XWorm Unmasked: Weaponizing Script Obfuscation and Modern Evasion Techniques
Summary The XWorm malware family is known for leveraging VBScript (VBS), Batch (BAT), and PowerShell (PS1) scripts to implement advanced obfuscation and evasion techniques, which are highly modular and weaponizing, and it is also a sophisticated RAT . Technique analysis Sample md5 a2907290e94d10d566afaad71f0a77d2 Sha256 ecb6c26329c5aa711c857bb37431b6d5037b0d28818af4c033c78231d007bb40 combining Scri pt-based obfuscation (VBS/BAT/PS1) and multi-stages This malware sample uses VBScript to create a batch file, WordDoc.bat. The file WordDoc.bat runs and injects and executes injection code, which is the PowerShell script, and finally uses the PS1 to load a malicious embedded payload and connects to the attacker’s Command & Control (C2) server. The way belongs to multi-stages to load the payload of attacking . Fig.1 Combining VBS+BAT+PS1 and multi-stages In VBScript , the ...