New XWorm V6 Variant Injects Malicious Code into a Legitimate Windows Program
XWorm V6.0, a recent variant of the malware, was released on Wed, Jun 4, 2025, marking a significant development in malware sophistication. This version addresses a critical remote code execution flaw found in previous editions.
XWorm V6.0, a recent variant of the malware, was released on Wed, Jun 4, 2025, marking a significant development in malware sophistication. This version addresses a critical remote code execution flaw found in previous editions.
XWorm V6.0 features a modular architecture consisting of a core client and a suite of plugins that enable various malicious activities, including credential theft and ransomware deployment. The infection process begins with a multi-stage chain designed to evade detection and persist on compromised systems.
The initial payload is delivered as a JavaScript (.js) file, often embedded in phishing emails or via compromised websites. When executed, this script issues a PowerShell command to download and execute malicious content. This includes disabling Windows Defender’s Antimalware Scan Interface and injecting code into a legitimate Windows process to conceal its presence.
XWorm V6.0, a recent variant of the malware, was released on Wed, Jun 4, 2025, marking a significant development in malware sophistication.
The malware communicates with a command-and-control (C2) server at 94.159.113.64 over port 4411, using an AES-encrypted channel with a default key of 666666. A unique machine identifier is generated using a hash of system parameters, and this identifier is used for all future plugin storage, encryption routines, and C2 transactions.
XWorm V6.0 leverages rundll32.exe to map malicious code into the address space of RegSvcs.exe, ensuring it runs under a legitimate process context. This approach bypasses application whitelisting and complicates forensic analysis. The plugins, delivered as Base64-encoded DLLs, are loaded directly into memory, reducing the malware’s footprint and enhancing persistence.
XWorm V6.0 represents a sophisticated evolution in malware technology, with advanced features for evasion and persistence. Its modular design and memory-resident capabilities pose significant challenges for detection and remediation efforts.
Based on reporting by Cyber Security News.