obfuscation[.]inDomain

Reported by 1 independent source · first reported 31 Mar 2026 by Zscaler ThreatLabz · last reported 31 Mar 2026

Last reported 6 months ago

What the reports say

1 report, newest first · the exact sentence from each

“…ue bytes using a bitwise XOR operation, as shown in the figure below.Figure 2:  An example of Xloader’s function prologue bytes obfuscation[.]In addition to the enhancements described above, the custom decryption routine that Xloader uses to decrypt data is now obfuscated…”

Zscaler ThreatLabzVendor31 Mar 2026
Latest Xloader Obfuscation Methods and Network Protocol

named in the same reports

Copy these 8 indicators · defanged

8 indicators, defanged, one per line

8.1[.]in
8.1[.]network
actions[.]network
layers[.]network
specified[.]as
data[.]as
script[.]windows
file[.]windows

Thanks — we review every report.

Report a wrong value