real-time communication

XWorm is a sophisticated strain of malware known for its advanced obfuscation techniques and stealthy nature. A new variant, identified by researchers from NetSkope, is being delivered through Windows script files and has progressed to version 5.6 since its first identification in 2022. The malware initiates infection via a Windows Script File (WSF), which downloads an obfuscated PowerShell script from paste[.]ee, generating files such as “VsLabs.vbs,” “VsEnhance.bat,” and “VsLabsData.ps1” in the C:ProgramDataMusicVisuals directory. It creates a scheduled task named “MicroSoftVisualsUpdater” for persistence. XWorm employs evasive techniques like reflective code loading and process injection into legitimate processes. It communicates with its command and control (C2) server through TCP sockets, using AES-ECB encryption and a modified MD5 hash. Version 5.6 introduces features like the ability to remove plugins and a “Pong” command for response time reporting. The malware conducts extensive reconnaissance on infected systems, alerts attackers via Telegram, and can access sensitive information, establish remote access, and deploy additional malware. It modifies host files to redirect DNS requests and can launch Distributed Denial of Service (DDoS) attacks. XWorm captures screenshots, executes system commands, and downloads additional payloads while maintaining stealth through process monitoring. It utilizes a structured message format for communication with the C2 server, incorporating system information.