XWorm malware
XWorm is a .NET remote access trojan and loader sold as malware-as-a-service. It supports remote control, data theft, DDoS and ransomware modules, with an encrypted configuration holding its C2 endpoints.
Malva.RE has analysed 479 public samples tagged XWorm, statically and without execution. The latest public sample was seen on 2026-10-21.
File types
- PE Executable39
- ZIP Archive1
Recurring C2 endpoints
74[.]120[.]121[.]2233188[.]212[.]158[.]342u973[.]cantdown[.]su1152[.]89[.]168[.]2441103[.]67[.]163[.]1881valid-rpg[.]gl[.]at[.]ply[.]gg1Artexxiz-64097[.]portmap[.]host1151[.]241[.]154[.]231xw[.]bidz[.]top1xw[.]jukt[.]top1
Defanged. Extracted statically from the configurations of public samples.
Latest public XWorm samples
Analyse your own XWorm sample
Malva.RE unpacks, decompiles and extracts the configuration of suspicious files statically — the file is never executed. Free-plan reports are public.
Analyse a file for free