X-Worm
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
9 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniquesThe X-Worm malware is being spread through a phishing email... An attacker sent an email with a shortened link that, when clicked, triggered the download of a file named Itinerary.doc_.zip.
An attacker sent an email with a shortened link that, when clicked, triggered the download of a file named Itinerary.doc_.zip.
Execution
2 techniquesThis .lnk file was used to download and run a malicious batch script (output4.bat).
Persistence
2 techniquesThe .lnk file was used to download and run a malicious batch script (output4.bat), which employed bitsadmin to download a harmful payload, disguised as svchost.com, into the %temp% folder.
Privilege Escalation
1 techniqueStealth
3 techniquesThe svchost.com file... was part of the XWorm malware family, protected by .NET Reactor. The malware's code was heavily obfuscated... MD5 hashing, AES encryption in ECB mode, and Base64 decoding to decrypt strings.
...download a harmful payload, disguised as svchost.com, into the %temp% folder.
Collection
1 techniqueThe downloaded .zip file contained a shortcut file (.lnk).
Command and Control
1 techniqueThe malware’s configuration included a host (cyberdon1[.]duckdns[.]org), port (1500), and other parameters like a Telegram token and chat ID.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a malware-as-a-service malware family used as a pricing comparison against WeedHack.
Referenced as another commercially available malware offering, noted for lifetime subscription pricing.
X-Worm is a malware family with capabilities ranging from remote access trojan functionality to ransomware. In this campaign it was delivered via a phishing email containing a shortened link that led to a ZIP archive with an LNK file, which downloaded and executed a batch script that used bitsadmin to fetch the final payload disguised as svchost.com. The analyzed sample was identified as XWorm version 5.6 and included configuration data such as a C2 host, port, Telegram token, and chat ID.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.