XWorm V3.0 RAT License Listed for Sale on Darknet

Capabilities and Behavior of XWorm V3.0

XWorm is a commercially distributed malware family developed within the Microsoft .NET framework, commonly compiled using Visual Basic .NET or C# into MSIL binaries. Once executed on a target host, the malware establishes comprehensive administrative control, turning unmanaged workstations into remotely accessible botnet nodes. Its design combines information-stealing routines with broad remote surveillance features, allowing an operator to execute commands without user consent.

The internal architecture of XWorm V3.0 relies on dedicated namespaces and modules configured to perform targeted malicious actions:

• Stub.Main: Acts as the primary orchestrator, managing initialization routines, sandbox detection checks, and configuration extraction.

• Stub.AlgorithmAES: Provides symmetric AES-ECB encryption and decryption routines used to secure embedded configuration blocks and obfuscate outbound command and control communications.

• Stub.ClientSocket: Manages persistent raw TCP socket channels, packet dispatching, keep-alive timers, and automated reconnection logic.

• Stub.XLogger: Deploys low-level Windows keyboard hooks via the SetWindowsHookEx API to capture keystrokes across applications in real time.

• Stub.Messages: Houses the command parsing dispatcher, interpreting inbound tasking from the threat actor and invoking specific plugin routines.

• Stub.Uninstaller: Handles clean artifact removal, deleting persistence keys and host binaries upon an operator termination command.

Beyond traditional remote administration, XWorm incorporates automated credential harvesting targeting stored web browser credentials, crypto wallet files, and desktop tokens. It also features clipboard-monitoring capabilities designed to substitute cryptocurrency wallet addresses with operator-controlled addresses in memory.

Infection Chain and Persistence Mechanisms

The typical delivery chain for XWorm involves multi-stage loaders engineered to evade static signature detection before releasing the core payload into system memory.

Delivery and Loader Execution

Threat actors deploy XWorm through high-volume malspam campaigns carrying weaponized archive attachments such as ZIP, LZH, or ISO containers. In other cases, malicious LNK shortcut files initiate background downloads via WebDAV or script interpreters. The outer loader stub uses high-entropy packing and dynamic invocation via System.Reflection.Assembly.Invoke to unpack the encrypted MSIL binary into RAM, avoiding early disk-based scanning.

Process Injection and Defense Evasion

To mask its presence during active operations, XWorm frequently employs process hollowing techniques. The loader spawns legitimate Windows binaries in a suspended state, such as vbc.exe, RegAsm.exe, svchost.exe, or MSBuild.exe. The loader then unmaps the legitimate executable code using native APIs, writes the decrypted XWorm payload into the allocated space, and resumes the primary thread.

Establishing Persistent Execution

To sustain unauthorized access through system reboots, XWorm configures multiple persistence footholds across the Windows operating system:

• Registry Run Keys: Appending entries under HKCU\Software\Microsoft\Windows\CurrentVersion\Run pointing directly to hidden payload drops in %APPDATA% or %TEMP%.

• Startup Directory Links: Creating disguised shortcut files within the user startup directory at %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup.

• Windows Scheduled Tasks: Registering system tasks configured to trigger at logon or on repeating schedules under elevated execution contexts.

Organizations must continuously audit external perimeters and internet-facing endpoints through Attack Surface Management to detect exposed services and misconfigurations that facilitate these delivery chains.

Command and Control Infrastructure

Communication between the compromised host and the threat actor is governed by lightweight, low-overhead networking modules. XWorm establishes direct, raw TCP socket connections to remote IP addresses on non-standard ports, bypassing generic HTTP filtering when deep packet inspection is absent.

Network traffic sent across the command channel is wrapped in a custom delimiter protocol, utilizing markers such as <XWorm> or custom tag identifiers to structure data packets. Payload contents, telemetry strings, and harvested system details are encrypted using AES-ECB with a key baked into the client configuration. In specialized variants, operators can also configure fallback HTTP check-ins or leverage the Telegram Bot API to relay heartbeat telemetry when direct socket connections are blocked by perimeter firewalls.

Detection Logic and Indicators of Compromise

Detecting XWorm requires a combination of behavioral analysis on the endpoint and network-layer inspection for unauthorized socket activity.

Host-Based Behavioral Signatures

Security Operations Center (SOC) teams should configure Endpoint Detection and Response (EDR) platforms to flag the following indicators:

• Script engines such as wscript.exe, cscript.exe, or powershell.exe spawning from user writable directories (%TEMP%, %APPDATA%) and establishing external network sockets.

• Native Windows utilities like vbc.exe or RegAsm.exe initiating unexpected outbound network connections.

• API sequences typical of process hollowing, notably VirtualAllocEx, WriteProcessMemory, and ResumeThread calls executed between unrelated processes.

YARA Detection Rule

rule Trojan_Win32_XWorm_Ident
{
    meta:
        description = "Detects structural indicators and classes of XWorm RAT"
        threat_level = "High"
    strings:
        $cls1 = "Stub.AlgorithmAES" ascii wide
        $cls2 = "Stub.ClientSocket" ascii wide
        $cls3 = "Stub.XLogger" ascii wide
        $cls4 = "Stub.Messages" ascii wide
        $proto1 = "<XWorm>" ascii wide
        $proto2 = "[XWORM V" ascii wide
    condition:
        uint16(0) == 0x5A4D and (2 of ($cls*) or (1 of ($cls*) and 1 of ($proto*)))
}

Indicators of Compromise (IoCs)

The following technical indicators have been associated with active XWorm distribution campaigns and command infrastructure:

• Core Payload Hash (SHA-256): b4ae0aa38f19cf8c917061bcd03ee501ec97faac1582d0b8ca488f8c97c00a53

• Delivery Sample Hash (SHA-256): 21432bcec2d1df855e85a64b3bfbcae8f5031ce449f2c4652076db7bdea375a2

• Secondary Payload Hash (SHA-256): 372d7d8ca222e03afa5970848cf88efa6a3bc5146d20398601285fc7eaea6735

• C2 IPv4 Address: 103.231.12.27

• C2 Domain Name: harivo.vip

Removal and Recovery Procedures

When an active XWorm infection is confirmed on an enterprise system, incident response teams must follow a structured containment and eradication workflow:

• Network Isolation: Disconnect the infected host immediately from corporate local networks, Wi-Fi, and active VPN tunnels to terminate the interactive C2 channel and stop potential lateral movement.

• Credential Invalidation: Because XWorm actively logs keystrokes and extracts browser credential stores, all Active Directory passwords, cloud account sessions, and multi-factor authentication tokens accessed from that device must be revoked and reset.

• Process Termination and Persistence Eradication: Terminate the hollowed host process using EDR controls, delete dropped executable files from %APPDATA% and %TEMP%, and remove corresponding Registry Run keys and scheduled tasks.

• System Reimaging: In enterprise environments, full endpoint reimaging from a known-good gold image is strongly advised to eliminate stealthy secondary payloads or rootkits deposited during the intrusion.

• Firewall Ingress and Egress Review: Block outbound communication to known C2 IP addresses and audit perimeter firewall policies to restrict arbitrary high-port outbound TCP sockets.