Updated 2025-02-26-IOCs-for-XLoader-infection.txt

PaloAltoNetworks · Feb 26, 2025 · 67a1b2a · 67a1b2a
1 parent a2fde19
commit 67a1b2a
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/2025-02-26-IOCs-for-XLoader-infection.txt b/2025-02-26-IOCs-for-XLoader-infection.txt
@@ -4,6 +4,11 @@ AUTHOR:
 
 - Bradley Duncan
 
+REFERENCES:
+
+- https://www.linkedin.com/posts/unit42_xloader-formbook-malspam-activity-7300644313238016000-5EnT/
+- https://x.com/Unit42_Intel/status/1894878695916970061
+
 INFECTION CHAIN:
 
 - email --> attached PDF --> link to zip archive --> zip contains legitimate EXE that side-loads malware DLL for XLoader
@@ -82,4 +87,4 @@ XLOADER C2 DOMAINS ACTIVE DURING A LIVE TEST RUN OF THE MALWARE:
 - www.maceoconsultores[.]net
 - www.superhoroz[.]xyz
 - www.tokosayur[.]shop
-- www.yusufzdemir[.]xyz
+- www.yusufzdemir[.]xyz