Organizations that rely only on static detection methods will likely struggle against threats like this.
In our view, the best defense is a combination of behavioral monitoring, threat intelligence, and continuous analysis. Xloader is a reminder that cybersecurity is no longer reactive — it has to be proactive and adaptive.
