XWorm RAT
威胁评分卡
EnigmaSoft 威胁记分卡
EnigmaSoft 威胁记分卡是针对不同恶意软件威胁的评估报告，由我们的研究团队收集和分析。 EnigmaSoft 威胁记分卡使用多个指标对威胁进行评估和排名，包括现实世界和潜在风险因素、趋势、频率、普遍性和持续性。 EnigmaSoft 威胁记分卡会根据我们的研究数据和指标定期更新，对广泛的计算机用户有用，从寻求解决方案以从系统中删除恶意软件的最终用户到分析威胁的安全专家。
EnigmaSoft 威胁记分卡显示各种有用的信息，包括：
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
严重性级别：根据我们的风险建模过程和研究，确定的对象的严重性级别，以数字形式表示，如我们的威胁评估标准中所述。
受感染计算机： SpyHunter 报告的在受感染计算机上检测到的特定威胁的确认和疑似案例数量。
另请参阅威胁评估标准。
| Popularity Rank: | 4,286 |
| 威胁级别： | 80 % (高的) |
| 受感染的计算机： | 312 |
| 初见： | April 24, 2023 |
| 最后一次露面： | January 22, 2026 |
| 受影响的操作系统： | Windows |
XWorm 恶意软件被识别为远程访问木马 (RAT) 类别的威胁。 RAT 专门设计用于网络犯罪分子对受害者计算机进行未经授权的访问和控制。通过使用 RAT，攻击者可以远程监控和观察用户活动、窃取敏感数据，并根据其具体目标在受感染的系统上执行各种恶意操作。据研究人员称，XWorm RAT 的开发商以 400 美元的价格出售。
目录
XWorm RAT 可以窃取广泛的敏感信息
XWorm RAT 拥有广泛的功能，使其成为网络犯罪分子手中高度复杂且危险的威胁。其主要功能之一是能够从受害者的计算机上秘密窃取有价值的系统信息。 RAT 可以从流行浏览器窃取敏感数据。 XWorm 可以从 Chromium 浏览器中提取密码、cookie、信用卡详细信息、书签、下载、关键字和浏览历史记录。同样，它可以窃取 Firefox 浏览器的密码、cookie、书签和历史记录，极大地损害受害者在线活动的安全。
此外，XWorm 的功能涵盖针对各种应用程序和服务。它可以窃取 Telegram 会话数据、Discord 令牌、WiFi 密码、Metamask 和 FileZilla 数据。此外，XWorm 还可以访问注册表编辑器、记录击键、运行勒索软件来加密文件并索要赎金，以及操纵剪贴板数据、服务和进程。
除了信息盗窃之外，XWorm 还具有执行文件的能力，使攻击者能够在受感染的系统上运行各种恶意程序和有效负载。此外，该特洛伊木马还可以未经授权访问受害者的网络摄像头和麦克风，从而严重侵犯隐私并允许攻击者监视受害者的活动。 XWorm 的影响范围进一步扩大，因为它可以打开 URL、执行 shell 命令和管理文件，从而有效地让攻击者完全控制受害者的计算机。
攻击者甚至可以使用 XWorm 启用或禁用关键系统组件和功能，例如用户帐户控制 (UAC)、注册表编辑器、任务管理器、防火墙和系统更新。调用蓝屏死机 (BSoD) 的能力给受害者的系统增加了另一层破坏和潜在损害。
XWorm RAT 可用于在被破坏的设备上传递勒索软件有效负载
XWorm 的一项重要功能是其进行勒索软件攻击的能力。勒索软件正在威胁加密文件的软件，使文件在没有特定解密密钥的情况下无法访问。随后，XWorm 的运营商可以要求受害者付款，以换取受害者提供必要的解密软件以重新获得对加密文件的访问权限。
此外，据观察，网络犯罪分子利用 XWorm 进行剪贴板劫持。该技术涉及恶意软件监控和拦截复制到受害者剪贴板的数据，特别关注替换加密货币钱包地址。例如，如果受害者复制比特币、以太坊或其他加密货币钱包地址，XWorm 会检测到该数据并将其替换为网络犯罪分子拥有的钱包地址。因此，受害者无意中将资金发送到黑客的钱包，而不是预期的收件人地址。
XWorm RAT 中观察到的广泛恶意功能还包括键盘记录功能。键盘记录涉及秘密捕获和记录用户在受感染系统上进行的所有键盘输入的有害过程。这意味着密码、登录凭据、敏感消息和其他个人信息会被秘密记录并传输到攻击者的命令和控制服务器。
分析报告
一般信息
| Family Name: | Keylogger.XWormRAT |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
8393544e67726805f0c88ccda151372c
SHA1:
2e161a4086a183403597d0a6b0ae9ea0c9d19037
SHA256:
36D605F10AE3233010B4BE32CF6B75501B3D332C95CF56E54001FD8C7A8389CE
文件大小:
2.97 MB, 2971648 bytes
|
|
MD5:
6c081bbee7b8c0dede2869a2d239d3c3
SHA1:
53c9351e354d5466b49786b2b6afafee30d822ee
SHA256:
9114C4BDC17A52B091638AE86A2D788EDA113CDC94925B3343A483F2EFC396BD
文件大小:
11.78 KB, 11776 bytes
|
|
MD5:
0ae34e0fa21b649ebfc90052b713682a
SHA1:
ce89172965fe3205dc28014db093c5c19a3e1236
SHA256:
2A0EA0B7D49FF3D309AB51EC94B06C7370EFC5D7AA5200F05D130F27EEC9762E
文件大小:
55.30 KB, 55296 bytes
|
|
MD5:
5d7149ceedf9f6ae4fbe58771daeec84
SHA1:
4ed9ef1ed31a9dda24b488f10a0799003a1ab0fe
SHA256:
7334C22939E917D6D9E4B3F849F07F7FA6D34D9787692B3DCA06145B3D7EBF4B
文件大小:
44.54 KB, 44544 bytes
|
|
MD5:
e27820ce232dfe90f0e7eda36614d2d1
SHA1:
46523ea3b60c6987d20b0751296b7d3de874e6d7
SHA256:
1FC75F0B36B7DF183678BE72F3B225ACC04A5B450D67D2E1AF42DEE53A243805
文件大小:
2.07 MB, 2074112 bytes
|
Show More
|
MD5:
4489cbaa5dc8e45ad3293280175bda02
SHA1:
6a2f992055737bd58e936c01c86ed965034dce57
SHA256:
D95B28A388740E01832E83FCCFB6EB8B07188C36FFDCC5D73FA9D00754946459
文件大小:
265.73 KB, 265728 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have security information
- File has exports table
- File has TLS information
- File is .NET application
- File is 32-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
Show More
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| 姓名 | 价值 |
|---|---|
| Assembly Version | 1.0.0.0 |
| Company Name | Synaptics |
| File Description |
|
| File Version |
|
| Internal Name |
|
| Legal Copyright |
|
| Original Filename |
|
| Product Name |
|
| Product Version |
|
File Traits
- .NET
- 00 section
- 2+ executable sections
- dll
- HighEntropy
- Installer Version
- NewLateBinding
- ntdll
- RijndaelManaged
- Run
Show More
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 74 |
|---|---|
| Potentially Malicious Blocks: | 41 |
| Whitelisted Blocks: | 20 |
| Unknown Blocks: | 13 |
Visual Map
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
x
x
x
?
x
x
x
x
x
x
x
x
0
x
x
x
x
x
?
?
?
?
x
?
?
x
x
x
?
?
x
x
?
x
x
x
?
0
x
x
x
x
x
0
0
x
x
x
x
x
x
x
x
x
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- MSIL.BypassUAC.K
- MSIL.BypassUAC.LC
- MSIL.BypassUAC.P
- MSIL.Downloader.CAYD
- MSIL.Rozena.GG
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\users\user\ce89172965fe3205dc28014db093c5c19a3e1236_0000055296 | Generic Write,Read Attributes |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | 数据 | API Name |
|---|---|---|
| HKLM\software\microsoft\tracing\rasapi32::enablefiletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::enableautofiletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::enableconsoletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::filetracingmask | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::consoletracingmask | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::maxfilesize | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::filedirectory | %windir%\tracing | RegNtPreCreateKey |
| HKLM\software\microsoft\tracing\rasmancs::enablefiletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasmancs::enableautofiletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasmancs::enableconsoletracing | RegNtPreCreateKey |
Show More
| HKLM\software\microsoft\tracing\rasmancs::filetracingmask | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasmancs::consoletracingmask | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasmancs::maxfilesize | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasmancs::filedirectory | %windir%\tracing | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Other Suspicious |
|
| User Data Access |
|
| Anti Debug |
|
| Syscall Use |
Show More
8 additional items are not displayed above. |
| Encryption Used |
|
| Process Manipulation Evasion |
|
| Network Winsock2 |
|
| Network Winsock |
|
| Network Winhttp |
|
| Network Info Queried |
|
