XLoader Executed Through JAR Signing Tool (jarsigner.exe)

AhnLab ASEC discovered a distribution campaign of the XLoader infostealer using DLL side-loading: attackers bundle a legitimate, signed jarsigner EXE (renamed Documents2012.exe) with two unsigned malicious DLLs (jli.dll and concrt140e.dll). The tampered jli.dll exports a single malicious entry point that decrypts concrt140e.dll and injects it into aspnet_wp.exe; the decrypted payload executes XLoader to harvest system and browser data and download additional malware. The report includes two MD5 hashes and a delivery URL as indicators.