XWorm, a multi-functional malware tool discovered in 2022, allows attackers to steal sensitive data, remotely access systems, and deploy other malware, whose versatility has made it a popular choice for threat actors like NullBulge and TA558.
WSF downloader fetches a malicious PowerShell script that injects a DLL into a legitimate process for XWorm execution via reflective loading and scheduled tasks.
A malicious WSF file disguised with Social Security Administration information uses VBScript to decode a hex-encoded string and download a PowerShell script for execution via Wscript.Shell, aiming to evade static detection.
VBScript downloads obfuscated PowerShell scripts from Paste.ee, creates folders, and generates & stores additional scripts (Ps1, bat, vbs). VsLabs.vbs triggers VsEnhance.bat, which executes VsLabsData.ps1.
The PowerShell script VsLabsData.ps1 establishes persistence for the XWorm malware by creating a scheduled task named “MicrosoftVisualUpdater,” which is configured to execute a VBScript file, VsEnhance.bat, at a specified interval, ensuring the malware’s continued presence on the compromised system.
Malicious PowerShell script injects XWorm worm using a custom NewPE2 loader hidden within the script, which leverages reflective loading to bypass static detection and injects XWorm into a legitimate process (RegSvcs.exe).
XWorm, a .NET binary detected by antivirus software, is a version 5.6 malware that uses AES encryption with a specific key derived from a known string to decrypt its configuration, including a command and control server address, port, and other settings.
It establishes a TCP socket connection with a C2 server using its IP address, which sets the socket buffer for data transfer to 50KB and maintains the connection through regular pings and pong responses.
It collects initial victim device information such as hostname, username, and system details before executing malicious actions, which can load and remove plugins for custom functions and report network response time using the “Pong” command.
According to Netskope, XWorm’s “Hosts” and “Shosts” commands allow attackers to read, modify, and overwrite victims’ host files, enabling DNS attacks. The “StartDDos” command launches DDoS attacks on specified targets, sending POST requests every 2.5 seconds.
It captures a screenshot by determining the screen dimensions, creating a bitmap, copying the screen content to the bitmap, saving it as a JPEG in memory, and sending it to the attacker via a socket connection.
