XWorm Malware Adopts New Infection Chain to Bypass Security Detection

Cybersecurity researchers have traced XWorm’s infection chain as it shifts from predictable distribution to more deceptive, multi-stage techniques designed to evade detection. According to Trellix Advanced Research Center, the campaign now begins with a stealthy .lnk file distributed via phishing, which triggers PowerShell commands to kick off a complex chain.

The process drops a text file in the system’s temporary directory containing the message “domethelegandary-ontop hackingtest f**ked” before downloading a deceptive executable named ‘discord.exe’. The second stage then installs two more malicious files, ‘main.exe’ and ‘system32.exe’, with the latter functioning as the actual XWorm payload and mimicking a Windows system file for camouflage.

It can disable Windows Firewall through a registry entry, checks for third‑party security tools, uses anti‑analysis techniques such as virtual environment detection, and executes a scheduled task named “XClient” running every minute. The malware also employs Rijndael with Base64 encoding for data concealment and provides backdoor control via its C2 server, enabling remote commands including shutdowns, file downloads and URL redirections.