Xworm

Malware updated 19 days ago (2024-10-15T10:01:34.432Z)
Download STIX
Preview STIX
XWorm is a sophisticated piece of malware designed to infiltrate and exploit computer systems, often without the user's knowledge. It can be delivered through various means such as suspicious downloads, emails, or websites, and once inside a system, it can steal personal information, disrupt operations, or even hold data hostage for ransom. The malware was found in a machine running ScreenConnect client software, and its presence was confirmed through analysis of the svchost.com file using tools like DiE and ExeInfo. This analysis revealed that the file was part of the XWorm malware family and was protected by .NET Reactor. Threat actors have been observed using XWorm in conjunction with other malicious tools such as Async RAT before delivering LockBit payloads built using the leaked Lockbit Black builder. These campaigns utilize an array of tools and malware, including AgentTesla, FormBook, Remcos, LokiBot, GuLoader, Snake Keylogger, and XWorm. In one scenario, a Microsoft Word document initiated a chain leading to the installation of Remcos RAT, while another attack chain deployed XWorm RAT through an Excel file and LokiBot through an RTF document. The XWorm malware is particularly dangerous due to its ability to maintain a connection with the attackers' command-and-control (C2) server and drop plugins including Remcos RAT, XWorm, NanoCore RAT, and a stealer designed for specific crypto wallets. Notably, XWorm can load ransomware or act as a persistent backdoor, giving attackers complete system control to capture keystrokes, screenshots, credentials, and other sensitive information. Following injection and environment verification, the shellcode executes the final malware, XWorm, thereby completing the infection process.
Description last updated: 2024-10-15T09:28:54.711Z
What's your take? (Question 1 of 5)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Aliases We are not currently tracking any aliases
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Malware
Rat
Remcos
Payload
Trojan
Windows
Ransomware
Github
Screenconnect
Injector
Hp
ConnectWise
Vulnerability
Exploit
Fortiguard
Analyst Notes & Discussion
Be the first to leave your mark here! Log in to share your views and vote.
Associated Malware
To see the evidence that has resulted in these malware associations, create a free account
Alias DescriptionAssociation TypeVotes
The Agenttesla Malware is associated with Xworm. AgentTesla is a well-known remote access trojan (RAT) that has been used extensively in cybercrime operations. It infiltrates systems through various methods, including malicious emails and suspicious downloads. Once inside, it can steal personal information, disrupt operations, or hold data hostageUnspecified
4
The AsyncRAT Malware is associated with Xworm. AsyncRAT is a malicious software (malware) that infiltrates systems through suspicious downloads, emails, or websites, often unbeknownst to the user. Once inside, it can steal personal information, disrupt operations, or even hold your data hostage for ransom. It has recently risen to prominence, raUnspecified
2
The Lockbit Malware is associated with Xworm. LockBit is a type of malware, specifically a ransomware, that infiltrates systems to exploit and damage them. It's known for its disruptive activities such as stealing personal information or holding data hostage for ransom. The LockBit ransomware gang has claimed responsibility for several high-proUnspecified
2
The Agent Tesla Malware is associated with Xworm. Agent Tesla is a well-known malware that primarily targets systems through phishing attacks, exploiting an outdated Microsoft Office vulnerability (CVE-2017-11882). This malicious software is designed to infiltrate computer systems, often without the user's knowledge, and can steal personal informatUnspecified
2
The IcedID Malware is associated with Xworm. IcedID is a prominent malware that has been utilized in various cyber-attacks. It functions as a malicious software designed to infiltrate and damage computer systems, often through suspicious downloads, emails, or websites. Once inside a system, IcedID can steal personal information, disrupt operatUnspecified
2
The Lokibot Malware is associated with Xworm. LokiBot is a malicious software, or malware, that was first reported on October 24, 2020. It is designed to exploit and damage computer systems by infiltrating them through suspicious downloads, emails, or websites, often without the user's knowledge. Once inside, LokiBot steals personal informationUnspecified
2
The NETWIRE Malware is associated with Xworm. NetWire is a type of malware, specifically a remote access trojan (RAT), that has been utilized for various malicious activities since at least 2014. Initially promoted as a legitimate tool for managing Windows computers remotely, NetWire was quickly adopted by cybercriminals and used in phishing atUnspecified
2
The QakBot Malware is associated with Xworm. Qakbot is a potent piece of malware, or malicious software, that infiltrates computer systems through suspicious downloads, emails, or websites. Once installed, it can steal personal information, disrupt operations, or even hold data hostage for ransom. This malware, built by various groups includinUnspecified
2
The Redline Malware is associated with Xworm. Redline is a notorious malware, known for its infostealing capabilities and widespread usage among cybercriminals. It is designed to steal personal data from victims' devices, including usernames, passwords, saved form data like addresses, email addresses, phone numbers, and cryptocurrency wallets. Unspecified
2
Associated Vulnerabilities
To see the evidence that has resulted in these vulnerability associations, create a free account
Alias DescriptionAssociation TypeVotes
The Follina Vulnerability is associated with Xworm. Follina (CVE-2022-30190) is a software vulnerability that was discovered and exploited in the first half of 2022. It was weaponized by TA413, a malicious entity known for its cyber attacks, shortly after its discovery and publication. The vulnerability was used to target the Sophos Firewall product,Unspecified
2
Source Document References
Information about the Xworm Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
PreviewSource LinkCreatedAtTitle
InfoSecurity-magazine
18 days ago
SANS ISC
2 months ago
Contagio
2 months ago
SANS ISC
2 months ago
InfoSecurity-magazine
4 months ago
Checkpoint
5 months ago
BankInfoSecurity
7 months ago
DARKReading
7 months ago
Fortinet
7 months ago
Malware-traffic-analysis.net
8 months ago
CERT-EU
8 months ago
BankInfoSecurity
8 months ago
CERT-EU
8 months ago
CERT-EU
8 months ago
CERT-EU
8 months ago
Securityaffairs
8 months ago
CERT-EU
8 months ago
Trend Micro
8 months ago
CERT-EU
8 months ago
Fortinet
9 months ago