XWorm
Also known as: X-Worm, XWorm RAT
XWorm is a .NET remote access trojan sold as Malware-as-a-Service since 2022, developed by an author known as "XCoder". It went through rapid iteration from v2 through v5.6 before the developer abandoned the project in late 2024. Cracked copies of v5.6 flooded underground channels, and a critical RCE flaw was found that let anyone with the encryption key run code on the operator's own server. A v6.0 release appeared in June 2025, described as "fully re-coded" with the RCE patched. Cracked copies of v6 followed within weeks.
The C2 protocol uses raw TCP with AES-ECB encryption, where the key is derived from the MD5 hash of a configurable mutex string. Commands and parameters are separated by a distinctive delimiter. The protocol is stateless -- the server doesn't track client state between messages. Plugins are delivered as .NET DLLs identified by SHA-256 hash, loaded directly into memory via reflection.
XWorm's capabilities go well beyond typical RAT functionality. It includes keylogging, screen and webcam capture, credential theft from 35+ browsers and applications, a clipboard crypto address replacer, USB spreading, DDoS attacks, and a ransomware module with code overlap from NoCry. The plugin architecture supports 50+ extensions in the latest versions. It can mark itself as a Windows critical process, causing a blue screen if an analyst tries to kill it.
Delivery relies on phishing with business-themed lures (invoices, shipping docs, banking receipts), ClickFix fake CAPTCHA pages, and a wide mix of file formats including Office exploits, LNK files, VHD containers, and steganography with payloads hidden in images on legitimate hosting. XWorm is part of a broader .NET commodity RAT ecosystem -- Neptune RAT is a proven code derivative sharing the same encryption routine, and it's regularly co-deployed with AsyncRAT, Quasar, and VenomRAT through shared crypter services.
Linked Threat Actors
C2 Infrastructure
Last 7 days
| Date | C2 Hosts |
|---|---|
| Apr 14, 2026 | 33 |
| Apr 13, 2026 | 17 |
| Apr 12, 2026 | 13 |
| Apr 11, 2026 | 17 |
| Apr 10, 2026 | 17 |
| Apr 9, 2026 | 20 |
| Apr 8, 2026 | 11 |
Further Reading
CERT Polska's thorough reverse-engineering of XWorm internals. Covers config extraction, AES-ECB encryption (MD5 mutex key), full C2 command list, and plugin loading.
Deep dive into v6's 35+ plugin architecture including ransomware module (NoCry overlap), credential theft covering 35+ apps, HVNC, and webcam streaming.
Best coverage of v6 defense evasion: AMSI bypass via clr.dll patching, ETW blinding, critical process self-protection, and COM hijacking persistence.
Catalogs delivery format diversity (PowerShell, VBS, .NET, JS, HTA, LNK, ISO, VHD, Office macros). AES-encrypted stagers and process injection techniques. Includes Splunk detection rules.
Full infection chain: XLAM exploit (CVE-2018-0802) to HTA to JScript/PowerShell, steganography via Cloudinary-hosted JPG, process hollowing into MSBuild.exe.
Real-world dual-payload campaign (XWorm v2.2 + v3.1 with AgentTesla). Covers weaponized Word docs, AMSI bypass, Defender disabling, and .NET loader analysis.
Multi-stage chain targeting Brazilian users via fake banking receipts. Steganography, Cloudinary abuse, and a .NET persistence module using Task Scheduler COM APIs.
Proves code lineage -- Neptune RAT V1 shares the exact same AES-ECB encryption routine (MD5-hashed mutex duplicated to 32-byte key). Shows how XWorm's code propagates.
Novel obfuscation using meme-filled variable names in PowerShell. Exploits Follina (CVE-2022-30190). Linked to TA558 TTPs. Targeted German manufacturing and healthcare.
Covers v7's full lifecycle from phishing through process hollowing, TCP C2 protocol details, AES-ECB command encryption, and the 50+ plugin framework.