Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
9 distinct techniques documented for this family, organized by ATT&CK tactic.
The svchost.com file... was part of the XWorm malware family, protected by .NET Reactor. The malware's code was heavily obfuscated... MD5 hashing, AES encryption in ECB mode, and Base64 decoding to decrypt strings.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a malware-as-a-service malware family used as a pricing comparison against WeedHack.
Referenced as another commercially available malware offering, noted for lifetime subscription pricing.
X-Worm is a malware family with capabilities ranging from remote access trojan functionality to ransomware. In this campaign it was delivered via a phishing email containing a shortened link that led to a ZIP archive with an LNK file, which downloaded and executed a batch script that used bitsadmin to fetch the final payload disguised as svchost.com. The analyzed sample was identified as XWorm version 5.6 and included configuration data such as a C2 host, port, Telegram token, and chat ID.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.