Listen to this Post
A Familiar Threat with a Fresh Delivery Twist
XWorm is back in the wild, and while the malware family itself is far from new, its delivery chain continues to evolve in ways that deserve attention. Threat actors are once again demonstrating that creativity, not just code, is their strongest weapon. This latest wave showcases a multi-technology infection chain combining obfuscated JavaScript, layered PowerShell loaders, in-memory execution, and process hollowing to deploy the well-known remote access trojan.
What makes this campaign notable is not just the payload, but the carefully staged execution process that allows it to evade detection and maintain persistence. The infrastructure behind it also connects to previously observed activity, suggesting either an ongoing operation or recycled resources from earlier campaigns.
Below is a clear and structured breakdown of how this XWorm wave operates, what it delivers, and why it matters.
The Initial Stage: Obfuscated JavaScript as the Entry Point
The infection begins with a heavily obfuscated JavaScript file, a classic technique used to hide malicious logic from static analysis tools and security researchers.
Rather than manually reversing the script, executing it safely in a sandbox reveals its behavior. Upon execution, the JavaScript drops a PowerShell script into a temporary directory, specifically under a path resembling:
C:Tempps_5uGUQcco8t5W_1772542824586.ps1
This is a typical loader behavior. The file naming appears semi-randomized, likely to avoid signature-based detection and to blend in with system artifacts.
The PowerShell Loader: Decoding the Next Layer
The dropped PowerShell script acts as a second-stage loader. It decodes another payload using a combination of Base64 encoding and XOR encryption.
This dual-layer encoding approach is simple but effective. Base64 helps disguise binary content within text, while XOR encryption adds another light obfuscation layer. Once decoded, the script executes another PowerShell command directly in memory.
This in-memory execution is crucial. By avoiding writing the final payload directly to disk, the attackers reduce forensic artifacts and minimize the chances of antivirus detection.
The XOR-Encrypted DLL: Process Hollowing in Action
The next stage involves a DLL that is XOR-encrypted but otherwise straightforward once decrypted. Interestingly, it exports a function named “ProcessHollowing,” a surprisingly transparent name for a malicious capability.
Process hollowing is a well-known injection technique where a legitimate process is started in a suspended state, its memory is replaced with malicious code, and then execution resumes. In this case, the malware injects the XWorm client into the .NET compiler process.
This is a strategic move. The .NET compiler is a legitimate Windows component, making the malicious activity blend more naturally into normal system behavior.
The DLL essentially acts as a loader whose sole purpose is to deploy the final XWorm payload through injection.
The Final Payload: XWorm V6.4
The deployed malware is identified as XWorm version 6.4, part of the broader XWorm family.
XWorm is a well-known Remote Access Trojan that provides attackers with extensive control over infected systems. Its capabilities typically include:
Remote command execution
Keylogging
Screen capture
Credential harvesting
File management
Persistence mechanisms
The extracted configuration reveals the following details:
C2 Server: 204[.]10[.]160[.]190:7003
Installation File Name: USB.exe
AES Key: XAorWEAzx4+ic89KWd910w==
Mutex: Cqu1F0NxohroKG5U
Version: XWorm V6.4
The presence of a hardcoded AES key indicates encrypted communications with the command-and-control server. The mutex ensures that only one instance runs on the infected system, preventing instability or duplication.
Infrastructure Overlap: A Previously Observed C2
The command-and-control IP address, 204[.]10[.]160[.]190, is not new. It matches infrastructure previously documented in a campaign involving fake FedEx-themed lures reported by the SANS Internet Storm Center.
That earlier campaign used similar social engineering techniques to distribute malware, suggesting either the same threat actor group or shared infrastructure among operators.
Infrastructure reuse is common in cybercrime. It reduces setup costs and accelerates campaign deployment. However, it also creates valuable correlation points for defenders.
Indicators of Compromise
The campaign includes the following known file hashes:
Inv-4091-CBM-4091-CUSTOM-Packing_List.js
SHA256: 5140b02a05b7e8e0c0afbb459e66de4d74f79665c1d83419235ff0cdcf046e9c
ps_5uGUQcco8t5W_1772542824586.ps1
SHA256: 5a3d33efaaff4ef7b7d473901bd1eec76dcd9cf638213c7d1d3b9029e2aa99a4
MAD.dll
SHA256: af3919de04454af9ed2ffa7f34e4b600b3ce24168f745dba4c372eb8bcc22a21
payload.exe (XWorm)
SHA256: 58e38fffb78964300522d89396f276ae0527def8495126ff036e57f0e8d3c33b
These indicators provide defenders with actionable detection opportunities at multiple stages of the attack chain.
What Undercode Say:
Multi-Technology Chains Are the New Normal
This campaign is a clear example of layered malware execution becoming standard practice. JavaScript drops PowerShell. PowerShell decodes and executes memory payloads. A DLL performs process hollowing. Finally, a mature RAT takes control.
Each layer is relatively simple on its own. Together, they create complexity that challenges static analysis tools and inexperienced analysts.
The lesson here is not that XWorm is advanced. It is that operational chaining makes even common malware difficult to detect.
Obfuscation Is Cheap but Effective
The attackers did not use sophisticated encryption. They used Base64 and XOR. These are beginner-level techniques from a cryptographic standpoint.
Yet they remain effective.
Why? Because detection systems often rely on patterns. Slight variations in encoding or script structure are enough to bypass signature-based controls.
Attackers do not need military-grade encryption when operational noise and automation are enough to slip through defenses.
Process Hollowing Remains a Favorite
Process hollowing is not new. It has been used for years across malware families.
But its continued use highlights something important: many environments still struggle to detect in-memory injection techniques.
Monitoring for abnormal child processes, suspicious PowerShell execution, and .NET compiler misuse should be baseline detection rules in enterprise environments.
Infrastructure Reuse Is an Intelligence Opportunity
The reuse of the same C2 infrastructure seen in previous campaigns is a gift to threat intelligence teams.
Infrastructure pivoting allows defenders to:
Identify related campaigns
Track actor behavior over time
Correlate phishing themes
Build proactive detection rules
When actors recycle IP addresses, they leave fingerprints behind.
The Real Risk Is Accessibility
XWorm is widely available in underground forums. It is marketed as an affordable and easy-to-use RAT.
This democratization of malware lowers the barrier to entry. You do not need to be an advanced developer to launch campaigns anymore.
You just need a builder kit, a hosting provider, and a phishing template.
That accessibility transforms mid-level criminals into capable operators.
Defenders Must Shift Focus
Traditional antivirus alone is insufficient against these chains.
Organizations should prioritize:
Script execution monitoring
PowerShell logging and transcription
Memory injection detection
EDR behavioral analytics
Network traffic inspection for encrypted C2 patterns
Behavioral detection, not just file-based detection, is essential.
Fact Checker Results
✅ XWorm V6.4 configuration details match the extracted data presented in the campaign analysis.
✅ The C2 IP address 204[.]10[.]160[.]190 has been associated with previous documented malicious activity.
✅ The infection chain uses JavaScript, PowerShell, XOR decoding, and process hollowing as described.
Prediction
🔮 XWorm operators will continue refining delivery chains rather than rewriting the core malware.
🔮 Infrastructure reuse suggests either confidence in low detection rates or disposable hosting models that reduce operational risk.
🔮 Multi-stage PowerShell-based loaders will remain a dominant infection vector throughout the year due to their flexibility and evasion capabilities.
🕵️📝✔️Let’s dive deep and fact‑check.
References:
Reported By: isc.sans.edu
Extra Source Hub (Possible Sources for article):
https://www.discord.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
Bing
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon
