XWorm | Netskope Threat Labs

Description

XWorm is a remote access trojan written in C sharp that provides extensive control over infected systems, including remote desktop, keylogging, clipboard monitoring, and ransomware style features. Its cheap builder and active developer updates made it one of the most widely deployed commodity RATs, and its campaigns spread through phishing, USB drives, and loader chains. Researchers documented a major version update and its new capabilities and delivery techniques.

Stats

First seen: April 2023
Last seen: October 2026

Also known as

Xworm

Alert name variants

Alert Name	Engine
ByteCode-MSIL.Backdoor.Xworm	ATP Sandbox Adv. Heuristics
ByteCode-MSIL.Backdoor.XWorm	ATP Sandbox Adv. Heuristics
ByteCode-MSIL.Exploit.Xworm	ATP Sandbox Adv. Heuristics
ByteCode-MSIL.Trojan.Xworm	ATP Sandbox Adv. Heuristics
ByteCode-MSIL.Trojan.XWorm	ATP Sandbox Adv. Heuristics
Document-HTML.Trojan.Xworm	ATP Sandbox Adv. Heuristics
Gen:Variant.XWorm.1	AV
Gen:Variant.XWorm.113	AV
Gen:Variant.XWorm.13	AV
Gen:Variant.XWorm.2	AV
Gen:Variant.XWorm.3	AV
Gen:Variant.XWorm.6	AV
IL:Trojan.XWorm.1	AV
IL:Trojan.XWorm.2	AV
IL:Trojan.XWorm.3	AV
IL:Trojan.XWorm.43	AV
IL:Trojan.XWorm.44	AV
IL:Trojan.XWorm.47	AV
Script-BAT.Backdoor.Xworm	ATP Sandbox Adv. Heuristics
Script-BAT.Backdoor.XWorm	ATP Sandbox Adv. Heuristics
Script-BAT.Downloader.XWorm	ATP Sandbox Adv. Heuristics
Script-BAT.Trojan.Xworm	ATP Sandbox Adv. Heuristics
Script-BAT.Trojan.XWorm	ATP Sandbox Adv. Heuristics
Script-JS.Backdoor.Xworm	ATP Sandbox Adv. Heuristics
Script-JS.Backdoor.XWorm	ATP Sandbox Adv. Heuristics
Script-JS.Downloader.XWorm	ATP Sandbox Adv. Heuristics
Script-JS.Dropper.XWorm	ATP Sandbox Adv. Heuristics
Script-JS.Trojan.Xworm	ATP Sandbox Adv. Heuristics
Script-JS.Trojan.XWorm	ATP Sandbox Adv. Heuristics
Script-PowerShell.Backdoor.XWorm	ATP Sandbox Adv. Heuristics
Script-PowerShell.Downloader.XWorm	ATP Sandbox Adv. Heuristics
Script-PowerShell.Trojan.Xworm	ATP Sandbox Adv. Heuristics
Script-PowerShell.Trojan.XWorm	ATP Sandbox Adv. Heuristics
Script-WScript.Backdoor.Xworm	ATP Sandbox Adv. Heuristics
Script-WScript.Backdoor.XWorm	ATP Sandbox Adv. Heuristics
Script-WScript.Downloader.XWorm	ATP Sandbox Adv. Heuristics
Script-WScript.Trojan.Xworm	ATP Sandbox Adv. Heuristics
Script-WScript.Trojan.XWorm	ATP Sandbox Adv. Heuristics
Script.Backdoor.Xworm	ATP Sandbox Adv. Heuristics
Script.Downloader.XWorm	ATP Sandbox Adv. Heuristics
Trojan.XWorm.45	AV
Trojan.XWorm.46	AV
Trojan.XWorm.48	AV
Trojan.XWorm.A	AV
Win32.Backdoor.Xworm	ATP Sandbox Adv. Heuristics
Win32.Backdoor.XWorm	ATP Sandbox Adv. Heuristics
Win32.Exploit.Xworm	ATP Sandbox Adv. Heuristics
Win32.Exploit.XWorm	ATP Sandbox Adv. Heuristics
Win32.Phishing.XWorm	ATP Sandbox Adv. Heuristics
Win32.Ransomware.Xworm	ATP Sandbox Adv. Heuristics
Win32.Ransomware.XWorm	ATP Sandbox Adv. Heuristics
Win32.Trojan.Xworm	ATP Sandbox Adv. Heuristics
Win32.Trojan.XWorm	ATP Sandbox Adv. Heuristics
Win64.Backdoor.Xworm	ATP Sandbox Adv. Heuristics
Win64.Backdoor.XWorm	ATP Sandbox Adv. Heuristics
Win64.Trojan.Xworm	ATP Sandbox Adv. Heuristics
Win64.Trojan.XWorm	ATP Sandbox Adv. Heuristics

Related IPS Signatures

Signature Name	Engine
MALWARE-CNC Win.Dropper.Xworm variant inbound communication	IPS-SWG
MALWARE-OTHER Win.Dropper.Xworm variant download attempt	IPS-SWG
MALWARE-OTHER Win.Trojan.Xworm download attempt	IPS-SWG

Related blogs

XWorm V6: Advanced Evasion and AMSI Bypass Capabilities Revealed

July 28, 20254 min read

Netskope Threat Labs Uncovers New XWorm’s Stealthy Techniques

September 30, 20249 min read

Related families

Jalapeno Acsogenixx AsyncRAT Boxter Bulz

References

malpedia.caad.fkie.fraunhofer.de