A DNS Investigation of the GootLoader Campaign
WhoisXML API found 1,000+ artifacts that could be connected to the GootLoader campaign. Download the threat research materials now.
Continue reading Download reportProbing the DNS for Signs of XLoader Abuse
XLoader may have been trying to set its sights on macOS users since 2021, but back then, it only successfully targeted those who opted to install Java.
It’s back, though. This time, XLoader’s new variant can infect macOS devices should its user happen to download a rogue OfficeNote package.1
SentinelOne published 19 XLoader indicators of compromise (IoCs)—15 domains extracted from the reported host names and four IP addresses—related to the ongoing attacks. The WhoisXML API research team used them as jump-off points for a DNS deep dive that led to the discovery of:
- 24 unreported IP resolutions, 19 of which turned out to be malicious based on a bulk malware check
- 53 domains that shared some of the IoCs’ seemingly dedicated IP hosts, three of which have been tagged as malicious
- 446 domains that contained text strings found among some of the IoCs like:
- spv88.
- raveready.
- qq9122.
- qhsbobfv.
- pinksugarpopmontana.
Download a sample of the threat research materials now or contact us to access the complete set of research materials.
—
- [1] https://www.sentinelone.com/blog/xloaders-latest-trick-new-macos-variant-disguised-as-signed-officenote-app/