FlagThis

Cybercriminals are exploiting the legitimate Eclipse Jarsigner tool to deploy the XLoader malware, using a DLL side-loading technique. Researchers at AhnLab Security Intelligence Center (ASEC) discovered the campaign, which involves packaging a legitimate jarsigner.exe executable, a tool used for signing Java Archive (JAR) files, with malicious DLL files inside a compressed ZIP archive. When the legitimate executable is run, the malicious DLLs are loaded, triggering the XLoader malware infection. This method allows the malware to evade security defenses by exploiting the trust associated with a legitimate application.

The attack sequence starts with a renamed version of jarsigner.exe (Documents2012.exe) executing, which then loads a tampered "jli.dll" library. This malicious DLL decrypts and injects "concrt140e.dll," the XLoader payload, into a legitimate process (aspnet_wp.exe). XLoader is designed to steal sensitive information, including user credentials, browser data, and system information. The malware can also download and execute additional malicious payloads. Users are advised to exercise caution when handling compressed files with executable files and accompanying DLLs from unverified sources.

ImgSrc: blogger.googleusercontent.com

References:

• Cyber Security News - Cybercriminals Abuse Jarsigner to Spread XLoader Malware - 1d
• gbhackers.com - Hackers Exploit Jarsigner Tool to Deploy XLoader Malware - 1d
• The Hacker News - Cybercriminals Use Eclipse Jarsigner to Deploy XLoader Malware via ZIP Archives - 1d
• cyberpress.org - Cybercriminals Abuse Jarsigner to Spread XLoader Malware - 1d
• Talkback Resources - Cybercriminals Use Eclipse Jarsigner to Deploy XLoader Malware via ZIP Archives [rev] [mal] - 1d
• GBHackers Security | #1 Globally Trusted Cyber Security News Platform - Hackers Exploit Jarsigner Tool to Deploy XLoader Malware - 1d
• SCM feed for Threat Management - Intrusions begin with the spread of a compressed ZIP archive containing a renamed jarsigner.exe file, which when executed prompts the loading of a tampered DLL library and eventual injection of XLoade - 9h

Classification:

• HashTags: XLoader Malware SideLoading
• Company: Eclipse Foundation
• Target: Windows users
• Product: Jarsigner
• Feature: DLL side-loading
• Type: Malware
• Severity: Medium