Threat Anatomy

• #012 Decoding XWorm: Command and Control MalwareMay 2, 2025
  6 min In this article, the last in the XWorm series, we analyze its Command and Control capabilities.
• #011 Decoding XWorm: Communication via Telegram and Retrieval of New Variant MalwareApr 16, 2025
  4 min In this article, we explore how XWorm reports back to its operators and how it retrieves new variants of itself.
• #010 Decoding XWorm: Keylogger and Cryptocurrency Capture MalwareMar 19, 2025
  8 min In this article, we explore how XWorm intercepts cryptocurrency transactions intended for other wallets, as well as its ability to capture keystrokes …
• #009 Decoding XWorm: Lateral Movement MalwareFeb 18, 2025
  7 min In this article, we explore how XWorm uses USBs to spread to other machines.
• #008 Decoding XWorm: Defense Evasion and Persistence MalwareJan 22, 2025
  5 min In this article, we explore how XWorm evades defenses and establishes persistence.
• #007 Decoding XWorm: Initial Exploration and Anti-Analysis Techniques MalwareJan 14, 2025
  8 min In this article, we explore how XWorm employs obfuscation, encryption, and anti-analysis techniques to evade detection.
• #006 Decoding XWorm: Introduction MalwareJan 10, 2025
  7 min In this first article of the XWorm series, we explore the basics of analyzing this RAT (Remote Access Trojan). We identify the type of binary, analyze …
• #005 Analyzing a C2 agent - Part 3: the agent - Dynamic analysis MalwareFeb 12, 2024
  8 min In this article we will dynamically analyze the C2 agent we previously obtained and evaluate ways to interact with it in order to understand how it …