Tag: reflective dll injection

2 Attack Reports | 0 Vulnerabilities

Attack reports

XWorm RAT Delivered via Shellcode: Multi-Stage Attack Analysis

This analysis details a sophisticated multi-stage attack delivering the XWorm RAT. The campaign begins with a phishing email containing a malicious .xlam file. The file harbors embedded shellcode that, when executed, retrieves a secondary payload. This payload is a .NET binary that reflectively loa…

multi-stage attack

reflective dll injection

Published: September 29, 2025

Downloadable IOCs: 8

NSIS Abuse and sRDI Shellcode: Anatomy of the Winos 4.0 Campaign

A malware campaign using fake software installers to deliver Winos v4.0, a memory-resident malware, has been tracked throughout 2025. The campaign, dubbed Catena, employs trojanized NSIS installers, reflective DLL loading, and shellcode-embedded INI files to evade detection. It stages payloads enti…

chinese-speaking targets

memory-resident malware

reflective dll injection

trojanized installers

Published: May 27, 2025

Downloadable IOCs: 31

Click here to see more Attack Reports