The Evolution of an Infostealer: Xloader 8.7 Unmasked

ThreatLabz provides a deep-dive analysis of Xloader (formerly Formbook), tracking its evolution to version 8.7 and highlighting advanced code obfuscation, RC4-encrypted C2 communications, decoy C2 addresses, and capabilities such as credential and cookie theft, remote command execution, arbitrary payload execution, and self-removal; the report emphasizes the difficulty of automated and manual analysis and recommends defenders thoroughly study the malware to improve detection and mitigation.