New XWorm V6 Variant Embeds Malicious Code into Trusted Windows Applications

According to Trellix ARC, XWorm has evolved into a modular threat whose V6.0 campaign expands its plugin arsenal and introduces persistence techniques designed to conceal its activity on Windows. The campaign, first publicly documented as a resurgence on 4 June 2025, follows a lineage that began with XWorm’s appearance in 2022 and its previous V5.6 variant.

A malicious JavaScript dropper downloads and runs a PowerShell script, disables AMSI, and retrieves the XWorm client along with a DLL injector, which then implants XWorm into legitimate Windows programs such as RegSvcs.exe. The compromised host talks to a C2 at 94.159.113[.]64:4411 using a new default key, and the V6.0 framework loads ILProtector-packed plugins from registry entries under HKCU\\SOFTWARE<Client ID>, with plugin commands identified by SHA-256 hashes.

Notable payloads include RemoteDesktop.dll, Stealer.dll, FileManager.dll, shell.dll and ransomware.dll, the latter encrypting files with AES-CBC keyed by a SHA-512 hash of the client ID and dropping ransom notes. The article emphasises that XWorm’s plugin count exceeds 35 and highlights four persistence methods ranging from startup keys to factory-reset hooks.