XWorm V6 Variant with Enhanced Anti-Analysis Techniques Strikes Windows Users in the Wild

The threat landscape is witnessing the resurgence of the XWorm malware family, with its latest version, XWorm 6.0, revealing significant advancements in both persistence and anti-analysis methodologies.

Netskope Threat Labs, after nearly a year of tracking XWorm’s activities, has unearthed the deployment of version 6.0 in ongoing attack campaigns.

This new iteration, still propagated via sophisticated social engineering ploys, demonstrates continued development and enhanced stealth characteristics, elevating the risk posed to Windows environments globally.

Sophisticated Infection Chain

The infection chain remains consistent with earlier XWorm versions but is now more robust and multilayered. The attack commences with a VBScript dropper, typically delivered through phishing.

This dropper does not simply execute its payload; rather, it reconstructs a second, obfuscated VBScript at runtime by iterating through an array of character codes, converting them into Unicode characters, and concatenating them into the real script, which is then executed via eval.

This reconstructed script removes forensic traces by deleting its own Zone.Identifier metadata, executes a PowerShell command to fetch a further payload, and establishes long-term persistence by copying itself as update.vbs into both the TEMP and APPDATA directories and modifying the critical Run registry key to ensure execution upon reboot.

What distinguishes XWorm 6.0 from previous samples is its new persistence strategy. While earlier versions leveraged scheduled tasks, the latest variant pivots to registry-based persistence, underlining the flexibility available to attackers through the XWorm “client builder.”

This adaptability means defenders should expect to see combinations of persistence techniques scheduled tasks, registry keys, and even startup folders deployed in live environments depending on attacker preferences.

Innovative Evasion with AMSI Bypass

Once persistence is established, XWorm’s infection chain leverages an advanced PowerShell script adept at bypassing the Windows Antimalware Scan Interface (AMSI).

By patching the CLR.DLL module in process memory and nullifying the AmsiScanBuffer string, the malware prevents AMSI from inspecting potentially malicious content.

This technique, adapted from open-source code but obfuscated through variable and function renaming, fundamentally weakens the host’s defensive posture.

The script then clandestinely downloads the XWorm payload from a public repository, executing it entirely in memory using .NET’s Assembly.Loadfunction, thus avoiding disk writes and further hampering standard detection tools.

XWorm 6.0, codenamed⁣Microsoft.exe, retains the well-established operational behaviors of its predecessors but introduces critical upgrades.

The binary’s configuration, such as its Command and Control (C2) server, is stored in a base64-encoded string embedded within the executable.

Unlike older variants where the C2 could be specified at runtime, this hard-coded approach adds resilience to disruptions.

A prominent new feature is the malware’s ability to flag its process as critical, thwarting termination efforts by users or automated security tools.

If executed with administrative privileges, XWorm elevates its process rights using debug privileges and designates itself as critical; any attempt to kill the process can result in a system crash, ensuring the malware’s immediate re-establishment upon reboot due to its registry persistence.

According to the report, XWorm 6.0 pushes the envelope on anti-analysis defenses. Besides existing measures, the malware now automatically terminates itself upon detecting that it is running within a Windows XP environment, a common platform for malware analysis sandboxes.

Furthermore, it leverages the IP-API service to identify devices whose IP addresses are associated with data centers or hosting providers and self-terminates when such an environment is detected.

This behavior, inspired by high-profile open-source threats like AsyncRAT, enables XWorm to evade commercial sandbox and researcher infrastructures more effectively.

The emergence and feature-richness of XWorm 6.0 underscore the malware’s ongoing active development and increase its potential for widespread exploitation in the near future.

Threat actors now possess a more elusive, persistent, and flexible tool for breaching Windows systems.

Organizations are advised to update their defensive strategies, monitor for new persistence techniques, and enhance detection of in-memory malware execution and AMSI bypass tactics.

Indicators of Compromise (IOC)

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates