Trojan:MSIL/Xworm!MTB

Once launched, Trojan:MSIL/Xworm!MTB initiates a multi-stage process to embed itself within the device. It creates a copy of its primary payload in the user's Application Data folder, using the path %Application Data%\msedge.exe, and activates both HIDDEN and SYSTEM attributes to evade casual discovery. To achieve persistence and ensure it runs at every Windows startup, Xworm modifies the Windows Registry by adding a new value named msedge to the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run key, which points directly to the malicious file.  

A key evasion technique involves the use of PowerShell commands to deactivate critical security controls; it runs commands to add exclusions for its own file path and process name within Windows Defender, preventing the antivirus from scanning its components. 

It further manipulates the Windows environment to conceal its activities. It modifies the registry value ShowSuperHidden located in HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, setting it to 0 to hide super-hidden files. To prevent multiple instances from running in parallel, it creates a mutex with the specific name oXwnhd5ZIRDDutbH. For propagation across removable media, it drops a copy of itself named DriverInstaller.exe onto all available drives.  

It then creates a file at %User Temp%\Log.tmp to store data captured by its keylogging functionality. 

Once established, Xworm connects to a Command and Control (C2) server, with one identified instance being [BLOCKED]dns.org on port 1111 using TCP. Before awaiting commands, it performs extensive device profiling, gathering information such as the username, Windows version and architecture, Xworm variant identifier, file creation date, administrative rights status, detailed hardware specifications (including CPU, GPU, and RAM), and the name of any installed security software. The backdoor supports a wide array of commands, allowing comprehensive control over the infected device. These include system control functions like PCShutdown, PCRestart, and PCLogoff; launching commands such as LN (to download and launch a file) and RunShell (to run a system command); and attack commands like StartDDos and StopDDos to initiate or halt Distributed Denial-of-Service attacks. Surveillance capabilities are facilitated through commands like $cap for screen capture and dedicated keylogging routines, while system configuration can be altered using the Shosts command to modify the host file. Xworm also possesses self-management functions, including update and uninstall routines. 

Xworm drops the following files:  

• %User Temp%\Log.tmp 
• %Application Data%\msedge.exe 
• DriverInstaller.exe 

Modifies the following registry entries: 

• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ value: msedge 
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced value of “0” 

Xworm connects to the following URLs: 

• goo[.]su 
• ziadonfire[.]work[.]gd 

It also interacts to the following hosts: 

• 104[.]21[.]38[.]221 port 443 
• 89[.]116[.]164[.]56 port 7000