Zero-Dwell Threat Intelligence Reports

XWorm Backdoor Connects to ply.gg C2 With AES-Encrypted Traffic.exe

long-sleeps calls-wmi assembly persistence

Cassiopeia/XWorm Dropper Uses ip-api Recon and Huge Packed Overlay.exe

detect-debug-environment assembly malware

Bladabindi/XWorm RAT Masquerades as VsCode.exe With Telegram C2.exe

detect-debug-environment calls-wmi assembly

Packed XWorm Loader Deploys USB.exe Worm Module and AES-Encrypted C2 Communications.exe

long-sleeps detect-debug-environment calls-wmi

High-Severity MSIL Dropper Deploys VenomRAT Payload and Evades Detection Through Packing.exe

detect-debug-environment checks-user-input assembly

XWorm V5.6 RAT Connects to Hardcoded C2 89.106.206.142:5555 With AES-Encrypted Traffic.exe

detect-debug-environment calls-wmi checks-user-input

XWorm Backdoor Uses Triple DDNS C2 and AES-Encrypted Traffic for Stealth Control.exe

checks-user-input assembly payload

Lazy/XWorm Stealer Dropper Performs ip-api External IP Lookup and Sandbox Evasion.exe

detect-debug-environment calls-wmi assembly malware

XWorm V5.6 RAT Uses Pastebin C2 and Packed Win64 Loader for Stealth Operations.exe

64bits overlay spreader

XWorm Dropper Shows Heavy RCDATA Packing, Pastebin Retrieval, and Classic Delf Behavior.exe

spreader malware

XWorm v6 RAT Emerges With Hardcoded C2 and USB-Worming Features.exe

long-sleeps calls-wmi malware persistence

MasonRAT .NET Uses Pastebin-Hosted C2 Config and Displays NeptuneRAT Backdoor Capabilities.exe

detect-debug-environment idle spreader assembly