Cybercriminals use a legitimate Jarsigner within a ZIP archive to deploy XLoader malware. A modified DLL in the archive decrypts and injects XLoader (concrt140e.dll) into aspnet_wp.exe via DLL side-loading, bypassing security. XLoader steals data and downloads more malware.#ZipArchiveMalware
February 20, 2025 at 12:05 PM
Cybercriminals use a legitimate Jarsigner within a ZIP archive to deploy XLoader malware. A modified DLL in the archive decrypts and injects XLoader (concrt140e.dll) into aspnet_wp.exe via DLL side-loading, bypassing security. XLoader steals data and downloads more malware.#ZipArchiveMalware