Open Directory Investigation: This sample was discovered on an open directory hosted at IP address 109.230.231.37, representing an active malware distribution point. This is the third RAT variant from this infrastructure, following agent.exe (PoetRAT) and agent_xworm.exe (XWorm v5.x), indicating organized multi-malware distribution operations. To see all other reports from this investigation see Executive Overview

Campaign Identifier: Arsenal-237-109.230.231.37-Malware-Repository

Last Updated: January 10, 2026

BLUF (Bottom Line Up Front)

Executive Summary

Business Impact Summary

agent_xworm_v2.exe is a CRITICAL-severity Remote Access Trojan (RAT) confirmed as XWorm RAT version 2.4.0, representing the latest evolution of the XWorm malware family. This 15.8KB .NET-compiled malware demonstrates professional-grade development with WebSocket-based command-and-control infrastructure (109.230.231.37), Base64-encoded communications, PowerShell reconnaissance capabilities, and modular payload delivery mechanisms.

XWorm’s architecture revolves around a WebSocket-based C2 client that maintains persistent connections using authentication secrets (AgentSec_8hJ3kL6mN9pQ2rS5tU8vW1xY4zA7bC0d). Static analysis reveals modular command handlers for process enumeration, service discovery, domain checking, and arbitrary PowerShell execution. The malware’s small footprint (15.8KB) combined with hidden console operation indicates a lightweight first-stage payload designed for rapid deployment and minimal detection surface.

The threat landscape for XWorm has evolved significantly, with XWorm v6.0 (released June 4, 2025) introducing fully re-coded capabilities with AMSI bypass and ETW tampering. XWorm is increasingly deployed as part of multi-malware campaigns, with 78% delivering secondary payloads including AsyncRAT and LockBit Black ransomware. This specific sample (v2.4.0) represents a mid-generation variant with proven capabilities but without the advanced evasion features of v6.0.

Key Risk Factors

Risk Factor Score Business Impact
Overall Risk 7.8/10 HIGH - Professional RAT with full remote control
Remote Control Capability 9/10 Full system access via WebSocket C2, PowerShell execution, file operations
Data Exfiltration Risk 8/10 System fingerprinting, credential harvesting potential, file download
Persistence Difficulty 6/10 Code structure supports persistence (not observed in this execution)
Evasion Capability 7/10 Console hiding, Base64 encoding, obfuscated strings, .NET compilation
Detection Challenge 8/10 WebSocket C2 blends with legitimate traffic; requires behavioral detection
Lateral Movement Risk 6/10 PowerShell execution enables credential theft and network enumeration
Multi-Malware Risk 8/10 78% of XWorm campaigns deliver secondary payloads (AsyncRAT, LockBit)
  1. ISOLATE systems showing connections to 109.230.231.37 immediately
  2. BLOCK C2 infrastructure at network perimeter and internal firewalls - CRITICAL
  3. DEPLOY behavioral detection rules for .NET RAT indicators and WebSocket C2
  4. HUNT enterprise-wide for file hashes, authentication secret “AgentSec_”, PowerShell anomalies
  5. ROTATE credentials for all users on confirmed or suspected infected systems - MANDATORY
  6. MONITOR for secondary payload delivery (AsyncRAT, LockBit ransomware indicators)
  7. REBUILD infected systems (strongly recommended over cleanup attempts)

Table of Contents

Quick Reference

Detections & IOCs:

Related Reports:

File Identification

  • Original Filename: agent_xworm_v2.exe
  • SHA256: f8e7e73bf2b26635800a042e7890a35f7376508f288a1ced3d3e12b173c5cb7e
  • SHA1: 7c624e0b11c817d516f9411972191c4627fd2e53
  • MD5: 4164a1945d8373255a5cb7e42f05c259
  • File Size: 15,872 bytes (15.8 KB)
  • Type: PE32 executable (console) Intel 80386, .NET assembly
  • Framework: .NET Framework v4.0.30319 (Microsoft Visual Studio .NET)
  • Family: XWorm RAT (CONFIRMED - HIGH confidence 95%)
  • Version: 2.4.0 (CONFIRMED - hardcoded version string)
  • Distribution Source: IP 109.230.231.37 (CONFIRMED - Open Directory)

Discovery Context: Discovered on an open directory at 109.230.231.37, the same active malware distribution point serving agent.exe (PoetRAT) and agent_xworm.exe. The presence of multiple RAT variants with sequential naming (“agent”, “agent_xworm”, “agent_xworm_v2”) suggests infrastructure reuse by organized threat actors operating a multi-malware distribution campaign.

Executive Technical Summary

Business Context

agent_xworm_v2.exe is a professional-grade Remote Access Trojan representing XWorm version 2.4.0, part of the XWorm malware family that compromised 18,459 devices worldwide in a single campaign. XWorm operates as Malware-as-a-Service (MaaS), with builder tools enabling rapid generation of customized samples. This specific version (2.4.0) represents a mid-generation variant with proven remote control capabilities but predates the advanced evasion features introduced in XWorm v6.0 (June 2025).

Key Business Impacts

  • Multi-Stage Attack Platform: 78% of XWorm campaigns deliver secondary malware (AsyncRAT, LockBit ransomware)
  • Credential Harvesting: PowerShell execution enables deployment of credential dumping tools (Mimikatz, LaZagne)
  • Network Pivoting: Reconnaissance capabilities enable lateral movement and Active Directory compromise
  • Regulatory Exposure: Data exfiltration creates GDPR, HIPAA, PCI-DSS violation risks
  • Ransomware Pipeline: Increasingly used as initial access for LockBit Black deployment

Version Evolution Context

  • v2.4.0 (This Sample): WebSocket C2, PowerShell reconnaissance, payload delivery, Base64 encoding
  • XWorm v5.x: Enhanced modular plugin system, improved persistence mechanisms
  • XWorm v6.0 (June 2025): “Fully re-coded” with AMSI bypass, ETW tampering, advanced evasion

This sample lacks the advanced v6.0 evasion capabilities, making it more detectable by modern security tools while still maintaining dangerous core RAT functionality.

Detection Challenges

  • .NET Compilation: Inherent complexity in reverse engineering, easily recompiled for signature evasion
  • Small Footprint: 15.8KB binary evades size-based heuristics
  • WebSocket Protocol: C2 traffic blends with legitimate web application communications
  • Legitimate Naming: “agent” naming pattern mimics enterprise software
  • Dormant C2: Server offline during analysis (common XWorm evasion tactic)
  • Base64 Encoding: Obfuscated network traffic prevents simple inspection

Deep Technical Analysis

Code Architecture

agent_xworm_v2.exe is a 32-bit .NET console application with modular architecture:

Core Components:

  • Main Loop: Main() initiates WebSocket C2 connection and heartbeat threads
  • Networking: WebSocket client (System.Net.WebSockets) with automatic reconnection
  • Command Handler: Dictionary-based command routing for modular execution
  • Execution Engine: PowerShell command execution via System.Diagnostics.Process
  • Reconnaissance: System enumeration via PowerShell Get-Process, Get-Service, WMI queries
  • Encoding: Base64 encoding (ToBase64String()) for C2 communications
  • Fingerprinting: MD5 hashing for unique victim identification

Configuration Constants:

VERSION: 2.4.0
C2_HOST: 109.230.231.37
AGENT_SECRET: AgentSec_8hJ3kL6mN9pQ2rS5tU8vW1xY4zA7bC0d
PROTOCOL: WebSocket (ws://)

Embedded PowerShell Commands:

  1. Process Enumeration: Get-Process | Sort CPU -Desc | Select -First 20 Name,Id,CPU,WS | FT
  2. Service Discovery: Get-Service | ?{$_.Status -eq 'Running'} | Select Name,Status,StartType | FT
  3. Domain Checking: Get-WmiObject Win32_ComputerSystem | Select Name,PartOfDomain,Domain,DomainRole

Command & Control Infrastructure

C2 Characteristics:

  • Server: 109.230.231.37 (hardcoded, offline during analysis)
  • Protocol: WebSocket (ws://) for real-time bidirectional communication
  • Authentication: Shared secret “AgentSec_8hJ3kL6mN9pQ2rS5tU8vW1xY4zA7bC0d”
  • Encoding: Base64 for command/data transmission
  • Reconnection: Automatic retry logic after connection failures
  • Heartbeat: Periodic keepalive mechanism to maintain persistent connections

Operational Flow:

  1. Execute → hide console (ShowWindow API with SW_HIDE)
  2. Generate machine ID (MD5 hash of hostname + username + system characteristics)
  3. Establish WebSocket connection to 109.230.231.37
  4. Authenticate with AGENT_SECRET
  5. Spawn heartbeat thread for keepalive
  6. Receive/process commands via dictionary-based handler
  7. Execute via PowerShell → transmit results
  8. Auto-reconnect on failure

Business Impact: Hardcoded IP (109.230.231.37) provides critical blocking opportunity. Network traffic to this IP indicates active XWorm infection requiring immediate response.

Capabilities Analysis

PowerShell Execution

Confirmed: CAPA analysis + embedded command templates

Implementation:

ProcessStartInfo {
    FileName = "powershell.exe",
    Arguments = "-NoP -C <command>",
    UseShellExecute = false,
    RedirectStandardOutput = true,
    RedirectStandardError = true,
    CreateNoWindow = true,
    WindowStyle = Hidden
}

Capabilities Enabled:

  • Credential harvesting (Invoke-Mimikatz, LSASS dumping)
  • Lateral movement (Invoke-Command, WMI/WinRM)
  • Data discovery (Get-ChildItem, Select-String recursive file searches)
  • Privilege escalation (PowerUp, PowerSploit exploitation frameworks)
  • Persistence (Registry, scheduled tasks, WMI event subscriptions)
  • Anti-forensics (log clearing, timestamp manipulation, evidence destruction)

System Reconnaissance

Confirmed: CAPA T1082, T1033, T1087, T1057, T1007

Information Collected:

  • OS version, architecture, .NET runtime (T1082)
  • Hostname, machine ID via MD5 fingerprinting (T1082)
  • Username, administrator privileges via IsInRole() (T1033)
  • Local IP address (T1016)
  • Domain membership, domain role via WMI (T1016)
  • Running processes via Get-Process (T1057)
  • Running services via Get-Service (T1007)

Business Impact: Enables targeted post-exploitation based on victim value assessment (domain membership + admin privileges = high priority target for further exploitation).

File Download & Payload Delivery

Confirmed: CAPA - WebClient.DownloadFile

Multi-Stage Attack Chain:

XWorm v2.4.0 (15.8KB initial access)
    ↓ reconnaissance
AsyncRAT plugin (credential harvesting, lateral movement)
    ↓ privilege escalation
LockBit Black ransomware (encryption + exfiltration)

78% of XWorm campaigns deploy secondary payloads, making this capability CRITICAL for risk assessment.

Stealth & Evasion

Confirmed Techniques:

  1. Hidden Console: ShowWindow(hWnd, 0) - SW_HIDE
  2. Base64 Encoding: Obfuscates C2 traffic and configuration data
  3. Small Footprint: 15.8KB binary size evades size-based heuristics
  4. .NET Obfuscation: Compiled Intermediate Language (IL) increases reverse engineering difficulty

XWorm v6.0 Advanced Evasion (NOT in this v2.4.0 sample):

  • AMSI bypass (disables PowerShell script inspection)
  • ETW tampering (prevents Script Block Logging)
  • Process injection, DLL side-loading

Reality Check: This v2.4.0 sample uses basic stealth suitable for mass distribution. Detectable by:

  • Modern EDR with .NET process monitoring
  • PowerShell Script Block Logging (if enabled)
  • Network analysis for WebSocket C2 to non-whitelisted destinations
  • YARA rules for authentication secret patterns

XWorm Family Threat Intelligence

Historical Context

Timeline:

  • Mid-2022: XWorm first appears on dark-web marketplaces (MaaS model)
  • 2023: Rapid iteration (v4.x → v5.x) adds modular capabilities
  • H1 2024: Used in Russian state-sponsored attacks against Ukraine (Ukrainian State Service reporting)
  • June 4, 2025: XWorm v6.0 released - “fully re-coded, RCE-Fixed, AMSI bypass, ETW tampering”
  • January 2026: v2.4.0 sample discovered (this analysis) - mid-generation variant still actively deployed

Scale: 18,459 devices compromised in single builder campaign (global threat)

Delivery Mechanisms

  • Email phishing (.vbs, .bat, .ps1, .hta, Office macros)
  • Drive-by downloads (compromised websites, exploit kits)
  • ClickFix social engineering (fake error messages → PowerShell execution)
  • Software supply chain (pirated software bundles, cracks, keygens)
  • Open directories (109.230.231.37 infrastructure - CONFIRMED for this sample)
  • Malvertising (malicious ads redirecting to XWorm downloads)

Multi-Malware Ecosystem

Campaign Statistics:

  • 78% of XWorm campaigns deliver additional malware
  • 60%+ of secondary payloads are RATs (AsyncRAT, QuasarRAT, DcRAT, NjRAT)
  • 25% involve ransomware (LockBit Black, Conti, Hive)
  • 15% deploy infostealers (RedLine, Raccoon, Vidar)

Common Attack Chain:

XWorm RAT → AsyncRAT → LockBit Black ransomware

Threat Actor Usage:

  • Commodity cybercriminals (60% - financial gain)
  • Initial access brokers (10% - selling credentials)
  • Ransomware affiliates (25% - LockBit deployment)
  • State-sponsored groups (5% - Ukrainian intelligence reporting on Russian usage)

MITRE ATT&CK Mapping

Tactic Technique ID Technique Name Confidence
Execution T1204.002 User Execution: Malicious File CONFIRMED
Execution T1059.001 Command and Scripting Interpreter: PowerShell CONFIRMED
Persistence T1547.001 Registry Run Keys / Startup Folder LIKELY (plugin)
Defense Evasion T1564.003 Hide Artifacts: Hidden Window CONFIRMED
Defense Evasion T1027 Obfuscated Files or Information CONFIRMED
Defense Evasion T1562.001 Impair Defenses: Disable Tools (AMSI/ETW) NOT IN v2.4.0 (v6.0 feature)
Credential Access T1056.001 Input Capture: Keylogging LIKELY (PowerShell capability)
Discovery T1082 System Information Discovery CONFIRMED
Discovery T1033 System Owner/User Discovery CONFIRMED
Discovery T1057 Process Discovery CONFIRMED
Discovery T1007 System Service Discovery CONFIRMED
Discovery T1482 Domain Trust Discovery CONFIRMED
Collection T1005 Data from Local System CONFIRMED
Collection T1113 Screen Capture LIKELY (PowerShell capability)
Command and Control T1071.001 Application Layer Protocol: Web Protocols CONFIRMED (WebSocket)
Command and Control T1132.001 Data Encoding: Standard Encoding CONFIRMED (Base64)
Command and Control T1105 Ingress Tool Transfer CONFIRMED
Exfiltration T1041 Exfiltration Over C2 Channel CONFIRMED
Impact T1486 Data Encrypted for Impact LIKELY (campaign context - LockBit)

Dynamic Analysis Findings

Execution Environment

Analysis conducted in isolated Windows 10 virtual machine (FlareVM) with FakeNet-NG network simulation

Behavioral Observations

Process Execution:

  1. Initial Execution: agent_xworm_v2.exe executed cleanly without errors (PID 6428)
  2. Process Lifetime: Process remained running for duration of observation (23+ minutes)
  3. Console Visibility: No visible console window appeared (hidden window CONFIRMED)
  4. Child Processes: No child processes spawned during initial execution (C2 offline)
  5. Resource Utilization: Minimal CPU and memory footprint (<5MB RAM, <1% CPU)

Network Activity:

  • NO network connections established (Volatility netscan.txt confirms empty network state)
  • Analysis: C2 server 109.230.231.37 was unreachable during analysis
  • Expected Behavior: Outbound WebSocket connection attempt to ws://109.230.231.37
  • Implication: Malware has no fallback C2 domains (single point of failure)

File System Activity:

  • NO persistence mechanisms established during this execution
  • NO files created in %APPDATA%, %TEMP%, or startup directories
  • Analysis: Persistence may require successful C2 connection and operator command

Registry Activity:

  • NO registry modifications detected
  • Standard .NET Framework configuration queries observed (normal for .NET applications)

Memory Analysis (Volatility):

  • Process visible in memory (PID 6428, parent cmd.exe PID 1804)
  • No injected code or hollowed processes detected
  • Clean process tree structure

Detection Strategies

Network-Based Detection

High-Confidence Indicators:

  1. WebSocket Connection to 109.230.231.37 - CRITICAL IOC
  2. WebSocket connections from non-browser .NET processes
  3. Long-lived WebSocket connections to external IPs (heartbeat pattern)
  4. Base64-encoded payloads in WebSocket frames

Suricata/Snort Rule:

alert tcp $HOME_NET any -> 109.230.231.37 any (
    msg:"MALWARE XWorm RAT v2.4.0 C2 Connection";
    flow:to_server,established;
    reference:sha256,f8e7e73bf2b26635800a042e7890a35f7376508f288a1ced3d3e12b173c5cb7e;
    classtype:trojan-activity;
    sid:1000020;
    rev:1;
)

Endpoint-Based Detection

PowerShell Logging: Enable PowerShell Script Block Logging (Event ID 4104) to capture reconnaissance commands:

Get-Process | Sort CPU -Desc
Get-Service | ?{$_.Status -eq 'Running'}
Get-WmiObject Win32_ComputerSystem

EDR Detection Logic:

  1. Process: agent_xworm_v2.exe OR matching hash
  2. Behavior: Hidden window + network connection
  3. Child: PowerShell with -NoP -C flags
  4. Action: Alert + isolate endpoint

Hash-Based Detection

Deploy immediately:

  • SHA256: f8e7e73bf2b26635800a042e7890a35f7376508f288a1ced3d3e12b173c5cb7e
  • MD5: 4164a1945d8373255a5cb7e42f05c259
  • SHA1: 7c624e0b11c817d516f9411972191c4627fd2e53

Incident Response Procedures

Priority 1: Immediate Response (0-4 hours)

CRITICAL Actions:

  1. ISOLATE infected systems (disable network adapter, preserve memory)
  2. BLOCK C2 IP 109.230.231.37 at network perimeter - MANDATORY
  3. PRESERVE evidence (memory dumps, disk images, network pcaps)
  4. ALERT leadership (CISO, IT Director) of CRITICAL XWorm RAT infection
  5. HUNT enterprise-wide for file hashes and C2 connections

Priority 2: Investigation (4-24 hours)

Threat Hunting:

  • Search all endpoints for SHA256 hash
  • Review firewall logs for connections to 109.230.231.37
  • Search PowerShell logs for reconnaissance patterns
  • Identify all users on infected systems during infection window

Credential Rotation Scope:

  • ALL users who authenticated to infected systems (MANDATORY)
  • Service accounts accessible from infected systems
  • Privileged accounts enterprise-wide (if infected system had admin access)

Priority 3: Remediation Decision

REBUILD STRONGLY RECOMMENDED:

  • Complete system wipe and clean OS installation from trusted media
  • Restore user data from pre-infection backups (after malware scanning)
  • MANDATORY credential rotation for all affected users
  • Deploy enhanced monitoring for 30 days post-rebuild

Cleanup NOT RECOMMENDED due to:

  • XWorm modular architecture (unknown plugins may have loaded)
  • 78% multi-malware campaign rate (AsyncRAT, LockBit indicators required)
  • 10-20% residual risk of hidden persistence mechanisms

Frequently Asked Questions

Q: Why is the C2 server offline?

A: XWorm infrastructure is ephemeral - C2 servers are activated for specific campaigns and deactivated after distribution. Open directory (109.230.231.37) was distribution point; actual C2 may have been different infrastructure or campaign may have concluded.

Q: What makes XWorm v2.4.0 different from v6.0?

A: v2.4.0 (this sample) uses basic evasion (hidden console, Base64 encoding) and is detectable by modern EDR. v6.0 (June 2025 release) includes AMSI bypass and ETW tampering, making PowerShell logging and runtime analysis significantly more difficult. Organizations should treat v6.0 variants as CRITICAL upgrades requiring enhanced detection.

Q: Should we rebuild infected systems?

A: YES - REBUILD STRONGLY RECOMMENDED. XWorm’s modular architecture means unknown plugins may have been loaded. 78% of campaigns deliver secondary malware (AsyncRAT, LockBit). Cleanup has 10-20% residual risk. Industry best practice (NIST SP 800-83) strongly recommends rebuild for RAT infections.

Q: What are compliance implications?

A: Significant violations possible:

  • GDPR: 72-hour breach notification for EU citizen data
  • HIPAA: PHI exposure triggers HHS notification
  • PCI-DSS: Forensic investigation, potential fines for payment card data exposure
  • SOX: Financial data integrity concerns require attestation

Q: How to detect if antivirus fails?

A: Behavioral detection:

  • Enable PowerShell Script Block Logging (Event ID 4104)
  • Deploy EDR monitoring .NET processes with hidden windows + network activity
  • Network analysis for WebSocket C2 to non-whitelisted destinations
  • Hunt for “AgentSec_” authentication secret patterns in memory

IOCs

Detections

Research Sources

[XWorm Malware: Analysis, Detection, Removal Huntress](https://www.huntress.com/threat-library/malware/xworm)
[XWorm Rises Again: Dissecting the Modular Malware’s V6 Resurrection Picus Security](https://www.picussecurity.com/resource/blog/xworm-rises-again-dissecting-the-modular-malwares-v6-resurrection)
[18,459 Devices Compromised Worldwide Via XWorm RAT Builder MSSP Alert](https://www.msspalert.com/brief/18459-devices-compromised-worldwide-via-xworm-rat-builder)
[XWorm RAT analysis: Steal, persist & control Logpoint](https://logpoint.com/en/blog/xworm-rat-analysis-steal-persist-control)
[XWorm (Malware Family) Malpedia](https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm)

License

© 2026 Joseph. All rights reserved. Free to read, but reuse requires written permission.