| | Details | | :--- | :--- | | First Discovered | 2022 | | Language | C# (.NET-based) | | Version of Interest | XWorm v5.6 (last original version by XCoder) | | Primary Capabilities | Info-stealer, Ransomware, DDoS, Keylogger, Remote Desktop | | Key Persistence Methods | Registry Run Key, Scheduled Tasks, Startup Folder | | Notable Evasion Techniques | AMSI Bypass (via CLR.DLL patching), Process Hollowing, Fileless Execution | | Major Attack Vectors | Phishing emails, Malicious .LNK files, Trojanized software installers, Fake CAPTCHA pages |
Unusual outgoing network traffic, often to known malicious command-and-control (C2) servers. Persistent processes added to the Windows Registry. How to Protect Yourself from XWorm XWorm-5.6-main.zip
: Phishing emails with malicious attachments (.zip, .doc, .xlsm) or malicious URLs Key Capabilities | | Details | | :--- | :---
