New XWorm V6 Variant Embeds Malicious Code into Trusted Windows Applications

In the constantly evolving world of cyber threats, staying informed is not just an advantage; it’s a necessity. First observed in 2022, XWorm quickly gained notoriety as a highly effective malware, providing cybercriminals with a versatile toolkit for malicious activities.

XWorm’s modular design is built around a core client and an array of specialized components known as plugins. These plugins are essentially additional payloads designed to carry out specific harmful actions once the core malware is active.

This modularity allows attackers to use XWorm’s capabilities for various objectives, ranging from data theft and system control to persistent surveillance.

Understanding these plugins is crucial for both cybersecurity professionals safeguarding their organizations and customers of cybersecurity products seeking to enhance their protection against such prevalent threats.

Trellix ARC has been closely observed XWorm’s evolution, including its recent resurgence. In this blog, we’ll go beyond the surface to explore a campaign deploying XWorm V6.0 and, more importantly, dissect the key plugins and additional payloads, including a script for persistence.

From Abandonment to Chaos

XWorm’s development, led by “XCoder,” saw regular updates shared via Telegram. During late 2024, after the release of XWorm V5.6, XCoder deleted their account, ending official support and leaving V5.6 as the presumed final version.

In the aftermath, threat actors distributed cracked V5.6 builders laced with trojans that infected unwitting operators. Reports by CloudSEK and DMPdump detail trojanized builders and modified distributions, while a Chinese-language offshoot named XSPY emerged.

An additional blow came from the disclosure of a critical remote code execution vulnerability in V5.6, enabling attackers with the C2 encryption key to execute arbitrary code—an exploit verified in labs.

Believing XWorm dead, many professionals turned attention elsewhere, but malware retirement is seldom permanent.

On June 4, 2025, hackforums.net saw a post from “XCoderTools” announcing XWorm V6.0, claiming fixes for the RCE flaw and other enhancements.

Skepticism ran high: Was XCoderTools the true author or an opportunist riding XWorm’s reputation? Two Telegram channels—one for updates, one for discussion—surfaced but were repeatedly banned, driving operators to mirror on Signal.

Community videos showcase new features, yet the legitimacy of V6.0 remains under scrutiny. Since its release, VirusTotal detections of XWorm V6.0 have surged, underscoring rapid threat actor adoption.

Infection Chain and Plugin Arsenal

A prominent V6.0 campaign begins with a malicious JavaScript file that downloads and executes a PowerShell script while displaying a benign PDF decoy.

The PowerShell component disables AMSI to avoid detection, fetches the XWorm client and a DLL injector, and prepares them for stealthy deployment.

The injector embeds XWorm’s code into legitimate Windows programs like RegSvcs.exe, enabling covert execution.

Once active, the client connects to C2 at 94[.]159[.]113[.]64:4411 using a new default key (“<666666>” vs. “<123456789>” in V5.6). Core functionality echoes V5.6, but V6.0 introduces ILProtector-packed plugins that load from registry entries under HKCUSOFTWARE.

Operators issue “plugin” commands by SHA-256 hash; missing plugins trigger a “sendplugin” workflow. Loaded plugins support remote desktop, credential theft, file management, shell execution, startup enumeration, TCP control, webcam streaming, and ransomware.

Notable payloads include RemoteDesktop.dll, Stealer.dll, FileManager.dll, Shell.dll, and ransomware.dll. The latter encrypts files with AES-CBC keyed by a SHA-512 hash of the client ID, drops ransom notes and wallpapers, and sets registry flags for tracking encryption status.

Decryption mirrors this process. V6’s plugin count exceeds 35, with additional modules for rootkit installation and factory-reset persistence in leaked V6.4 builders.

Persistence and Evolving Threat

Persistence scripts delivered via VBS or .wsf files create scheduled tasks, registry run keys, and even ResetConfig.xml for push-button resets to survive reinstalls.

Operators leverage four distinct persistence methods ranging from logon scripts to admin-level factory reset hooks.

Cracked V6 builders further distribute infected builders, highlighting a self-propagating risk where builders themselves harbor malware.

XWorm V6’s return underscores that no malware threat ever truly retires. Its modular plugin architecture and advanced injection techniques demand defenses beyond signature-based prevention.

A multi-layered posture is essential: endpoint detection and response to catch anomalous process injections; proactive email and web gateways to block initial droppers; and continuous network monitoring to spot C2 communications. In this dynamic threat landscape, agile, behavior-focused security platforms are imperative to stay one step ahead of adversaries.

IOC

Here is the data presented in tabular form:

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.