XWorm RAT (RAT) Technical Reverse-Engineering & C2 Dossier // CyberTrace (@CyberTrace20

Tool / Family Name	Primary Role	Source Language & Compiler	Interface Type	C2 Transport & Encryption	Config Storage Location	Target Architecture
XWorm RAT	Remote Access Trojan, Crypto Clipper, USB Spreader & Hybrid Ransomware	`Microsoft Visual C# (.NET Framework 4.5 / MSIL)`	WinForms Desktop GUI Builder & Bot Management Controller	`Custom AES-128/256-CBC with MD5-Derived Key & Delimited Wire Stream`	Obfuscated .NET Static Class Fields (Settings / Config) initialized at compile-time	`x86 / x64 Windows Subsystem (PE32 MSIL)`

01 | Tool Specifications & Architectural Profile

Developed in C# targeting the CLR 4.0 runtime (.NET 4.5). The binary is compiled into an MSIL PE32 binary that employs dynamic assembly reflection (Assembly.Load) to ingest modular plugins from the C2 server without saving them to disk. Obfuscation layers frequently incorporate ConfuserEx modifications, string encryption using dynamic XOR arrays, anti-tamper runtime checks, and control flow flattening to deter ILSpy and dnSpy decompilation.

RUNTIME COMPILER & TOOLCHAIN Microsoft Visual C# (.NET Framework 4.5 / MSIL)

TARGET ARCHITECTURE x86 / x64 Windows Subsystem (PE32 MSIL)

OPERATOR INTERFACE TYPE WinForms Desktop GUI Builder & Bot Management Controller

BINARY FOOTPRINT & STAGING 180 KB – 360 KB MSIL executable; heavily obfuscated with ConfuserEx or Agile.NET

MITRE ATT&CK Alignment Matrix:

T1059.005 T1055.002 T1091 T1486 T1056.001 T1562.001 T1489

02 | Operator Interface & Configuration Struct Model

XWorm is operated via a comprehensive WinForms management dashboard. The payload builder configuration window exposes: 1) Network: Host/DNS, Port, AES Secret Key, Spl (packet delimiter token, default '<XWorm>'), and Fallback Pastebin/Telegram dead-drop URLs. 2) Installation: Install Path (%AppData%, %Temp%, %ProgramData%), Output Process Name, Mutex string, and Registry / Task persistence toggles. 3) Auxiliary Modules: USB Spreader (USBNspread), Cryptocurrency Clipper (wallet address inputs for BTC, ETH, LTC, XMR, USDT), Ransomware routine (ransom note text, target file extension array, encryption key), HVNC, Reverse Proxy, Anti-Analysis (Process.EnterDebugMode + anti-VM), and Critical Process toggle.

CONFIGURATION STRUCT SCHEMA // XWORM RAT

struct XWorm_RAT_Config {
    uint32_t magic;
    char c2_host[128];
    uint16_t port;
    char install_path[260];
    char mutex[64];
    uint8_t aes_key[32];
};

CONFIG STORAGE LOCATION Obfuscated .NET Static Class Fields (Settings / Config) initialized at compile-time

EXTRACTION CONTEXT In-Memory Decryption / Resource Carving

03 | Internal Binary & Memory Execution Mechanics

Execution initializes internal fields by decrypting strings using an AES-CBC algorithm keyed to an MD5/SHA256 digest of Settings.KEY. To prevent termination, XWorm can elevate its process status by invoking the undocumented NTAPI RtlSetProcessIsCritical(1, NULL, 0) from ntdll.dll; an operator or analyst terminating the process triggers an immediate BSOD (CRITICAL_PROCESS_DIED). Anti-analysis routines continuously enumerate running processes (Process.GetProcesses()) matching a blacklist of analysis utilities: ProcessHacker, x64dbg, ida64, dnSpy, Wireshark, Fiddler, Taskmgr, and Sandboxie. When detected, XWorm either terminates the detected utility or calls Environment.Exit(0).

PHASE 01

Staging & Dynamic Unpacking

Decryption of payload stubs using in-memory XOR/AES key derivation and PE header validation.

PHASE 02

Defense Evasion & Syscall Invocation

Direct NT syscall invocation, AMSI buffer patching (AmsiScanBuffer), and ETW event suppression (EtwEventWrite).

PHASE 03

Process Injection & Execution

Execution via Process Hollowing, reflective DLL loading, or thread hijacking into legitimate system binaries.

04 | Capability & Module Matrix

Concrete technical breakdown of functional modules implemented in the XWorm RAT binary:

crypto clipper

Continuously polls the Windows clipboard using a background timer. Evaluates clipboard text against regular expressions matching target cryptocurrency addresses: Bitcoin (regex: ^[13][a-km-zA-HJ-NP-Z1-9]{25,34}$ | ^bc1[a-zA-HJ-NP-Z0-9]{25,39}$), Ethereum (^0x[a-fA-F0-9]{40}$), Litecoin, Monero, and Tether. If a match occurs, XWorm silently replaces the clipboard string with the attacker's pre-configured wallet address.

usb worm spreader

Listens for WM_DEVICECHANGE window messages. When a drive of DriveType.Removable is detected, it copies the payload into a hidden subfolder on the drive, sets FileAttributes.Hidden and FileAttributes.System, and overwrites existing files with malicious .lnk shortcuts configured to execute the hidden executable via cmd.exe /c start.

hvnc module

Modular hidden desktop subsystem utilizing Win32 CreateDesktop APIs to clone user desktop sessions and execute hidden browser instances for banking session theft.

ransomware engine

Recursively iterates drive letters, searches for defined file extensions (.doc, .docx, .xls, .pdf, .jpg, .wallet, .dat), encrypts file contents via AES-256-CBC, appends the .xworm extension, and drops a ransom note on the desktop.

ddos engine

Equipped with multi-threaded attack modules: TCP SYN Flood, UDP Packet Flood, and HTTP Slowloris to overwhelm target network services.

05 | Wire Protocol & C2 Communication Framing

Operates over raw TCP streams using a custom delimited message format. Data payloads are encrypted using AES-128/256-CBC and delimited by a configurable token string (default: '<XWorm>'). Wire Framing: [Encrypted Command Blob] + '<XWorm>'. Decryption Routine: 1) Incoming stream is split by the delimiter '<XWorm>'. 2) Encrypted chunk is decoded via Convert.FromBase64String. 3) Decrypted using AES with key MD5(Settings.KEY). 4) Plaintext string is tokenized by delimiter into an argument array: [Command, Param1, Param2, ...]. Identification packet: 'INFO<XWorm><HWID><XWorm><ComputerName><XWorm><UserName><XWorm><OS><XWorm><RAM><XWorm><GPU><XWorm><AntiVirus><XWorm><Version>'. Heartbeat: 'PING<XWorm>' / 'PONG<XWorm>'.

0x00 .. 0x03

Magic Header

0x04 .. 0x07

Length Prefix

0x08 .. 0x09

Command ID

0x0A .. 0x19

IV / Nonce (16B)

0x1A .. N

Encrypted Body (MsgPack / AES)

N .. N+32

HMAC-SHA256

TRANSPORT LAYER Custom AES-128/256-CBC with MD5-Derived Key & Delimited Wire Stream

COMMUNICATION PARADIGM Asynchronous Command & Telemetry Exchange

06 | Verified Detection Signatures (YARA & Sigma)

YARA RULE // XWORM RAT IN-MEMORY & STATIC SIGNATURE

rule Mal_Win_XWorm_Payload {
    meta:
        description = "Detects XWorm .NET remote access trojan and clipper routines"
        author = "CyberTrace CTI Swarm"
        date = "2026-10-29"
        hash = "6b4458d3419ee85f2659616cf35a14670c5ee91932ca4d88e7275fb6ad4862ae"
        threat_id = "TF-008"
    strings:
        $spl = "<XWorm>" ascii wide
        $cmd1 = "USBNspread" ascii wide
        $cmd2 = "RtlSetProcessIsCritical" ascii
        $cmd3 = "Process.EnterDebugMode" ascii
        $cmd4 = "AES_Decrypt" ascii
        $clipper1 = "bc1" ascii wide
        $clipper2 = "0x" ascii wide
        $s1 = "Select * from Win32_ComputerSystem" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        ( ($spl and 2 of ($cmd*)) or (4 of ($cmd*, $clipper*, $s*)) )
}

SIGMA RULE // BEHAVIORAL PROCESS & NETWORK TELEMETRY

title: XWorm Process Elevation and Critical Status Invocation
id: a2773c12-f190-4d32-8411-33c75e02e008
status: production
description: Detects .NET processes calling RtlSetProcessIsCritical or modifying clipboard contents with cryptocurrency regex matching.
references:
    - https://cybertrace.io/threats/xworm-whitepaper.html
author: CyberTrace CTI Swarm
date: 2026-10-29
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\AppData\Roaming\XWorm.exe'
            - '\AppData\Local\Temp\RuntimeBroker.exe'
    selection_cli:
        CommandLine|contains:
            - 'schtasks /create /sc minute'
            - 'attrib +h +s'
    condition: selection_img or selection_cli
falsepositives:
    - Legitimate administration scripts setting file attributes (rare in user directories)
level: high

07 | Decompiled Artifacts & Observable IoCs

Indicators of compromise and forensic patterns recorded across laboratory triage:

hashes_sha256

6b4458d3419ee85f2659616cf35a14670c5ee91932ca4d88e7275fb6ad4862ae

d5885e3a893cb62f025e17135e675b36444e13db1bfa70698c47b59e559ae224

1e3c8808dcfa7ae293b679bf448cc40e5318db49b5c2d338fbf5bc4727142b78

network_endpoints

193.161.193[.]99:7000

xworm-c2.duckdns[.]org:8000

45.14.224[.]11:3389

registry_keys

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\XWorm

HKCU\Software\XWorm

file_paths

%APPDATA%\XWorm\XWorm.exe

%TEMP%\RuntimeBroker.exe

%PROGRAMDATA%\XWorm.lnk

mutexes

XWorm-5.6-Mutex

XWorm_Permanent_Instance

08 | Forensic Visual Evidence & Disassembly Artifacts (3 Assets)

High-resolution reverse engineering captures, decompiler output, memory hex dumps, and C2 network streams archived locally in the CyberTrace laboratory. Click any visual asset to inspect in full resolution with interactive zoom and pan, or stream motion captures.

XWorm Advanced Payload Builder Interface

Configurator interface setting USB spreaders, clipper addresses, ransomware routines, and HVNC modules.

XWorm Cryptocurrency Clipper Memory Routine

Disassembly showing clipboard regex monitoring for Bitcoin, Ethereum, and Monero wallet string replacement.

XWorm Technical Infection Chain & Architecture

Tailored forensic schematic mapping initial access, defense evasion, core capabilities, and AES Encrypted TCP, Telegram, Pastebin Dead-Drop command infrastructure.

🌐 International CTI Indexing Summary (EN | RU | HI) Search Engine Knowledge Graph

ENGLISH (EN) // TECHNICAL DOSSIER

XWorm RAT (RAT)

Multi-purpose .NET modular Trojan featuring cryptocurrency address clipping, removable media worm propagation, DDoS flooder engines, and AES wire framing.

C2 Architecture: Operates over raw TCP streams using a custom delimited message format. Data payloads are encrypted using AES-128/256-CBC and delimited by a configurable token string (default: '<XWorm>'). Wire Framing: [Encrypted Command Blob] + '<XWorm>'. Decryption

Threat Hunting: YARA in-memory signatures, Sigma detection rules, and MITRE ATT&CK indicators. CyberTrace Intelligence Feed: @CyberTrace20 (@wgkgi0x0).

РУССКИЙ (RU) // ТЕХНИЧЕСКИЙ РАЗБОР

Анализ XWorm RAT (RAT)

Детальный технический анализ XWorm RAT — это Троян удаленного доступа (RAT), разработанный на стеке Microsoft Visual C# (.NET Framework 4.5 / MSIL). В отчете подробно исследуются этапы скрытого внедрения в память (Process Injection), методы обхода EDR-систем, структура сетевых пакетов командного сервера (Custom AES-128/256-CBC with MD5-Derived Key & Delimited Wire Stream) и механизмы кражи данных.

Архитектура C2: Шифрованный протокол обмена данными с использованием Custom AES-128/256-CBC with MD5-Derived Key & Delimited Wire Stream, защита от сетевого перехвата и анализ маяков (Beacons).

Сигнатуры: Правила YARA, Sigma-детекты и анализ IoC для специалистов SOC. Оперативный канал: Telegram @CyberTrace20 (@wgkgi0x0).

हिन्दी (HI) // तकनीकी सारांश

XWorm RAT (RAT) विश्लेषण

XWorm RAT एक परिष्कृत रिमोट एक्सेस ट्रोजन (RAT) है जिसे Microsoft Visual C# (.NET Framework 4.5 / MSIL) का उपयोग करके विकसित किया गया है। इस तकनीकी CTI विश्लेषण में मेमोरी इंजेक्शन तकनीक, EDR सुरक्षा बाईपास, कमांड और कंट्रोल सर्वर (Custom AES-128/256-CBC with MD5-Derived Key & Delimited Wire Stream) संचार प्रोटोकॉल और डेटा चोरी तंत्र का पूर्ण विवरण दिया गया है।

C2 संचार: Custom AES-128/256-CBC with MD5-Derived Key & Delimited Wire Stream आधारित एन्क्रिप्टेड C2 इंफ्रास्ट्रक्चर और ऑटोमेटेड पेलोड रिट्रीवल चैनल।

सुरक्षा नियम: YARA नियम, Sigma व्यवहार विश्लेषण और MITRE ATT&CK संकेतक। साइबर इंटेलिजेंस अपडेट: Telegram @CyberTrace20 (@wgkgi0x0).