XWorm

MITRE ATT&CK FRAMEWORK ... Initial Access T1189 Drive-by Compromise ZIP archive with malware delivered via fake portal

Once downloaded, the ZIP archive unpacks a disk image file named Tax_Assessment.img, which contains two core malicious components working together in a staged execution chain.

MITRE ATT&CK FRAMEWORK ... Initial Access T1566.002 Phishing: Spear phishing Link Fraudulent Income Tax website → malicious archive download

The DLL carries full RAT capabilities, including startup registration, scheduled task creation, system information collection, user activity monitoring, and encrypted communication back to the attacker.

MITRE ATT&CK FRAMEWORK ... Persistence T1053.005 Scheduled Task Scheduled-task persistence functionality

MITRE ATT&CK FRAMEWORK ... Execution T1059 Command and Scripting Interpreter Reflection-based .NET dynamic execution

The Lua files contain base64-encoded PowerShell that, when decoded, downloads and executes the Async RAT sample (via Invoke-WebRequest).

Confense documented a Python-based loader deploying XWorm RAT using APC injection from obfuscated Python code. The attack chain used Python’s ctypes library to call native Windows APIs directly

Bumblebee’s injection module ( dij command for DLL Injection) dynamically resolves NtQueueApcThread at runtime and uses it to inject a payload DLL... While the static import of NtQueueApcThread is flagged by multiple scanners, a runtime GetProcAddress lookup on ntdll.dll is invisible to import-table analysis.

MITRE ATT&CK FRAMEWORK ... Execution T1204.002 User Execution: Malicious File User downloads/executes Tax_Assessment.exe

The DLL carries full RAT capabilities, including startup registration, scheduled task creation, system information collection, user activity monitoring, and encrypted communication back to the attacker.

MITRE ATT&CK FRAMEWORK ... Persistence T1053.005 Scheduled Task Scheduled-task persistence functionality

After deobfuscation, Tax_Assessment.exe was observed hiding its console window and modifying user registry settings.

The DLL carries full RAT capabilities, including startup registration, scheduled task creation, system information collection, user activity monitoring, and encrypted communication back to the attacker.

Functions such as AddToStartupAdmin, AddToStartupNonAdmin, and SetAutoRun indicate startup persistence mechanisms

The DLL carries full RAT capabilities, including startup registration, scheduled task creation, system information collection, user activity monitoring, and encrypted communication back to the attacker.

MITRE ATT&CK FRAMEWORK ... Persistence T1053.005 Scheduled Task Scheduled-task persistence functionality

Process injection sits at the top of the MITRE ATT&CK heap for the second year running. Picus Labs’ Red Report 2025 found T1055 in roughly 31% of the million-plus malware samples they examined.

Hence APC injection was formed as a technique, they’d find a process with a thread in an alertable wait and get a handle to it, call VirtualAllocEx and WriteProcessMemory to plant shellcode and then call QueueUserAPC pointed at the shellcode, the thread would eventually wake up and execute the shellcode.

The DLL carries full RAT capabilities, including startup registration, scheduled task creation, system information collection, user activity monitoring, and encrypted communication back to the attacker.

Functions such as AddToStartupAdmin, AddToStartupNonAdmin, and SetAutoRun indicate startup persistence mechanisms

Confense documented a Python-based loader deploying XWorm RAT using APC injection from obfuscated Python code.

HeartCrypt was originally discovered through underground forums... it has been used to pack over 2,000 malicious payloads... The packed payload was consistently added as a resource to a legitimate binary... Each resource embedded in the binary contains PIC disguised as a bitmap (BMP) image file. This begins with a standard BMP header followed by a repeating hexadecimal pattern for padding.

MITRE ATT&CK FRAMEWORK ... Stealth T1036 Masquerading Deceptive filenames/metadata impersonating tax docs

The binary uses misleading identification details, such as “Runtime Service Host” and “Microsoft Corporation,” to blend with trusted Windows components, potentially reducing suspicion and increasing the chance of bypassing security detections.

Process injection sits at the top of the MITRE ATT&CK heap for the second year running. Picus Labs’ Red Report 2025 found T1055 in roughly 31% of the million-plus malware samples they examined.

Hence APC injection was formed as a technique, they’d find a process with a thread in an alertable wait and get a handle to it, call VirtualAllocEx and WriteProcessMemory to plant shellcode and then call QueueUserAPC pointed at the shellcode, the thread would eventually wake up and execute the shellcode.

the “malware” is Python bytecode that decrypts its payload at runtime, making static analysis and YARA signatures far less effective.

MITRE ATT&CK FRAMEWORK ... Execution T1218 System Binary Proxy Execution Mounted disk image (Tax_Assessment.img) stages execution

The trick relies on a Base64-encoded PowerShell or mshta command being injected silently into the user's clipboard... This script then fetched the ClickFix lure and executed mshta via check.foquh[.]icu.

MITRE ATT&CK FRAMEWORK ... Discovery T1497.001 Virtualization/Sandbox Evasion Anti-analysis checks before execution

After deobfuscation, Tax_Assessment.exe was observed hiding its console window and modifying user registry settings.

Tax_Assessment.exe was observed loading libsvcs.dll through Assembly.LoadFrom(). After successfully loading the assembly, the executable uses reflection to resolve the client.DllEntry class and invoke the Run method.

After deobfuscation, Tax_Assessment.exe was observed hiding its console window and modifying user registry settings.

The DLL carries full RAT capabilities, including startup registration, scheduled task creation, system information collection, user activity monitoring, and encrypted communication back to the attacker.

MITRE ATT&CK FRAMEWORK ... Discovery T1033 System Owner/User Discovery User info collection during reconnaissance

Functions such as ... GetWindowsVersion ... support host reconnaissance.

MITRE ATT&CK FRAMEWORK ... Discovery T1497.001 Virtualization/Sandbox Evasion Anti-analysis checks before execution

Functions such as ... GetSecurityInfo ... support host reconnaissance.

The DLL carries full RAT capabilities, including startup registration, scheduled task creation, system information collection, user activity monitoring, and encrypted communication back to the attacker.

At the center sits a button labeled “Download Assessment Order & Workings,” which initiates the download of a malicious ZIP file disguised as official documentation.

The malware communicates with a hardcoded command-and-control server at 103.231.12.27 over port 4444.

MITRE ATT&CK FRAMEWORK ... Command & Control T1071.001 Application Layer Protocol: Web Protocols C2 via application-layer web communications

MITRE ATT&CK FRAMEWORK ... Command & Control T1105 Ingress Tool Transfer Dynamic payload loading/execution

MITRE ATT&CK FRAMEWORK ... Command & Control T1219 Remote Access Software RAT functionality for remote access/command execution

Additionally, the binary contains an embedded 32-byte constant likely used as a cryptographic key for socket communication, indicating the use of encrypted command-and-control (C2) traffic.