Zero-Dwell Threat Intelligence Reports

Packed XWorm Loader Deploys USB.exe Worm Module and AES-Encrypted C2 Communications.exe

long-sleeps detect-debug-environment calls-wmi

High-Severity MSIL Dropper Deploys VenomRAT Payload and Evades Detection Through Packing.exe

detect-debug-environment checks-user-input assembly

XWorm V5.6 RAT Connects to Hardcoded C2 89.106.206.142:5555 With AES-Encrypted Traffic.exe

detect-debug-environment calls-wmi checks-user-input

XWorm Backdoor Uses Triple DDNS C2 and AES-Encrypted Traffic for Stealth Control.exe

checks-user-input assembly payload

Lazy/XWorm Stealer Dropper Performs ip-api External IP Lookup and Sandbox Evasion.exe

detect-debug-environment calls-wmi assembly malware

XWorm V5.6 RAT Uses Pastebin C2 and Packed Win64 Loader for Stealth Operations.exe

64bits overlay spreader

XWorm Dropper Shows Heavy RCDATA Packing, Pastebin Retrieval, and Classic Delf Behavior.exe

spreader malware

XWorm v6 RAT Emerges With Hardcoded C2 and USB-Worming Features.exe

long-sleeps calls-wmi malware persistence

MasonRAT .NET Uses Pastebin-Hosted C2 Config and Displays NeptuneRAT Backdoor Capabilities.exe

detect-debug-environment idle spreader assembly

Paradise Ransomware Build Detected With Packed PE32+ Layout and Aggressive File-Targeting Logic.exe

64bits payload

Qilin Variant Shows Veeam Indicators, RSA Public Key, and Extensive Network Enumeration.exe

detect-debug-environment

Qilin Loader Executes Process Killing, Enterprise Enumeration, and Full Filecoder Workflow.exe

detect-debug-environment spreader payload