New XLoader botnet uses probability theory to hide its servers

Abstraction: XLoader malware uses law of large numbers to hide C2 servers

Key points:

• XLoader versions 2.5/2.6 (analyzed by Check Point) hide C2 among a 64-domain list, overwriting 8 domains randomly each communication cycle (~80-90 sec)
• Real C2 domain probability of access per cycle is 7/64 or 1/8 depending on its list position; the law of large numbers ensures contact over time
• The scheme defeats automated sandbox analysis since lengthy emulation is required to statistically identify the genuine C2 address
• In 64-bit payloads (v2.6), the obfuscation was removed and the real C2 is contacted directly; 32-bit systems (common in VM sandboxes) retain full obfuscation
• XLoader descends from Formbook and targets both Windows and macOS; entered widespread use in January 2021

Connections: Xloader · Check Point · Malware · Cybersecurity · Probability Theory

Source: https://www.bleepingcomputer.com/news/security/new-xloader-botnet-uses-probability-theory-to-hide-its-servers/