XWorm RAT
威脅評分卡
EnigmaSoft 威胁记分卡
EnigmaSoft 威脅記分卡是我們的研究團隊收集和分析的不同惡意軟件威脅的評估報告。 EnigmaSoft 威脅記分卡使用多種指標對威脅進行評估和排名，包括現實世界和潛在的風險因素、趨勢、頻率、普遍性和持續性。 EnigmaSoft 威脅記分卡根據我們的研究數據和指標定期更新，對范圍廣泛的計算機用戶非常有用，從尋求解決方案以從其係統中刪除惡意軟件的最終用戶到分析威脅的安全專家。
EnigmaSoft 威脅記分卡顯示各種有用的信息，包括：
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
嚴重級別：根據我們的風險建模過程和研究確定的對象嚴重級別，以數字表示，如我們的威脅評估標準中所述。
受感染的計算機：根據 SpyHunter 的報告，在受感染的計算機上檢測到的特定威脅的已確認和疑似案例的數量。
另請參閱威脅評估標準。
| Popularity Rank: | 4,286 |
| 威胁级别： | 80 % (高的) |
| 受感染的计算机： | 312 |
| 初见： | April 24, 2023 |
| 最后一次露面： | January 22, 2026 |
| 受影响的操作系统： | Windows |
XWorm 惡意軟件被識別為遠程訪問木馬 (RAT) 類別的威脅。 RAT 專門設計用於網絡犯罪分子對受害者計算機進行未經授權的訪問和控制。通過使用 RAT，攻擊者可以遠程監控和觀察用戶活動、竊取敏感數據，並根據其具體目標在受感染的系統上執行各種惡意操作。據研究人員稱，XWorm RAT 的開發商以 400 美元的價格出售。
目錄
XWorm RAT 可以竊取廣泛的敏感信息
XWorm RAT 擁有廣泛的功能，使其成為網絡犯罪分子手中高度複雜且危險的威脅。其主要功能之一是能夠從受害者的計算機上秘密竊取有價值的系統信息。 RAT 可以從流行瀏覽器竊取敏感數據。 XWorm 可以從 Chromium 瀏覽器中提取密碼、cookie、信用卡詳細信息、書籤、下載、關鍵字和瀏覽歷史記錄。同樣，它可以竊取 Firefox 瀏覽器的密碼、cookie、書籤和歷史記錄，極大地損害受害者在線活動的安全。
此外，XWorm 的功能涵蓋針對各種應用程序和服務。它可以竊取 Telegram 會話數據、Discord 令牌、WiFi 密碼、Metamask 和 FileZilla 數據。此外，XWorm 還可以訪問註冊表編輯器、記錄擊鍵、運行勒索軟件來加密文件並索要贖金，以及操縱剪貼板數據、服務和進程。
除了信息盜竊之外，XWorm 還具有執行文件的能力，使攻擊者能夠在受感染的系統上運行各種惡意程序和有效負載。此外，該特洛伊木馬還可以未經授權訪問受害者的網絡攝像頭和麥克風，從而嚴重侵犯隱私並允許攻擊者監視受害者的活動。 XWorm 的影響範圍進一步擴大，因為它可以打開 URL、執行 shell 命令和管理文件，從而有效地讓攻擊者完全控制受害者的計算機。
攻擊者甚至可以使用 XWorm 啟用或禁用關鍵系統組件和功能，例如用戶帳戶控制 (UAC)、註冊表編輯器、任務管理器、防火牆和系統更新。調用藍屏死機 (BSoD) 的能力給受害者的系統增加了另一層破壞和潛在損害。
XWorm RAT 可用於在被破壞的設備上傳遞勒索軟件有效負載
XWorm 的一項重要功能是其進行勒索軟件攻擊的能力。勒索軟件正在威脅加密文件的軟件，如果沒有特定的解密密鑰就無法訪問它們。隨後，XWorm 的運營商可以要求受害者付款，以換取受害者提供必要的解密軟件以重新獲得對加密文件的訪問權限。
此外，據觀察，網絡犯罪分子利用 XWorm 進行剪貼板劫持。該技術涉及惡意軟件監控和攔截複製到受害者剪貼板的數據，特別關注替換加密貨幣錢包地址。例如，如果受害者復制比特幣、以太坊或其他加密貨幣錢包地址，XWorm 會檢測到該數據並將其替換為網絡犯罪分子擁有的錢包地址。因此，受害者無意中將資金發送到黑客的錢包，而不是預期的收件人地址。
XWorm RAT 中觀察到的廣泛惡意功能還包括鍵盤記錄功能。鍵盤記錄涉及秘密捕獲和記錄用戶在受感染系統上進行的所有鍵盤輸入的有害過程。這意味著密碼、登錄憑據、敏感消息和其他個人信息會被秘密記錄並傳輸到攻擊者的命令和控制服務器。
分析报告
一般信息
| Family Name: | Keylogger.XWormRAT |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
8393544e67726805f0c88ccda151372c
SHA1:
2e161a4086a183403597d0a6b0ae9ea0c9d19037
SHA256:
36D605F10AE3233010B4BE32CF6B75501B3D332C95CF56E54001FD8C7A8389CE
文件大小:
2.97 MB, 2971648 bytes
|
|
MD5:
6c081bbee7b8c0dede2869a2d239d3c3
SHA1:
53c9351e354d5466b49786b2b6afafee30d822ee
SHA256:
9114C4BDC17A52B091638AE86A2D788EDA113CDC94925B3343A483F2EFC396BD
文件大小:
11.78 KB, 11776 bytes
|
|
MD5:
0ae34e0fa21b649ebfc90052b713682a
SHA1:
ce89172965fe3205dc28014db093c5c19a3e1236
SHA256:
2A0EA0B7D49FF3D309AB51EC94B06C7370EFC5D7AA5200F05D130F27EEC9762E
文件大小:
55.30 KB, 55296 bytes
|
|
MD5:
5d7149ceedf9f6ae4fbe58771daeec84
SHA1:
4ed9ef1ed31a9dda24b488f10a0799003a1ab0fe
SHA256:
7334C22939E917D6D9E4B3F849F07F7FA6D34D9787692B3DCA06145B3D7EBF4B
文件大小:
44.54 KB, 44544 bytes
|
|
MD5:
e27820ce232dfe90f0e7eda36614d2d1
SHA1:
46523ea3b60c6987d20b0751296b7d3de874e6d7
SHA256:
1FC75F0B36B7DF183678BE72F3B225ACC04A5B450D67D2E1AF42DEE53A243805
文件大小:
2.07 MB, 2074112 bytes
|
Show More
|
MD5:
4489cbaa5dc8e45ad3293280175bda02
SHA1:
6a2f992055737bd58e936c01c86ed965034dce57
SHA256:
D95B28A388740E01832E83FCCFB6EB8B07188C36FFDCC5D73FA9D00754946459
文件大小:
265.73 KB, 265728 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have security information
- File has exports table
- File has TLS information
- File is .NET application
- File is 32-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
Show More
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| 姓名 | 价值 |
|---|---|
| Assembly Version | 1.0.0.0 |
| Company Name | Synaptics |
| File Description |
|
| File Version |
|
| Internal Name |
|
| Legal Copyright |
|
| Original Filename |
|
| Product Name |
|
| Product Version |
|
File Traits
- .NET
- 00 section
- 2+ executable sections
- dll
- HighEntropy
- Installer Version
- NewLateBinding
- ntdll
- RijndaelManaged
- Run
Show More
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 74 |
|---|---|
| Potentially Malicious Blocks: | 41 |
| Whitelisted Blocks: | 20 |
| Unknown Blocks: | 13 |
Visual Map
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
x
x
x
?
x
x
x
x
x
x
x
x
0
x
x
x
x
x
?
?
?
?
x
?
?
x
x
x
?
?
x
x
?
x
x
x
?
0
x
x
x
x
x
0
0
x
x
x
x
x
x
x
x
x
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- MSIL.BypassUAC.K
- MSIL.BypassUAC.LC
- MSIL.BypassUAC.P
- MSIL.Downloader.CAYD
- MSIL.Rozena.GG
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\users\user\ce89172965fe3205dc28014db093c5c19a3e1236_0000055296 | Generic Write,Read Attributes |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | 数据 | API Name |
|---|---|---|
| HKLM\software\microsoft\tracing\rasapi32::enablefiletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::enableautofiletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::enableconsoletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::filetracingmask | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::consoletracingmask | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::maxfilesize | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::filedirectory | %windir%\tracing | RegNtPreCreateKey |
| HKLM\software\microsoft\tracing\rasmancs::enablefiletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasmancs::enableautofiletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasmancs::enableconsoletracing | RegNtPreCreateKey |
Show More
| HKLM\software\microsoft\tracing\rasmancs::filetracingmask | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasmancs::consoletracingmask | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasmancs::maxfilesize | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasmancs::filedirectory | %windir%\tracing | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Other Suspicious |
|
| User Data Access |
|
| Anti Debug |
|
| Syscall Use |
Show More
8 additional items are not displayed above. |
| Encryption Used |
|
| Process Manipulation Evasion |
|
| Network Winsock2 |
|
| Network Winsock |
|
| Network Winhttp |
|
| Network Info Queried |
|
