Probing the DNS for Signs of XLoader Abuse | WhoisXML API

Threat Reports

Probing the DNS for Signs of XLoader Abuse

XLoader may have been trying to set its sights on macOS users since 2021, but back then, it only successfully targeted those who opted to install Java.

It’s back, though. This time, XLoader’s new variant can infect macOS devices should its user happen to download a rogue OfficeNote package.1

SentinelOne published 19 XLoader indicators of compromise (IoCs)—15 domains extracted from the reported host names and four IP addresses—related to the ongoing attacks. The WhoisXML API research team used them as jump-off points for a DNS deep dive that led to the discovery of:

  • 24 unreported IP resolutions, 19 of which turned out to be malicious based on a bulk malware check
  • 53 domains that shared some of the IoCs’ seemingly dedicated IP hosts, three of which have been tagged as malicious
  • 446 domains that contained text strings found among some of the IoCs like:
    • spv88.
    • raveready.
    • qq9122.
    • qhsbobfv.
    • pinksugarpopmontana.

Download a sample of the threat research materials now or contact us to access the complete set of research materials.

  • [1]
Try our WhoisXML API for free
Get started