Xworm-5.6-main.zip [patched] (2024)

Allows attackers to view and interact with the victim's screen in real time.

Extracts saved passwords, credit card details, cookies, and autofill data from popular web browsers.

If XWorm infection is detected:

This allows the attacker to open a second, invisible desktop session that the user cannot see, allowing them to perform malicious actions while the user continues their work undisturbed.

The primary distribution method involves phishing emails containing malicious attachments. Recent campaigns have used multiple themes and languages, including payment detail requests, purchase orders, and signed bank documents. The emails instruct recipients to open attached files to view additional details.

Attackers can then perform remote desktop control, steal credentials, exfiltrate data, or deploy ransomware across the compromised network.

Version 5.6 of XWorm features advanced functionalities designed to evade detection and maximize damage. Its primary capabilities include:

Version 5.6 represents a mature stage in the malware's lifecycle. In this version, the developer optimized evasion techniques, stabilized command-and-control (C2) communication protocols, and integrated advanced modules. This allows it to function simultaneously as a RAT, an information stealer, a ransomware strain, and a botnet loader. Core Capabilities of XWorm 5.6

Security teams should monitor for or other legitimate-looking hosting sites that are not typically used by the organization. Additionally, be alert for unusual outbound connections from internal hosts that might indicate C2 beaconing.

One of the primary distribution methods for XWorm involves malicious archives shared via public repositories and file-sharing platforms. The specific file "XWorm-5.6-main.zip" has been identified by security researchers as one such payload distribution vector.

XWorm-5.6-main.zip ├── XWorm v5.6.exe (The builder and controller) ├── stub/ (The client payload generator) ├── plugins/ (Additional modules like ransomware) ├── config.ini (Default C2 settings) └── readme.txt (Pirated instructions for deployment)

XWorm-5.6-main.zip can be distributed through various means, including:

Threat actors have also utilized Discord as a delivery vector, distributing weaponized archives disguised as legitimate game modifications or community plugins.

It is important to note that this version of XWorm contains a known vulnerability—a remote code execution (RCE) flaw that security researchers have since documented and created exploits for. This flaw allowed defenders to potentially disrupt the malware's C2 panel, though it has since been addressed in later versions like 6.0.