MITRE ATT&CKsoftware (malware)

S1207 XLoader

Published 2025-03-11 Modified 2025-03-11 Official page ↗
Domain
enterprise
Platforms
Windows
Aliases
Formbook
Version
1.0
Created
2025-03-11

Description

XLoader is an infostealer malware in use since at least 2016. Previously known and sometimes still referred to as Formbook, XLoader is a Malware as a Service (MaaS) known for stealing data from web browsers, email clients and File Transfer Protocol (FTP) applications.

Related

Uses · MITRE ATT&CK (28)

  • T1685 Disable or Modify Tools technique
  • T1027.013 Encrypted/Encoded File sub-technique
  • T1059.010 AutoHotKey & AutoIT sub-technique
  • T1622 Debugger Evasion technique
  • T1583.001 Domains sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1497.001 System Checks sub-technique
  • T1566.001 Spearphishing Attachment sub-technique
  • T1555.003 Credentials from Web Browsers sub-technique
  • T1056.001 Keylogging sub-technique
  • T1555 Credentials from Password Stores technique
  • T1027.002 Software Packing sub-technique
  • T1070.004 File Deletion sub-technique
  • T1547.001 Registry Run Keys / Startup Folder sub-technique
  • T1055.004 Asynchronous Procedure Call sub-technique
  • T1055.012 Process Hollowing sub-technique
  • T1053.005 Scheduled Task sub-technique
  • T1539 Steal Web Session Cookie technique
  • T1529 System Shutdown/Reboot technique
  • T1497 Virtualization/Sandbox Evasion technique
  • T1203 Exploitation for Client Execution technique
  • T1185 Browser Session Hijacking technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1033 System Owner/User Discovery technique
  • T1082 System Information Discovery technique
  • T1106 Native API technique
  • T1113 Screen Capture technique
  • T1115 Clipboard Data technique

References