XWorm — invoice-1645080830.pdf (9).js [79ce22de]

XWorm | Threat Level: high | Type: RAT

Cryptographic Identifiers

SHA256	`79ce22dee7148ab75a24bf3aaa9812c269b5436a3be18e3dad1496d7130f47a6`
MD5	`1c9ca020eac91d8ec69d1bc277ca0507`
File Type	js
Size	23383.3 KB
First Seen	2026-04-30
File Name	invoice-1645080830.pdf (9).js
Tags	js, xworm

Malware Family: XWorm

XWorm, 2022'de ortaya çıkan çok işlevli RAT'tır.

Type	RAT
Programming Language	.NET C#
Target Platform	Windows
C2 Protocol	TCP
Purpose	Uzaktan erişim, infostealer
First Seen Year	2022

Threat Indicators (IOC)

SHA256: 79ce22dee7148ab75a24bf3aaa9812c269b5436a3be18e3dad1496d7130f47a6
MD5: 1c9ca020eac91d8ec69d1bc277ca0507

System Cleanup Guide

Disconnect the system from the network — unplug ethernet, disable Wi-Fi
Terminate suspicious processes from Task Manager
Run a full system scan with Malwarebytes or Kaspersky
HKCU\Software\Microsoft\Windows\CurrentVersion\Run kayıtlarını kontrol edin
Review newly created tasks in Task Scheduler
Change all your account passwords from a clean device
Gerekirse Windows'u yeniden yükleyin ve verilerinizi temiz bir yedeğe geri alın

YARA Rule Hints

rule XWorm_SHA256 {
    meta:
        description = "XWorm sample: 79ce22dee7148ab7"
        threat_level = "high"
        first_seen = "2026-04-30"
    condition:
        hash.sha256(0, filesize) == "79ce22dee7148ab75a24bf3aaa9812c269b5436a3be18e3dad1496d7130f47a6"
}

XWorm — Malware Profile

XWorm RAT .NET. Contract.exe is sozlesmesi. RecargarPanels Ispanyolca UI. panelActions plugin. Aggregate modül.

Malware Type

RAT

Programming Language

.NET C#

C2 Protocol

TCP

Target Systems

Windows

Technical Details

C# .NET, AES-128-CBC veya AES-256, TCP varsayilan port 7878, Anti-VM (GetSystemFirmwareTable), Anti-debug (FindWindow Olly/x64dbg), Webhook stealer, Clipper, HVNC, Remote Shell, Ransomware modulu

Capabilities & Behavior

Uzaktan Erişim & Kontrol

Keylogger

Ekran Görüntüsü

Webcam Erişimi

Dosya Yönetimi

Süreç Yönetimi

Komut Yürütme

Kalıcılık Mekanizması

IOC List (19 indicators)

IOC — XWorm

# SHA256
79ce22dee7148ab75a24bf3aaa9812c269b5436a3be18e3dad1496d7130f47a6

# MD5
1c9ca020eac91d8ec69d1bc277ca0507

# IP
194.233.74.111 

# IP
185.105.6.34 

# IP
5.75.176.228 

# IP
185.220.101.92 

# IP
91.92.241.73 

# IP
91.92.246.33 

# IP
185.165.169.77 

# DOMAIN
xwormpanel.xyz 

# DOMAIN
xworm-update-checker.com 

# MUTEX
XWorm_V5.2_MUTEX 

# MUTEX
Global{8d290ab1-xworm} 

# MUTEX
XWorm_Mutex_v5.6 

# REGISTRY
HKCUSoftwareMicrosoftWindowsCurrentVersionRunSystem Update 

# REGISTRY
HKCUSoftwareMicrosoftWindowsCurrentVersionRunXWorm 

# FILEPATH
%APPDATA%XWormXWorm.exe 

# FILEPATH
%APPDATA%WindowsSystemXTask.exe 

# URL
https://xworm-updates.xyz/v5.2.exe

Type	Value	Note
sha256	79ce22dee7148ab75a24bf3aaa9812c269b5436a3be18e3dad1496d7130f47a6
md5	1c9ca020eac91d8ec69d1bc277ca0507
ip	194.233.74.111	C2:7878
ip	185.105.6.34	C2:1234
ip	5.75.176.228	C2:7877
ip	185.220.101.92	XWorm C2 Tor proxy
ip	91.92.241.73	XWorm aktif C2
ip	91.92.246.33	C2:7707
ip	185.165.169.77	C2:7707
domain	xwormpanel.xyz	XWorm C2 panel domain
domain	xworm-update-checker.com	XWorm fake update domain
mutex	XWorm_V5.2_MUTEX	XWorm v5.2 standart mutex
mutex	Global{8d290ab1-xworm}	XWorm GUID tabanli mutex
mutex	XWorm_Mutex_v5.6	XWorm v5.6 mutex
registry	HKCUSoftwareMicrosoftWindowsCurrentVersionRunSystem Update	XWorm persistence key
registry	HKCUSoftwareMicrosoftWindowsCurrentVersionRunXWorm	XWorm persistence
filepath	%APPDATA%XWormXWorm.exe	XWorm persistence directory
filepath	%APPDATA%WindowsSystemXTask.exe	XWorm persistence dosyasi
url	https://xworm-updates.xyz/v5.2.exe	XWorm v5.2 dropper URL

XWorm — Go to Full Profile →

C2 Servers (8 recorded servers for this family)

Address	Type	Port	Protocol	Status	Country
eIL.ru	domain	—	TCP	active	—
exec.in	domain	—	TCP	active	—
exec.in	domain	—	TCP	active	—
exec.in	domain	—	TCP	active	—
exec.in	domain	—	TCP	active	—
github.com	domain	—	TCP	active	—
system.io	domain	—	TCP	inactive	—
system.io	domain	—	TCP	inactive	—

C2 addresses are provided only from malware samples manually verified by the KEYDAL team. Commercial use is prohibited.