Beyond Simple Scripts: A New XWorm Campaign Uses Multi-Stage Stealth

A new XWorm campaign, identified by researchers at the Trellix Advanced Research Center, marks a shift to multi-stage stealth with the aim of evasion, persistence and evading detection. The attack commonly begins with a malicious .lnk shortcut delivered via phishing emails, where a hidden PowerShell command drops a payload.txt containing a taunting string and then downloads a fake Discord executable from a remote server.

This Discord.exe, disguised with the Discord icon, drops two additional executables: main.exe, a packed loader that disables security tools, and system32.exe, the actual XWorm payload masquerading as a core Windows system file.

The loader uses embedded .pyd modules and a main.dll, with TLS callbacks to complicate analysis, while the final payload introduces backdoor capabilities including virtualization checks, persistence via a scheduled task named XClient, and startup registry entries, plus PowerShell exclusions to whitelist itself.

The malware also uses layered cryptography with Rijndael to decrypt configuration data such as C2 IPs and commands, enabling actions like shutting down systems, downloading more payloads, and opening malicious URLs. XWorm then renames itself Xclient.exe to continue operations under a new disguise.