What is XWorm Official?

XWorm Official tracks versions, IOCs, news, changelogs, and MITRE techniques in 38 pages, helping defenders study malware changes and threats.

IOC Intelligence Database

XWorm Indicators of Compromise

A searchable, filterable, exportable database of XWorm indicators. All malicious infrastructure is defanged for safe display.

IOC disclaimer

An IOC is evidence of a historical observation, not permanent proof of maliciousness. Domains and IP addresses can change ownership, infrastructure changes rapidly, and file hashes represent specific samples. Always verify against live sources before action.

9 indicator(s) · defanged for safe display

Indicator	Type	Version	Campaign	First Seen ↓	Last Seen	Source	Conf.	Status	Notes
XWormMutex_7_4	mutex	7.4	Sandbox observations	2026-04-02	2026-04-02	ANY.RUN	high	active	Mutex artifact observed in 7.4 sample (illustrative).
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\XWorm	registry	7.4	Sandbox observations	2026-04-02	2026-04-02	ANY.RUN	high	active	Registry autorun persistence.
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\xworm.lnk	filename	7.4	Sandbox observations	2026-04-02	2026-04-02	ANY.RUN	high	active	Startup-folder persistence artifact.
UD_XWormClient 7.2	filename	7.2	Fortinet Feb 2026	2026-02-10	2026-02-10	FortiGuard Labs	confirmed	active	Version-info string identified in 32-bit .NET payload.
xworm-update[.]ru	domain	7.2	Fortinet Feb 2026	2026-02-10	2026-02-10	FortiGuard Labs	high	active	Defanged C2 domain (illustrative).
45[.]133[.]1[.]99	ip	7.2	Fortinet Feb 2026	2026-02-10	2026-02-10	FortiGuard Labs	high	active	Defanged C2 IP (illustrative).
c2[.]xworm-example[.]com:443	url	6.0	XCoderTools 6.0	2025-06-04	2025-08-01	Trellix	medium	retired	Defanged C2 endpoint (illustrative).
xworm-builder[.]net	domain	6.0	Trojanized builder	2024-01-01	2024-12-01	CloudSEK	high	retired	Defanged domain associated with trojanized builder distribution (illustrative).
EvilCoder_Project.exe	filename	2.x	Early ecosystem	2022-08-19	2022-08-19	Cyble	high	retired	Early EvilCoder project artifact.

Live IOC Sources

This database is maintained from reputable sources including:

URLhausMalwareBazaarThreatFoxANY.RUNTriageMicrosoft Security IntelligenceFortinetTrellixProofpointPalo Alto NetworksCyble

Never republish third-party proprietary data contrary to licensing terms.

Count semantics

Distinguish sample count, URL count, endpoint infection count, victim count, and campaign count. As of the research snapshot, URLhaus reported 1,188 unique XWorm payloads and 1,101 associated URLs — these are database figures, not worldwide infection totals.