Everything he touches, he destroys
10.03.2025 14:31
👍 0
🔁 0
💬 0
📌 0
Everything he touches, he destroys
RIP
Screenshot of my blog post with analysis of the XLoader infection.
XLoader distributed as a RAR attachment to an email. The malware is a Windows executable file within that RAR archive.
Traffic from the XLoader infection filtered in Wireshark.
XLoader persistent on the infected Windows host through a Windows registry update.
2025-01-30 (Thursday): #XLoader infection. Unlike my previous XLoader infections, this one didn't run in my VM, so I used a physical host. A #pcap of the infection traffic, the associated malware samples, and more info is available at malware-traffic-analysis.net/2025/01/30/i...