IOCs by window
0
IOCs tagged #Xworm
1
IOCs tagged #Xworm
8
IOCs tagged #Xworm
421
IOCs tagged #Xworm
Counts as of 2026-11-12. Regenerated daily.
About #Xworm
- Type: Modular .NET RAT and stealer. First seen around 2022.
- Spread: Cracked builder copies on forums and Telegram. Leaked v6.0 in 2025.
- Abuse: Keylogging, screen and webcam capture, credential theft.
- Plugins: Extra modules per victim. Optional ransomware plugin.
- Delivery: Phishing attachments, VBS/JS/PowerShell loaders, trojanised downloads.
- Detection: Behavior and memory signals. No single static network indicator.
- References: Malpedia.
Recent IOCs tagged #Xworm
Latest 8 IOCs from the past 30 days. Live JSON: api.tweetfeed.live/v1/month/xworm.
| Date | Type | Value | Source |
|---|---|---|---|
| ip | |||
| domain | |||
| url | |||
| url | |||
| url | |||
| ip | |||
| ip | |||
| sha256 |
Low volume this month. Year total: 421. Older data: api.tweetfeed.live/v1/year (all tags, filter for #Xworm).
Related tags
Frequently asked questions
What is XWorm?
A modular .NET RAT and stealer, first seen around 2022. It steals credentials, logs keys and has an optional ransomware plugin.
How is XWorm typically delivered?
Mostly by phishing attachments, script loaders (VBS, JS, PowerShell) and trojanised downloads. It does not exploit a vulnerability to install; the victim runs the dropper.
How is this list updated?
The feed and the API update every 15 minutes from researcher posts on X. This page refreshes once a day.
What is the license? Can I use this commercially?
Yes. All IOC data, including this Xworm subset, is CC0 1.0 Universal. No attribution needed. No warranty. The website code and branding are not CC0.
License
Xworm IOC data: CC0 1.0 Public Domain. No attribution required, no warranty.