What is the Xlm.trojan.abracadabra.8.gen Trojan?

The name Xlm.trojan.abracadabra.8.gen is the designator and detection name given to a version of the Abracadabra Trojan.

This particular strain has been around for a few years now, first detected in mid-2020. The original campaign used to spread the malware was using a malicious encrypted Excel file. When a user attempted to open the malicious file, it decrypted itself using a default embedded password. The password string used was "VelvetSweatshop".

The reason for using an encrypted file is better threat detection avoidance. Anti-malware software cannot scan and detect the malicious payload inside the file while it exists in its encrypted state and the office application does not have access to the payload before the file is fully decrypted.

The Abracadabra Trojan has a number of malicious capabilities, including establishing persistence and communicating with the C2 server to download further malicious files.

The campaign spreading the Abracadabra Trojan used malicious spam emails tailored to look like overdue invoices sent to victims.