Trojan:PowerShell/XWorm.PC!MTB

The Trojan:PowerShell/XWorm.PC!MTB infection process starts with a phishing email containing an attachment, such as a VBScript file disguised as an invoice or a shortcut (LNK) file. This initial file, for example booking.vbs, acts as a loader. It runs a command to run a batch file, like aoc.bat found in the %userprofile% directory. This batch script contains obfuscated code, often using random variable names and Base64 strings hidden within comments, to dynamically construct a PowerShell command. This command uses parameters such as -ExecutionPolicy Bypass and -WindowStyle Hidden to run without restrictions or visible windows. The core PowerShell script, which has a SHA-256 hash like 0f10d6cbaf195a7b0c9f708b7f0a225e2de29beb769bdf8d1652b682b1c4679f, performs a key function.  

It scans its own content for an embedded, encrypted payload. It then decrypts this payload using the AES algorithm with a hardcoded key and initialization vector, decompresses it using GZip, and loads the resulting .NET assembly directly into the memory of a legitimate process such as explorer.exe or svchost.exe. This reflective loading technique is a hallmark of fileless evasion. In alternative infection chains, a malicious LNK file might run PowerShell to download a secondary payload from a remote server, such as http://85[.]203.4[.]232:5000/Discord[.]exe. This downloaded file, perhaps a malicious binary with the hash 0861f20e889f36eb529068179908c26879225bf9e3068189389b76c76820e74e, is saved to a temporary location. It then may deploy a final payload, such as system32.exe, into a system directory.  

To ensure it survives a reboot, XWorm creates persistence mechanisms. It might add a registry entry at HKCU\Software\Microsoft\Windows\CurrentVersion\Run\XClient pointing to the payload file, or create a scheduled task named XClient configured with schtasks.exe to run every minute. It also takes steps to deactivate defenses. It often runs PowerShell commands to add exclusions to Windows Defender, for instance using Add-MpPreference -ExclusionPath "%AppData%" or -ExclusionProcess "msedge.exe". Other registry modifications for evasion include setting HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DisableFirewall to 1 to turn off the firewall or setting HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgrto 1 to block Task Manager. The malware uses a mutex, such as 1JJyHGXN8Jb9yEZG, to prevent multiple instances on the same machine. For command and control (C2) communication, it connects to remote servers like 94[.]159.113[.]64 on port 4411 or 89[.]116.164[.]56 on port 7000. It also communicates with domains like ziadonfire[.]work[.]gd or uses legitimate services such as paste[.]ee and api[.]telegram[.]org for data exfiltration. Additional payloads or plugins can be stored in a compressed format within registry keys under HKCU\SOFTWARE\<Client ID>.