The newest versions of the evolving “XLoader” botnet have been observed using probability theory to obscure their command-and-control (C2) infrastructures from analysts and lower the risk of losing nodes via tracking, identifying, and blocking. XLoader, an information-stealer botnet, was first discovered in January of 2021, and is known as the successor of the “Formbook” malware, which has a history of targeting both Windows and macOS systems. CheckPoint researchers conducted analysis of XLoader and determined that malware creators developed a way to mask the true C2 infrastructure among a series of decoys. CheckPoint researchers detailed XLoader 2.3 previously began concealing its C2 servers by using sixty-three (63) decoy domains in a configuration with the real C2 domain. Sixteen (16) domains are randomly added to a list by the malware for C2 communication. XLoader 2.5, after each attempt to access the selected domains, partially overwrites the first eight (8) domains listed with new random values within the collection of sixty-four (64) domains. The real C2 domain has a chance of being anywhere in the list. Researchers explained that “if the real C&C domain is in the second part of the list, it is accessed in every cycle once in approximately every 80-90 seconds. If it appears in the first part of the list, it will be overwritten in the next cycle with another random domain name.” If the real C2 domain is amongst the first eight (8) domains in the list, then “the probability that a real C&C server will be accessed in the next cycle is 7/64 or 1/8,” which is dependent on the position of the specific fake C2 servers. This feature demands analysts to perform “a lengthy emulation to derive the actual C2 address, which is an atypical practice and renders all automated scripts useless,” allowing two (2) goals to be achieved: the first being to disguise the real C2 server in common sandbox emulations, and the second to maintain the effectiveness of the malware. It is important to note that “it would be unlikely for XLoader not to contact the genuine C2 address after an hour after infection.” The newest XLoader version (XLoader 2.6) has one (1) functionality change, in which the real C2 server domain is “now accessed in every communication cycle, or once in approximately 80-90 seconds,” when run on a x64 system. When run in a x86 system (as currently many sandboxes still use x86 virtual machines), the real C2 domain has the same access probability as the decoy and fraudulent domains. A list of indicators of compromise (IOCs) as well as screenshots of the above process can be viewed in CheckPoint’s report linked below.