Skip to main content
Skip to main content
Microsoft Security Intelligence
201 entries found. Displaying page 1 of 11.
Updated on Sep 13, 2023

Trojan:MSIL/XWorm.C is an advanced malware family that operates as a Remote Access Trojan (RAT) that carries the “MSIL” designation to signify that the malware is a .NET-based threat that has been compiled to run in Microsoft Intermediate Language. Its .NET-based capabilities allow it to run on any device running Windows that is equipped with the appropriate Common Language Runtime, which means it is a very flexible and persistent backdoor and provides threat actors complete control over the compromised devices.  

Xworm is often delivered and sold as Malware-as-a-Service (MaaS), and due to its multifunctionality, it has a multitude of functionalities such as theft of sensitive information, the ability to launch distributed denial-of-service (DDoS) attacks, downloading additional payloads, and keylogging capabilities that allows it to capture sensitive user data, such as passwords and financial information. 

Alert level: severe
Updated on Apr 30, 2024

Trojan:MSIL/XWorm.RDF is an advanced malware family that operates as a Remote Access Trojan (RAT) that carries the “MSIL” designation to signify that the malware is a .NET-based threat that has been compiled to run in Microsoft Intermediate Language. Its .NET-based capabilities allow it to run on any device running Windows that is equipped with the appropriate Common Language Runtime, which means it is a very flexible and persistent backdoor and provides threat actors complete control over the compromised devices.  

Xworm is often delivered and sold as Malware-as-a-Service (MaaS), and due to its multifunctionality, it has a multitude of functionalities such as theft of sensitive information, the ability to launch distributed denial-of-service (DDoS) attacks, downloading additional payloads, and keylogging capabilities that allows it to capture sensitive user data, such as passwords and financial information. 

Alert level: severe
Updated on Jul 24, 2025

Trojan:MSIL/XWorm.RDK is an advanced malware family that operates as a Remote Access Trojan (RAT) that carries the “MSIL” designation to signify that the malware is a .NET-based threat that has been compiled to run in Microsoft Intermediate Language. Its .NET-based capabilities allow it to run on any device running Windows that is equipped with the appropriate Common Language Runtime, which means it is a very flexible and persistent backdoor and provides threat actors complete control over the compromised devices.  

Xworm is often delivered and sold as Malware-as-a-Service (MaaS), and due to its multifunctionality, it has a multitude of functionalities such as theft of sensitive information, the ability to launch distributed denial-of-service (DDoS) attacks, downloading additional payloads, and keylogging capabilities that allows it to capture sensitive user data, such as passwords and financial information. 

Alert level: severe
Updated on Jul 25, 2025

Trojan:MSIL/XWorm!rfn is an advanced malware family that operates as a Remote Access Trojan (RAT) that carries the “MSIL” designation to signify that the malware is a .NET-based threat that has been compiled to run in Microsoft Intermediate Language. Its .NET-based capabilities allow it to run on any device running Windows that is equipped with the appropriate Common Language Runtime, which means it is a very flexible and persistent backdoor and provides threat actors complete control over the compromised devices.  

Xworm is often delivered and sold as Malware-as-a-Service (MaaS), and due to its multifunctionality, it has a multitude of functionalities such as theft of sensitive information, the ability to launch distributed denial-of-service (DDoS) attacks, downloading additional payloads, and keylogging capabilities that allows it to capture sensitive user data, such as passwords and financial information. 

Alert level: severe
Updated on May 19, 2024
Alert level: severe
Updated on May 20, 2025

Trojan:MSIL/XWorm.SPXF is an advanced malware family that operates as a Remote Access Trojan (RAT) that carries the “MSIL” designation to signify that the malware is a .NET-based threat that has been compiled to run in Microsoft Intermediate Language. Its .NET-based capabilities allow it to run on any device running Windows that is equipped with the appropriate Common Language Runtime, which means it is a very flexible and persistent backdoor and provides threat actors complete control over the compromised devices.  

Xworm is often delivered and sold as Malware-as-a-Service (MaaS), and due to its multifunctionality, it has a multitude of functionalities such as theft of sensitive information, the ability to launch distributed denial-of-service (DDoS) attacks, downloading additional payloads, and keylogging capabilities that allows it to capture sensitive user data, such as passwords and financial information. 

Alert level: severe
Updated on Jul 24, 2025

Trojan:MSIL/XWorm.AMAA is an advanced malware family that operates as a Remote Access Trojan (RAT) that carries the “MSIL” designation to signify that the malware is a .NET-based threat that has been compiled to run in Microsoft Intermediate Language. Its .NET-based capabilities allow it to run on any device running Windows that is equipped with the appropriate Common Language Runtime, which means it is a very flexible and persistent backdoor and provides threat actors complete control over the compromised devices.  

Xworm is often delivered and sold as Malware-as-a-Service (MaaS), and due to its multifunctionality, it has a multitude of functionalities such as theft of sensitive information, the ability to launch distributed denial-of-service (DDoS) attacks, downloading additional payloads, and keylogging capabilities that allows it to capture sensitive user data, such as passwords and financial information. 

Alert level: severe
Updated on Oct 29, 2025
Alert level: severe
Updated on Feb 22, 2023

Trojan:MSIL/Xworm!MTB is an advanced malware family that operates as a Remote Access Trojan (RAT) that carries the “MSIL” designation to signify that the malware is a .NET-based threat that has been compiled to run in Microsoft Intermediate Language. Its .NET-based capabilities allow it to run on any device running Windows that is equipped with the appropriate Common Language Runtime, which means it is a very flexible and persistent backdoor and provides threat actors complete control over the compromised devices.  

Xworm is often delivered and sold as Malware-as-a-Service (MaaS), and due to its multifunctionality, it has a multitude of functionalities such as theft of sensitive information, the ability to launch distributed denial-of-service (DDoS) attacks, downloading additional payloads, and keylogging capabilities that allows it to capture sensitive user data, such as passwords and financial information. 

The “!MTB” suffix refers to Machine Threat Behavior, which indicates that this trojan was detected using behavioral analysis or machine learning models. Instead of relying solely on a static signature (like a known file hash), the antivirus engine identified the program's actions, sequence of operations, or code patterns as malicious. These patterns are consistent with the known behavior of the XWorm family. 

Alert level: severe
Updated on Mar 13, 2023

Trojan:MSIL/XWorm.C!MTB is an advanced malware family that operates as a Remote Access Trojan (RAT) that carries the “MSIL” designation to signify that the malware is a .NET-based threat that has been compiled to run in Microsoft Intermediate Language. Its .NET-based capabilities allow it to run on any device running Windows that is equipped with the appropriate Common Language Runtime, which means it is a very flexible and persistent backdoor and provides threat actors complete control over the compromised devices.  

Xworm is often delivered and sold as Malware-as-a-Service (MaaS), and due to its multifunctionality, it has a multitude of functionalities such as theft of sensitive information, the ability to launch distributed denial-of-service (DDoS) attacks, downloading additional payloads, and keylogging capabilities that allows it to capture sensitive user data, such as passwords and financial information. 

The “!MTB” suffix refers to Machine Threat Behavior, which indicates that this trojan was detected using behavioral analysis or machine learning models. Instead of relying solely on a static signature (like a known file hash), the antivirus engine identified the program's actions, sequence of operations, or code patterns as malicious. These patterns are consistent with the known behavior of the XWorm family.       

Alert level: severe
Updated on May 08, 2023

Trojan:MSIL/XWorm.AX!MTB is an advanced malware family that operates as a Remote Access Trojan (RAT) that carries the “MSIL” designation to signify that the malware is a .NET-based threat that has been compiled to run in Microsoft Intermediate Language. Its .NET-based capabilities allow it to run on any device running Windows that is equipped with the appropriate Common Language Runtime, which means it is a very flexible and persistent backdoor and provides threat actors complete control over the compromised devices.  

Xworm is often delivered and sold as Malware-as-a-Service (MaaS), and due to its multifunctionality, it has a multitude of functionalities such as theft of sensitive information, the ability to launch distributed denial-of-service (DDoS) attacks, downloading additional payloads, and keylogging capabilities that allows it to capture sensitive user data, such as passwords and financial information. 

The “!MTB” suffix refers to Machine Threat Behavior, which indicates that this trojan was detected using behavioral analysis or machine learning models. Instead of relying solely on a static signature (like a known file hash), the antivirus engine identified the program's actions, sequence of operations, or code patterns as malicious. These patterns are consistent with the known behavior of the XWorm family.       

Alert level: severe
Updated on Jul 21, 2023

Trojan:MSIL/XWorm.MC!MTB is an advanced malware family that operates as a Remote Access Trojan (RAT) that carries the “MSIL” designation to signify that the malware is a .NET-based threat that has been compiled to run in Microsoft Intermediate Language. Its .NET-based capabilities allow it to run on any device running Windows that is equipped with the appropriate Common Language Runtime, which means it is a very flexible and persistent backdoor and provides threat actors complete control over the compromised devices.  

Xworm is often delivered and sold as Malware-as-a-Service (MaaS), and due to its multifunctionality, it has a multitude of functionalities such as theft of sensitive information, the ability to launch distributed denial-of-service (DDoS) attacks, downloading additional payloads, and keylogging capabilities that allows it to capture sensitive user data, such as passwords and financial information. 

The “!MTB” suffix refers to Machine Threat Behavior, which indicates that this trojan was detected using behavioral analysis or machine learning models. Instead of relying solely on a static signature (like a known file hash), the antivirus engine identified the program's actions, sequence of operations, or code patterns as malicious. These patterns are consistent with the known behavior of the XWorm family.      

Alert level: severe
Updated on Sep 15, 2023

Trojan:MSIL/XWorm.NW!MTB is an advanced malware family that operates as a Remote Access Trojan (RAT) that carries the “MSIL” designation to signify that the malware is a .NET-based threat that has been compiled to run in Microsoft Intermediate Language. Its .NET-based capabilities allow it to run on any device running Windows that is equipped with the appropriate Common Language Runtime, which means it is a very flexible and persistent backdoor and provides threat actors complete control over the compromised devices.  

Xworm is often delivered and sold as Malware-as-a-Service (MaaS), and due to its multifunctionality, it has a multitude of functionalities such as theft of sensitive information, the ability to launch distributed denial-of-service (DDoS) attacks, downloading additional payloads, and keylogging capabilities that allows it to capture sensitive user data, such as passwords and financial information. 

The “!MTB” suffix refers to Machine Threat Behavior, which indicates that this trojan was detected using behavioral analysis or machine learning models. Instead of relying solely on a static signature (like a known file hash), the antivirus engine identified the program's actions, sequence of operations, or code patterns as malicious. These patterns are consistent with the known behavior of the XWorm family.    

Alert level: severe
Updated on Feb 14, 2024
Alert level: severe
Updated on May 20, 2025

Trojan:MSIL/XWorm.BB!MTB is an advanced malware family that operates as a Remote Access Trojan (RAT) that carries the “MSIL” designation to signify that the malware is a .NET-based threat that has been compiled to run in Microsoft Intermediate Language. Its .NET-based capabilities allow it to run on any device running Windows that is equipped with the appropriate Common Language Runtime, which means it is a very flexible and persistent backdoor and provides threat actors complete control over the compromised devices.  

Xworm is often delivered and sold as Malware-as-a-Service (MaaS), and due to its multifunctionality, it has a multitude of functionalities such as theft of sensitive information, the ability to launch distributed denial-of-service (DDoS) attacks, downloading additional payloads, and keylogging capabilities that allows it to capture sensitive user data, such as passwords and financial information. 

The “!MTB” suffix refers to Machine Threat Behavior, which indicates that this trojan was detected using behavioral analysis or machine learning models. Instead of relying solely on a static signature (like a known file hash), the antivirus engine identified the program's actions, sequence of operations, or code patterns as malicious. These patterns are consistent with the known behavior of the XWorm family.     

Alert level: severe
Updated on May 20, 2025

Trojan:MSIL/XWorm.DB!MTB is an advanced malware family that operates as a Remote Access Trojan (RAT) that carries the “MSIL” designation to signify that the malware is a .NET-based threat that has been compiled to run in Microsoft Intermediate Language. Its .NET-based capabilities allow it to run on any device running Windows that is equipped with the appropriate Common Language Runtime, which means it is a very flexible and persistent backdoor and provides threat actors complete control over the compromised devices.  

Xworm is often delivered and sold as Malware-as-a-Service (MaaS), and due to its multifunctionality, it has a multitude of functionalities such as theft of sensitive information, the ability to launch distributed denial-of-service (DDoS) attacks, downloading additional payloads, and keylogging capabilities that allows it to capture sensitive user data, such as passwords and financial information. 

The “!MTB” suffix refers to Machine Threat Behavior, which indicates that this trojan was detected using behavioral analysis or machine learning models. Instead of relying solely on a static signature (like a known file hash), the antivirus engine identified the program's actions, sequence of operations, or code patterns as malicious. These patterns are consistent with the known behavior of the XWorm family.    

Alert level: severe
Updated on May 20, 2025

Trojan:MSIL/XWorm.DC!MTB is an advanced malware family that operates as a Remote Access Trojan (RAT) that carries the “MSIL” designation to signify that the malware is a .NET-based threat that has been compiled to run in Microsoft Intermediate Language. Its .NET-based capabilities allow it to run on any device running Windows that is equipped with the appropriate Common Language Runtime, which means it is a very flexible and persistent backdoor and provides threat actors complete control over the compromised devices.  

Xworm is often delivered and sold as Malware-as-a-Service (MaaS), and due to its multifunctionality, it has a multitude of functionalities such as theft of sensitive information, the ability to launch distributed denial-of-service (DDoS) attacks, downloading additional payloads, and keylogging capabilities that allows it to capture sensitive user data, such as passwords and financial information. 

The “!MTB” suffix refers to Machine Threat Behavior, which indicates that this trojan was detected using behavioral analysis or machine learning models. Instead of relying solely on a static signature (like a known file hash), the antivirus engine identified the program's actions, sequence of operations, or code patterns as malicious. These patterns are consistent with the known behavior of the XWorm family.    

Alert level: severe
Updated on May 20, 2025

Trojan:MSIL/XWorm.WQ!MTB is an advanced malware family that operates as a Remote Access Trojan (RAT) that carries the “MSIL” designation to signify that the malware is a .NET-based threat that has been compiled to run in Microsoft Intermediate Language. Its .NET-based capabilities allow it to run on any device running Windows that is equipped with the appropriate Common Language Runtime, which means it is a very flexible and persistent backdoor and provides threat actors complete control over the compromised devices.  

Xworm is often delivered and sold as Malware-as-a-Service (MaaS), and due to its multifunctionality, it has a multitude of functionalities such as theft of sensitive information, the ability to launch distributed denial-of-service (DDoS) attacks, downloading additional payloads, and keylogging capabilities that allows it to capture sensitive user data, such as passwords and financial information. 

The “!MTB” suffix refers to Machine Threat Behavior, which indicates that this trojan was detected using behavioral analysis or machine learning models. Instead of relying solely on a static signature (like a known file hash), the antivirus engine identified the program's actions, sequence of operations, or code patterns as malicious. These patterns are consistent with the known behavior of the XWorm family. 

Alert level: severe
Updated on Jun 30, 2025

Trojan:MSIL/XWorm.AF!MTB is an advanced malware family that operates as a Remote Access Trojan (RAT) that carries the “MSIL” designation to signify that the malware is a .NET-based threat that has been compiled to run in Microsoft Intermediate Language. Its .NET-based capabilities allow it to run on any device running Windows that is equipped with the appropriate Common Language Runtime, which means it is a very flexible and persistent backdoor and provides threat actors complete control over the compromised devices.  

Xworm is often delivered and sold as Malware-as-a-Service (MaaS), and due to its multifunctionality, it has a multitude of functionalities such as theft of sensitive information, the ability to launch distributed denial-of-service (DDoS) attacks, downloading additional payloads, and keylogging capabilities that allows it to capture sensitive user data, such as passwords and financial information. 

Xworm is often delivered and sold as Malware-as-a-Service (MaaS), and due to its multifunctionality, it has a multitude of functionalities such as theft of sensitive information, the ability to launch distributed denial-of-service (DDoS) attacks, downloading additional payloads, and keylogging capabilities that allows it to capture sensitive user data, such as passwords and financial information.  

Alert level: severe
Updated on Jun 30, 2025

Trojan:MSIL/XWorm.AG!MTB is an advanced malware family that operates as a Remote Access Trojan (RAT) that carries the “MSIL” designation to signify that the malware is a .NET-based threat that has been compiled to run in Microsoft Intermediate Language. Its .NET-based capabilities allow it to run on any device running Windows that is equipped with the appropriate Common Language Runtime, which means it is a very flexible and persistent backdoor and provides threat actors complete control over the compromised devices.  

Xworm is often delivered and sold as Malware-as-a-Service (MaaS), and due to its multifunctionality, it has a multitude of functionalities such as theft of sensitive information, the ability to launch distributed denial-of-service (DDoS) attacks, downloading additional payloads, and keylogging capabilities that allows it to capture sensitive user data, such as passwords and financial information. 

Alert level: severe