Hackers Abuse LuaJIT and Windows Process Injection to Hide XLoader Credential-Stealing Malware

A new XLoader infection chain. It hides the credential stealer inside an embedded LuaJIT interpreter.

It moves it into another Windows process through shared-section injection. The campaign uses business-themed email lures. It also delivered Agent Tesla, Remcos and XWorm .

The chain starts with order and payment emails. One Greek-language message has a subject starting “RE:” to imply an ongoing exchange.

It asks the recipient to confirm order 001828 and is sent to “undisclosed-recipients”. Slovenian and quotation-themed variants were also observed.

Each carries a RAR archive that holds a single obfuscated JScript instead of an order document .

Windows Script Host runs the script. It tries to blank its own Zone.Identifier stream, which removes the mark-of-the-web.

It then decodes two embedded Base64 blobs through Microsoft.XMLDOM and writes them with ADODB.Stream to the user’s Documents folder.

These are an x86 LuaJIT-compatible executable named EHFTUOMQDRXVTJSF.exe and an extensionless Lua file named FSJTVXRDQMOUTFHE. Nothing is downloaded at this stage. The script launches the interpreter hidden and does not wait for it to finish .

The loader uses LuaJIT’s FFI to call Windows APIs. It hides the console and tries to weaken defenses inside its own process.

One routine zeroes AmsiScanBuffer and AmsiInitialize strings in CLR memory. Another overwrites 12 ntdll exports, including EtwEventWrite and NtTraceEvent, with a RET followed by NOPs.

Morphisec stresses that this shows intent, and the researchers did not observe successful patching on a host .

A conditional persistence branch is triggered by a .mui marker file. It can create a scheduled task that runs a VBS launcher every ten minutes. The first-run path never creates that marker, so the researchers treat this as a capability and not a confirmed behavior .

Morphisec has observed that, the loader then decodes a 382,982-byte literal that begins with “|K”. It applies a substitution, reverses the text, runs a custom Base64 decode and a rotation, and maps the resulting packed PE32 into LuaJIT’s memory.

XLoader Malware Attack

The mapper calls CreateRemoteThread but passes GetCurrentProcess(), so the thread runs inside LuaJIT .

The packed PE has one high-entropy .text section, with entropy of about 7.9937 bits per byte, and no import table. It walks the PEB to find ntdll, resolves NtAllocateVirtualMemory and allocates 0x45031 bytes of executable memory.

It then decrypts a 0x43400-byte region with RC4. A second RC4 pass runs over 15 blocks of 0x47BB bytes, and the cipher is reinitialized for each block. The packer then calls the XLoader core on the same thread .

The core decrypts its injector only while a wrapper runs. The wrapper decrypts the 0x656-byte body, executes it and re-encrypts it afterwards. This leaves little plaintext in memory for scanners to find .

The injector clones the stage and picks an x86 target. It either finds a running process or starts a suspended SysWOW64 host.

The 12 candidate hosts are cleanmgr.exe, clip.exe, TSTheme.exe, getmac.exe, UserAccountControlSettings.exe, proquota.exe, SearchProtocolHost.exe, mobsync.exe, mshta.exe, ftp.exe, fsutil.exe and find.exe .

It maps one shared section into both processes. It then sets the target thread’s context so execution enters the mapped bootstrap at remote_view + 0xC9C1.

It copies the clone through its local view and resumes the thread. This avoids WriteProcessMemory and remote-thread creation, which many detections watch for.

The target’s original image stays mapped, so Morphisec classes this as shared-section injection with thread-context redirection and not process hollowing.

The XLoader code can then run HTTP GET commands, enumerate the Windows Vault and prepare cookie records.

Morphisec has tracked Lua-based loaders before. A 2025 campaign used lua51.dll with a thin loader to run obfuscated scripts against students and gaming engines.

GuLoader, another loader, has also distributed XLoader, Remcos and other families . Morphisec has also documented a similar section-mapping and thread-resume technique in Agent Tesla chains.

Defenders should block RAR-delivered script files and monitor wscript.exe launching executables from Documents.

They should also alert on unexpected SysWOW64 utilities that start suspended and on shared-section mappings between unrelated processes. Morphisec says its Automated Moving Target Defense is designed to stop this kind of in-memory execution.

Indicators of Compromise

Indicator	Type	Context
Παραγγελία 00182`8.rar	Filename	Attachment in both captured EMLs
Παραγγελία 00182`8.JS	Filename	Sole member of the RAR
%MyDocuments%\EHFTUOMQDRXVTJSF.exe	File path	Dropped LuaJIT host
%MyDocuments%\FSJTVXRDQMOUTFHE	File path	Dropped extensionless Lua loader
%MyDocuments%\EHFTUOMQDRXVTJSF.mui	File path	Marker for conditional persistence

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.