Xworm

XWorm is a sophisticated piece of malware designed to infiltrate and exploit computer systems, often without the user's knowledge. It can be delivered through various means such as suspicious downloads, emails, or websites, and once inside a system, it can steal personal information, disrupt operations, or even hold data hostage for ransom. The malware was found in a machine running ScreenConnect client software, and its presence was confirmed through analysis of the svchost.com file using tools like DiE and ExeInfo. This analysis revealed that the file was part of the XWorm malware family and was protected by .NET Reactor. Threat actors have been observed using XWorm in conjunction with other malicious tools such as Async RAT before delivering LockBit payloads built using the leaked Lockbit Black builder. These campaigns utilize an array of tools and malware, including AgentTesla, FormBook, Remcos, LokiBot, GuLoader, Snake Keylogger, and XWorm. In one scenario, a Microsoft Word document initiated a chain leading to the installation of Remcos RAT, while another attack chain deployed XWorm RAT through an Excel file and LokiBot through an RTF document. The XWorm malware is particularly dangerous due to its ability to maintain a connection with the attackers' command-and-control (C2) server and drop plugins including Remcos RAT, XWorm, NanoCore RAT, and a stealer designed for specific crypto wallets. Notably, XWorm can load ransomware or act as a persistent backdoor, giving attackers complete system control to capture keystrokes, screenshots, credentials, and other sensitive information. Following injection and environment verification, the shellcode executes the final malware, XWorm, thereby completing the infection process.