BLACK FRIDAY: 2-for-1 offer NOVEMBER 20 - 26 See details

XWorm

24
Global rank
7 infographic chevron month
Month rank
7 infographic chevron week
Week rank
0
IOCs

XWorm is a remote access trojan (RAT) sold as a malware-as-a-service. It possesses an extensive hacking toolset and is capable of gathering private information and files from the infected computer, hijacking MetaMask and Telegram accounts, and tracking user activity. XWorm is typically delivered to victims' computers through multi-stage attacks that start with phishing emails.

RAT
Type
Ex-USSR
Origin
15 July, 2022
First seen
14 September, 2024
Last seen

How to analyze XWorm with ANY.RUN

RAT
Type
Ex-USSR
Origin
15 July, 2022
First seen
14 September, 2024
Last seen

IOCs

IP addresses
193.161.193.99
146.190.110.91
147.50.240.203
212.92.254.164
147.185.221.22
104.250.180.178
139.99.85.129
38.180.136.28
178.46.152.8
139.99.25.159
147.185.221.20
5.29.102.47
62.113.117.95
172.183.211.241
105.120.132.213
194.156.79.149
147.185.221.21
45.141.26.197
141.98.7.56
89.213.177.93
Hashes
4c18360c4b176fb068bc117c30e602eb0026a705b5a0673d3ea461c927bd71cb
66f27c057ae2e572446d6b26e0437711957ad7f9c19cd166d2274989a5506960
10265ef7d6568a1b67cd65013ecc2bb5bf98b11b8186a5f13f432da0c69613b6
4a1d4d9ba5d20036d58353f7f1d93f626cf2d1a1aa1af4b3c020fc06cf3cca3a
6566a8d7bf93a77705708899eed08f601623ad6bf6397ba15e951a8ce004a356
ac009da131ecc35c95b484248fcd3091f607d71f26f7421699b2a8c907b1ee04
6aca88e0fefaa47998bab8cd4b8eee3257b52d86d421f62da3f12a661108a6ec
3c0e2dd40fd5d433ff262ac25ea19a26634ececa7b841e11e4c058841cf3d6e7
fb6030901766855bd7c744c8b3718248014f53c72562191fe6bac6468d48b476
2958cfd4e636a261ddfb081e98944fc60c5dd63049dc8f73f05ce244a8b21637
cadf6bccaa2d299775d6566813aadded5a715cbd6f3633ee5fca4bd6b3417da9
dafef03b5ec0d8821003c6e823f7888179a90e2726b34e6242ab24449b37a4d6
ec6a6aa9a75e81c6069edc6bd5e246062ae923348d7c2221eb5f8fa3f59b63a8
f3bf94ab1d561cf85c832ac7e97329a763943a8d191dfdb9b0a1cb08ab20f914
eef14366a8910998a21b02bbc3180c87a110d6900897e918ee5810a0dba6fdf0
c1f5f4ac445c4d40ba9127e9df19be7b0bc544850e8df8f80008e71b94309b86
070d2bbbcacdbb4ba3ec53afe70d362e7d6b644e14a73a9a9c1c7adacceaf6f7
67fba308749c7916ae1c20d2167147d4dd4a806d790dbf94b60eca64a9103bb5
e5fd962cfc545edc3c5fb1442e50d4ede4e8ff4b57c805c09047df3ed8481547
cb31b4f8c67122dd77a48cea675de9b06748fbbadd95bd2add8733aa92a7977a
Domains
huge-discussing.gl.at.ply.gg
korkos.now-dns.net
earth-rica.gl.at.ply.gg
every-cg.gl.at.ply.gg
22.ip.gl.ply.gg
uogapk7.ddns.net
friedlyhelpinghehe-45402.portmap.host
clxpv3-51562.portmap.host
0.tcp.eu.ngrok.io
limited-architect.gl.at.ply.gg
y-lbs.gl.at.ply.gg
town-lime.gl.at.ply.gg
keep-forth.gl.at.ply.gg
reserved2021whsjsr.mywire.org
contract-language.gl.at.ply.gg
inn-ht.gl.at.ply.gg
taraji111.duckdns.org
told-contacts.gl.at.ply.gg
oman101.duckdns.org
final-consequently.gl.at.ply.gg
URLs
https://pastebin.com/raw/Q9e5dCEL:<123456789>
https://pastebin.com/raw/smAVjtZk:<123456789>
https://pastebin.com/raw/RPPi3ByL:<123456789>
https://pastebin.com/raw/sgmAd7Py:<123456789>
https://pastebin.com/raw/FAWEEx9p:<123456789>
https://pastebin.com/raw/kTrgfRNT:<123456789>
https://pastebin.com/raw/Gncgsqid:<123456789>
https://pastebin.com/raw/jxfGm9Pc:<123456789>
https://pastebin.com/raw/1WVS8u8F:<123456789>
https://pastebin.com/raw/1NLkRNBp:<123456789>
https://pastebin.com/raw/zs3YKzJ3:<123456789>
https://pastebin.com/raw/ZnhxAV6a:<123456789>
https://pastebin.com/raw/jkmUR9iK:<123456789>
https://pastebin.com/raw/BdgsZDZW:<123456789>
https://paste.tc/raw/aaa-48143:<123456789>
https://pastebin.com/raw/Ezv39idx:<123456789>
https://pastebin.com/raw/X4Zf0q6k:<123456789>
https://pastebin.com/raw/Z9jGeKcD:<123456789>
https://pastebin.com/raw/fqZCUyFU:<123456789>
https://pastebin.com/raw/7THVri4L:180508
Last Seen at

Recent blog posts

post image
ANY.RUN Now Integrates with Splunk!
watchers 316
comments 0
post image
How to Analyze Malware in ANY.RUN Sandbox: Er...
watchers 365
comments 0
post image
Security Training Lab: Educational Program fo...
watchers 1162
comments 0

What is XWorm malware?

XWorm is a remote access trojan (RAT) that gives cybercriminals unauthorized access to a victim's computer. It is a modular malware, meaning that it can be customized to perform a variety of malicious tasks, such as stealing sensitive data and cryptocurrency, launching DDoS attacks, and deploying ransomware. It first came into the spotlight in July 2022 and is believed to have originated in the ex-USSR.

XWorm is sold as a malware-as-a-service (MaaS), which makes it extremely dangerous. It lowers the barrier to entry and opens hacking opportunities to more people. Since its first appearance in the global threat landscape in July 2022, XWorm has gone through several iterations. As of August 2023, the 4.2 version and the 5.0 version were the latest ones available for purchase.

Criminals use multi-stage attacks to deploy XWorm on victims’ computers. For example, an attack might start with a phishing email that contains a malicious Word document attachment. When the document is opened, it will load an .rtf file from an external link. This file will contain an Excel spreadsheet with macros that will execute a PowerShell script, which will then download XWorm onto the computer.

Technical details of the XWorm malicious software

XWorm is developed with the .NET Framework, which makes it a significant threat to Windows systems. The malware is also configurable, offering a wide range of tools for manipulating the infected machine.

Here are some of XWorm’s key capabilities:

  • Encrypted connection: XWorm is capable of maintaining a secure connection with its C&C server, even during poor network conditions.
  • Information gathering: The malware can collect a wide range of information from the infected computer, including credit card numbers, browsing history, bookmarks, downloads, as well as Firefox and Chromium passwords and cookies.
  • Account hijacking: XWorm can hack Discord, Telegram, and MetaMask accounts, as well as get hold of WiFi keys and product keys.
  • User activity tracking: The malware enables attackers to monitor the victim’s activities on their computer by logging their keystrokes, automatically saving webcam images, listening to their microphone, scanning their network connections, and viewing opened windows.
  • Clipboard access: XWorm can retrieve the information that has been copied to the clipboard and replace victims’ crypto wallet credentials with those of the attacker.
  • File management: It can gain control of a computer’s file system to transfer sensitive documents and content to its C2 or download additional malware and run it.

Get started today for free

Easily analyze emerging malware with ANY.RUN interactive online sandbox

Register for free

In order to bypass User Account Control (UAC), XWorm attempts to get administrator permissions on the infected computer. This allows it to make changes to the system without requiring user consent. To ensure persistence, the malware adds itself to the list of programs that run automatically when the computer starts up by editing the registry.

It is also polymorphic, meaning that the malware’s code regularly transforms itself to throw detection software off course. Although XWorm has a built-in functionality to terminate its execution once it senses that it is launched in a virtualized environment, the ANY.RUN sandbox has no problem identifying the malware.

XWorm’s configuration

XWorm’s configuration

Execution process of XWorm

The malicious behavior of XWorm can be easily uncovered by uploading it to the ANY.RUN sandbox. Here is a sample of this malware on the platform.

Immediately upon execution, XWorm drops an executable file into the Startup directory (“C:\Users\admin/AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XWorm.exe”) and into the Roaming directory (“C:\Users\admin/AppData\Roaming\XWorm.exe”).

XWorm’s process graph

XWorm’s process graph

For the latter directory, a persistent service is created using the Task Scheduler. Malware checks for an external IP, which we can bypass with ANY.RUN’s Residential Proxy feature. After this, XWorm starts sending beacons to the C&C server, waiting for commands to execute.

Read a detailed analysis of XWorm in our blog.

Use ANY.RUN free for 14 days

Try the full power of interactive analysis

Start your free trial

Distribution methods of the XWorm malware

As with most malware families, email phishing campaigns serve as XWorm’s main gateway to victims’ computers. The attack begins with an email containing an attachment. By exploiting different social engineering techniques, threat actors can persuade a user to download the attached file and open it.

Analysts have observed several file formats used by attackers, including .rtf, .lnk, and .pdf. In most cases, the email attachment itself does not contain any macros and is used primarily to kick off a chain reaction that involves downloading several other files, executing PowerShell scripts, and finally delivering the payload.

Such attacks can be facilitated by specialized tools, such as Freeze[.]rs and SYK Crypter, which are equipped with advanced capabilities for circumventing defense systems to drop a variety of malware families including Remcos RAT, njRAT, and RedLine Stealer.

One of the most recent XWorm attacks targeted businesses in Germany. It involved sending a .docx document to victims with a name that suggested it contained hotel reservation information. Instead of using macros, the file exploited the Follina vulnerability (CVE-2022-30190) to run external malicious files and a PowerShell script, which eventually dropped XWorm.

Conclusion

XWorm retains considerable staying power due to the consistent updates and wide availability, making it a top concern for organizations around the world. To protect your system from this threat, you need to have a stricter approach towards handling any links or files arriving in your inbox from unknown senders.

Instead of downloading documents and opening URLs, you can first analyze them in the ANY.RUN sandbox to quickly understand whether the file is malicious or not. ANY.RUN also provides you with a detailed report about the malware, such as its IOCs and TTPs. This information can be used to protect your organization from future attacks.

Try ANY.RUN for free – request a demo!

HAVE A LOOK AT

Adwind screenshot
Adwind
adwind trojan
Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat, and JSocket, is a Malware As A Service Remote Access Trojan that attackers can use to collect information from infected machines. It was one of the most popular RATs in the market in 2015.
Read More
Agent Tesla screenshot
Agent Tesla
agenttesla trojan rat stealer
Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.
Read More
Amadey screenshot
Amadey
amadey
Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.
Read More
Arkei screenshot
Arkei
arkei stealer
Arkei is a stealer type malware capable of collecting passwords, autosaved forms, cryptocurrency wallet credentials, and files.
Read More
AsyncRAT screenshot
AsyncRAT
asyncrat
AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.
Read More
WarZone screenshot
WarZone
warzone avemaria stealer trojan rat
WarZone RAT is a remote access trojan, which is written in C++ and offered as a malware-as-a-service. It packs a wide range of capabilities, from stealing victims’ files and passwords to capturing desktop activities. WarZone RAT is primarily distributed via phishing emails and receives regular updates from its C2.
Read More