#Xworm

Modular .NET RAT and stealer. Spread via a leaked builder.

Subscribe (RSS)


#Xworm

Modular .NET RAT/stealer, leaked builder

Subscribe (RSS)

IOCs by window

Today

0

IOCs tagged #Xworm

Week

0

IOCs tagged #Xworm

Month

14

IOCs tagged #Xworm

Year

495

IOCs tagged #Xworm

Counts as of 2026-10-22. Regenerated daily.

About #Xworm

  • Type: Modular .NET RAT and stealer. First seen around 2022.
  • Spread: Cracked builder copies on forums and Telegram. Leaked v6.0 in 2025.
  • Abuse: Keylogging, screen and webcam capture, credential theft.
  • Plugins: Extra modules per victim. Optional ransomware plugin.
  • Delivery: Phishing attachments, VBS/JS/PowerShell loaders, trojanised downloads.
  • Detection: Behavior and memory signals. No single static network indicator.
  • References: Malpedia.

Recent IOCs tagged #Xworm

Latest 10 IOCs from the past 30 days. Live JSON: api.tweetfeed.live/v1/month/xworm.

Date Type Value Source
Oct 06, 15:21 url http://107.173.143.44/60 @James_inthe_box
Oct 06, 15:21 url http://151.241.154.23:7007 @James_inthe_box
Oct 06, 15:21 ip 107.173.143.44 @James_inthe_box
Oct 06, 15:21 ip 151.241.154.23 @James_inthe_box
Oct 06, 11:45 domain ygz.bet @smica83
Oct 06, 11:45 url http://ygz.bet/fps.exe @smica83
Oct 06, 11:45 ip 45.141.26.63 @smica83
Oct 06, 11:45 sha256 38fc7910c4e49d6be701b7850ad3f00093735590d051bbeb1399ce149fc6... @smica83
Oct 05, 16:00 domain 130826.ngrok.app @smica83
Oct 05, 16:00 url https://130826.ngrok.app/MicrosoftUpdateServices.exe @smica83

Related tags

Often seen with #Xworm.

See all tags on the Dashboard or browse the full IOC feed.

Frequently asked questions

What is XWorm?

A modular .NET RAT and stealer, first seen around 2022. It steals credentials, logs keys and has an optional ransomware plugin.

How is XWorm typically delivered?

Mostly by phishing attachments, script loaders (VBS, JS, PowerShell) and trojanised downloads. It does not exploit a vulnerability to install; the victim runs the dropper.

How is this list updated?

The feed and the API update every 15 minutes from researcher posts on X. This page refreshes once a day.

What is the license? Can I use this commercially?

Yes. All IOC data, including this Xworm subset, is CC0 1.0 Universal. No attribution needed. No warranty. The website code and branding are not CC0.

License

Xworm IOC data: CC0 1.0 Public Domain. No attribution required, no warranty.