XWorm RAT Delivered via Shellcode: Multi-Stage Attack Analysis

Description

This analysis details a sophisticated multi-stage attack delivering the XWorm RAT. The campaign begins with a phishing email containing a malicious .xlam file. The file harbors embedded shellcode that, when executed, retrieves a secondary payload. This payload is a .NET binary that reflectively loads a DLL into memory. The DLL, heavily obfuscated and encrypted, injects another DLL using reflective injection. The final stage involves process injection into the main executable, establishing persistence and exfiltrating data to Command & Control servers associated with the XWorm family. The attack chain demonstrates advanced evasion techniques, including the use of shellcode, steganography, and multiple stages of reflective DLL injection.