XWorm Malware Adopts New Infection Chain to Bypass Security Detection

XWorm Malware's Advanced Evasion Tactics

Recent research has identified significant advancements in the tactics used by XWorm malware, focusing on enhanced evasion techniques to bypass detection systems. The Trellix Advanced Research Center has documented these changes, noting a shift towards more complex infection methods aimed at increasing effectiveness while avoiding detection.

XWorm has transitioned from predictable distribution methods to using legitimate-looking executable filenames to disguise itself as benign applications, exploiting both user and system trust. This method combines social engineering with technical attack vectors, expanding beyond conventional email-based attacks while continuing to utilize .lnk files and phishing emails for initial access.

The infection process begins with a .lnk file distributed through phishing campaigns. This shortcut executes malicious PowerShell commands, initiating a complex infection chain. A text file is dropped into the system's temporary directory before downloading an executable named 'discord.exe' from a remote server.

The 'discord.exe' file represents the second stage, employing sophisticated .NET packing techniques and using a legitimate Discord application icon for disguise. Upon execution, it drops two additional malicious files: 'main.exe' and 'system32.exe', with the latter being the actual XWorm payload, designed to imitate a Windows system file.

System Compromise and Evasion Techniques

The 'main.exe' component disables Windows Firewall via registry modifications and checks for third-party security applications. It creates a registry entry to ensure persistent firewall disablement. Meanwhile, 'system32.exe' employs advanced techniques to detect virtual environments, avoiding security sandbox analysis. If virtualization is detected, the malware terminates itself. In legitimate environments, it creates a duplicate named "Xclient.exe" and establishes multiple persistence mechanisms.

XWorm utilizes PowerShell commands with ExecutionPolicy Bypass to exclude itself from Windows Defender's real-time monitoring. It creates a scheduled task named "XClient" to maintain continuous operation. The malware employs advanced cryptography, using the Rijndael cipher and Base64 encoding for data concealment, protecting critical operational data such as Command and Control server information.

Once operational, XWorm facilitates extensive backdoor capabilities, allowing attackers to execute various remote commands, transform compromised machines into botnet nodes, and expand operational capabilities. The malware creates a mutex to prevent multiple instances and gathers reconnaissance data, aiding attackers in customizing subsequent attacks.

The evolution of XWorm underscores the importance of multi-layered security strategies. Organizations should implement robust detection mechanisms, user awareness training, and comprehensive endpoint protection to counter these sophisticated and deceptive attack vectors effectively.

Based on reporting by GBHackers.