Obfuscated JavaScript Downloader Linked to XWorm and AsyncRAT Infrastructure
Summary
Researchers traced an obfuscated JavaScript downloader using paste.ee to XWorm and AsyncRAT command-and-control infrastructure, detailing malware behavior, related hosts and ports, IOCs, and detection and mitigation approaches.
Key points
- The investigation began with a small, obfuscated JavaScript file found in MalwareBazaar submissions; it removes unusual Unicode characters to reconstruct an HTTP request to paste.ee and executes the response.
- Analysis of downloaded payloads identified XWorm, which can log keystrokes, collect system information, and maintain encrypted, persistent C2 access.
- Researchers linked XWorm and AsyncRAT activity to several IP addresses, including 45.145.43.244, 66.63.187.154, 66.63.187.232, and 196.251.118.41.
- Ports 6606, 7707, and 8808 were associated with the reported C2 infrastructure; the article says some AsyncRAT-related certificates and services were observed from February 2025.
- The report shares a paste.ee URL pattern for hunting, SSL certificate fingerprinting observations, and file hashes as detection leads.
- Recommended defenses include blocking identified malicious URLs and infrastructure, monitoring unusual connections and obfuscated scripts, and keeping security software updated.
Article Details
- Attack Vectors
- An obfuscated JavaScript downloader uses unusual Unicode characters to conceal its commands, retrieves code from a paste.ee URL, and executes the response.
- The downloaded payload was identified as XWorm, which can log keystrokes, collect system information, and maintain remote access through C2 servers.
- The report identifies AsyncRAT C2 infrastructure on ports 6606, 7707, and 8808.
- Defensive Notes
- Monitor for obfuscated JavaScript and unusual connections to paste.ee, especially links matching the reported URL pattern.
- Monitor for suspicious traffic on ports 6606 and 7707, and block the identified malicious URLs and C2 indicators.
- Keep security software up to date and exercise caution with email links to paste services.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | abuwire123[.]ddns[.]net | Domain decrypted from the XWorm configuration and used by XWorm. |
| DOMAIN | abuwire123[.]duckdns[.]org | Domain listed in the report's XWorm and AsyncRAT infrastructure indicators. |
| DOMAIN | abuwire123h[.]ddns[.]net | Domain listed in the report's XWorm and AsyncRAT infrastructure indicators. |
| IPV4 | 196[.]251[.]118[.]41 | Reported AsyncRAT C2 infrastructure. |
| IPV4 | 45[.]145[.]43[.]244 | Reported XWorm-related C2 infrastructure; AsyncRAT was also observed on ports 6606 and 7707. |
| IPV4 | 66[.]63[.]187[.]154 | Reported AsyncRAT-related infrastructure; the article also associates it with an AsyncRAT variant or AsyncRAT itself. |
| IPV4 | 66[.]63[.]187[.]232 | Reported XWorm C2 infrastructure; AsyncRAT was also associated with this IP. |
| MD5 | 6e976623d02e20d1b83e89fecd31215b | Hash listed for XWorm in the report's IOC table. |
| MD5 | bd4952489685f6a76fe36fc220821515 | Hash listed for the JavaScript file in the report's IOC table. |
| URL | hxxp[:]//paste[.]ee/d/s1uVin8i/0 | URL contacted by the malicious JavaScript downloader to retrieve and execute code. |
| URL | hxxps[:]//paste[.]ee/d/s1uVin8i/0 | Exact paste.ee URL identified in the IOC table as malicious payload hosting. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe downloader conceals its functionality with unusual Unicode characters inserted into strings.T1056.001 · KeyloggingXWorm records keyboard input across the system.T1059.007 · JavaScriptThe malicious JavaScript downloader reconstructs commands and executes retrieved code.T1105 · Ingress Tool TransferThe script retrieves code from a paste.ee URL for execution.
Malware
AsyncRAT80, which is running Nginx 1.24.0. More concerning are ports 6606 and 7707, both flagged for hosting AsyncRAT, a well-known remote access trojan. These ports were first detected in February 2025.Remcos RATIt was immediately flagged with the RemcosRAT signature and caught our attention due to its deceptive filename: "DOCUMENT FOR DELIVERY INFORMATION.js". At just under 3KB, it may look harmless, but its behavior andXWormFurther analysis revealed links to XWorm, a stealthy RAT with capabilities like keystroke logging, data exfiltration, and persistent remote access. In this report, we detail how we traced the activity, extracted IOCs,
Tools
dnSpyseveral malicious PE files that were both encoded and reversed. After decoding a file and loading it into dnSpy for analysis. Upon decrypting the encrypted configuration, we identified the malware as XWorm.httpxAfter we have this clean list, we use another tool called httpx from ProjectDiscovery to check the status of each URL. Basically, we want to see which sites are up and responding with a 200 OK status, because thesejqobjects, each with URLs and some extra info. To get just the URLs, we use a handy command-line tool called jq. Running this command: