It executes a wide range of commands like “system manipulation” (‘shutdown,’ ‘restart,’ ‘logoff’), “file operations,” and “remote code execution” via PowerShell. This diverse toolkit enables the actors to have a extensive access and control over the systems that have been compromised which makes “XWorm” a significant threat in today’s cybersecurity ecosystem. These sophisticated techniques enable “XWorm” to “access sensitive information,” “gain remote access,” and deploy “additional malware” while evading detection. It communicates with its “command and control (‘C2’) server” via “TCP sockets,” using “AES-ECB encryption” with a modified “MD5 hash” as the key. XWorm captures ‘screenshots’ using the “CopyFromScreen” function and stores them as “JPEG” images in memory before transmission. Here the new features in v5.6 include the ability to remove plugins and a “Pong” command for response time reporting.
This Cyber News was published on cybersecuritynews.com. Publication date: Tue, 01 Oct 2024 15:06:24 +0000