Zero-Dwell Threat Intelligence Reports

MSIL Dropper Executes PowerShell Defender Bypass and Drops nerestpc.exe.exe

long-sleeps detect-debug-environment calls-wmi checks-user-input assembly persistence

Win64 XWorm Backdoor Abuses Shell-Open Registry for Persistence.exe

64bits overlay spreader

Catlavan XWorm Variant Shows Stealer Activity and Dual C2 Channels.exe

detect-debug-environment calls-wmi assembly malware obfuscated

XWorm V6 Dropper Uses Pastebin + Telegram C2 and AES Key.exe

long-sleeps checks-user-input assembly malware

XWorm Variant Fetches C2 From Pastebin and Deploys crvwv.exe.exe

assembly malware obfuscated service-scan

Signed XWorm Backdoor Abuses Shell-Open Registry for Stealth Persistence.exe

64bits overlay spreader

MSIL XWorm Payload Exhibits Trojan Activity and Portmap C2 Communication.exe

long-sleeps calls-wmi assembly

XWorm V5.6 Sample Exhibits AES Encryption, C2 Retrieval, and Dropper Traits.exe

64bits checks-user-input spreader obfuscated

Packed Packy/XWorm Dropper Masquerades as Nixware Crack.exe

long-sleeps checks-user-input assembly

XWorm Backdoor Connects to ply.gg C2 With AES-Encrypted Traffic.exe

long-sleeps calls-wmi assembly persistence

Cassiopeia/XWorm Dropper Uses ip-api Recon and Huge Packed Overlay.exe

detect-debug-environment assembly malware

Bladabindi/XWorm RAT Masquerades as VsCode.exe With Telegram C2.exe

detect-debug-environment calls-wmi assembly